Slashdot Mirror
Researchers Find Methods For Bypassing Google's Bouncer Android Security
Trailrunner7 writes "Google's Android platform has become the most popular mobile operating system both among consumers and malware writers, and the company earlier this year introduced the Bouncer system to look for malicious apps in the Google Play market. Bouncer, which checks for malicious apps and known malware, is a good first step, but as new work from researchers Jon Oberheide and Charlie Miller shows, it can be bypassed quite easily and in ways that will be difficult for Google to address in the long term. Oberheide and Miller, both well-known for their work on mobile security, went into their research without much detailed knowledge of how the Bouncer system works. Google has said little publicly about its capabilities, preferring not to give attackers any insights into the system's inner workings. So Oberheide and Miller looked at it as a challenge, an exercise to see how much they could deduce about Bouncer from the outside, and, as it turns out, the inside."
..Is that what they call themselves these days?
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
This is why I hate Android in the corporate environment. While I love open technology for personal uses, trying to manage corporate security with Android in the mix is a nightmare. I can have a nice pretty policy that makes upper management happy but I have no really good way of enforcing it. For the pain in the butt that Blackberry is, it was designed around corporate security. Apple is a step above Android in this regard, but it is still not designed with corporate use in mind.
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
If you are simply willing to wait until X date or something you can always slip an app past any filter like this.
The one hope here is that the sandboxing will save you from evil behavior, since an app should not be able to do anything its permissions do not allow.
This is so obvious I'm surprised it has to be stated. It is no different from the situation in iOS either. Everyone always knew there were dozens of methods one can use to bypass these gatekeepers.
And here I thought researchers were looking for a way to break into the secret google night clubs. Everyone knows that's where all the cool nerds are.
Keeping this analogy, it does seem about as effective as an actual bouncer. While most drunken retards are being thrown out on the streets, the dangerous, more vile types get to stay inside and ultimately take drunk chicks home. I suppose it's nice to have less people throwing up on you, but getting stabbed at a nightclub is still getting stabbed at a nightclub. I suppose you could draw the argument that there's a pat-down and weapons check at the door, but let's be real, if you were going to bring a weapon to hurt someone in the first place, you'd be smart enough to hide it and get in.
If that didn't make sense to you (lack of cars, etc...), basically this means bouncer will only affect poor malware writers and the big-boys will just skirt around the security anyways. Which really means little, because I'd rather get rid of the big players and be stuck with a bunch of obvious annoyances than to remove the annoyances and have a false sense of security about my apps. I should give google credit though, at least it's a start. Hopefully by this time next year they'll have managed to match common sense 2014 in terms of malware protection.
While browsing the Google Play store, I have started to notice a number of apps that have 1000+ good reviews, all rather pithy like "Amazing", or "!!!".
You then tap "Download" to look at the permissions, and the app asks for everything under the sun, even though the app might be a game or a utility that does one thing, and has zero need to be able to read and write contacts.
Of course, for users who know what they are doing, stuff like this is as close to a Trojan as one can get, or at best some basic game coupled with a malware payload. However, for novice users who just want to use a phone and who think permissions are something to obtain from their teacher so they can go use the bathroom, the phrase, "babe in the woods" comes to mind.
I hate lobbing brickbats at Google since I like the Android ecosystem and Android phones. Android even has a stronger security model than iOS. However, Apple does one thing which precludes the need for that much security in iOS, and that is to be an active and stern gatekeeper. iOS devs don't get their app stomped, then one hour later turn up again with the same app under a different name.
Google needs to get on the ball and make two tiers of their Play Store. The first (default) tier would be like Amazon, where all apps are not just sent past a rudimentary scanner, but are actively vetted. This includes not just the original version of the app, but any updates, so malware can't be slipped in.
To boot, a higher fee is charged to play in this game, partially to offset the cost of the enhanced filtering, and partially to discourage people from making accounts and trying to palm off the same malware-ridden app under different names.
In the top tier, Google would need have some very stringent policies. For example, if an app gets rejected by account "A", submitting the exact same app under account "B" with slight changes mean that account "B" gets suspended for the first offense, and closed down for good after the second.
Of course, Google can keep their second tier (which would be the same as Google Play now), but maybe put up some sort of warning for a user that once they exit the vetted tier, they are essentially on their own, so do what is needed at their own risk. This tier is one step up from just downloading an app via a website and sideloading it, but it is better than no security.
Google needs to do something here, because the malicious apps are causing issues, not just in China, but here in the US. Already, Android's reputation is being tarnished by something that is not the OS's or hardware maker's fault, and Google needs to step up to the plate and do the role of active gatekeeper unless they want to see customers abandon the platform for ones with a better gate guardian, even though it means people buying far locked down devices.
Bouncer just isn't going to cut it.
Just FYI, Bouncer is a system they use to scan the Google Play market. It has nothing to do with the OS's security as the title seems to imply.
And every time they're caught, the app will be pulled, uninstalled from people's handsets, and if the people want to continue malicious activity, they will need to pay another dev fee to make a new account and continue putting malware on the store. Malware authors typically operate on small margins from what I have read (no convenient sources, please if you have one post it), so the break-even point might be high enough that they can't make money on it.
It reminds me of an anti-spam solution proposed years and years ago: Make a new email system in which it costs a penny to send an email. This is low enough that normal users don't care, but high enough that spammers' conversion rates of 1/12,000,000 (from Wikipedia) aren't enough to let them keep spamming for V14GR4.
And many apps require way more permissions than they ought to.
Any advertising-supported will need at least "Coarse location" to determine which advertisements are relevant, and "Internet" to download newly placed advertisements, and "Device state and identity" to make a unique user identifier so that each user sees relevant advertisements. How would you recommend funding the development of a free (as in beer) application without those permissions? Not all countries have paid applications. Or if I misguessed to which permissions you were referring, then to which permissions were you referring?
Wow. At first I was going to not RTFA and just say this would be something we have all known for over 20 years: blacklist fingerprint malware scanners are a dumb idea and guaranteed to not work, whether we're talking about Windows PCs in 1995 or smartphones in 2015.
But actually Google is doing something pretty interesting. They run malware deliberately, inside a sandboxed emulator, and then target behavior rather than appearance (a signature). That's good. It's not rigorous but it's a good idea for finding things. (Yeah, I know.. I bet the AV companies already do the same sorts of things.)
The main flaw in their plan was that the emulator makes network requests from a predictable range, so a server that the malware contacts, can tell the malware whether or not it's inside the emulator or in the wild. If you're inside the emulator (or anywhere else where you decide you'd rather bide your time than deliver payload just yet), act nice.
Google can probably take countermeasures against that, although they would never be able to effectively hunt for malware which is intended to deliver nasty payloads against some particular target. You can't ever detect behavior that you don't know how to trigger.
If the bomb only explodes when it's near Joe, then if-it-exploded-then-blacklist isn't going to work unless Joe's emulator is what is doing the testing.
Will be fun to see them speak at SummerCon [http://summercon.org/] this week. I'm more interested in hearing about Space Pope [http://futurama.wikia.com/wiki/Space_Pope] .
"boy they are nice, but it sure is easier for administrators to have a mainframe or at least a bunch of diskless workstations with a Novell box"
The thing is, with Android being open, this can be done without Google doing it.
But not generically! The fundamental flaw with your argument can bee easily seen simply by fully qualifying what you are saying:
"The way to solve security issues for novices is by someone building a more secure store, which of course will have to be the default store and replace the App Market for the novice users to find it".
That means not just anyone can do this - it has to be a device maker. So far the only example I can think of is Amazon, which is OK for tablets but doesn't address the smartphone market at all - again, for novice users.
I prefer Google's solution rather than Apple's.
I prefer Apple's because I have other technological things I'd rather play with than maintain a proper level of security on my phone.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
In what way do you think of the Android security model as "stronger"? It is at best equivalent, but since it includes things like attached storage as part of the fundamental system it has vectors of potential exploit iOS does not have at all.
The Android security model is also MUCH weaker in terms of real-world user security around device resources. Asking a user what permissions an app should be allowed before they run it makes no sense to me; far better is the iOS permission model where it asks on first attempt to use a protected resource. Then you as a user have the context you need to grant that permission or not.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
>Google has said little publicly about its capabilities, preferring not to give attackers any insights into the system's inner workings.
All your ghosts are just false positives.
Blackberry sucks, BES is terrible and I am glad to see them go.
womens sexy lingerie |
Reading your posts, you are equating lock screen policies on Android/iOS with BB's security model? lol
I pity the company that employs you for their IT needs.
http://en.wikipedia.org/wiki/Comma#Uses_in_English