New Android Malware Uses Google Play Icon To Trick Users

This is why you want a walled-off app store by Anonymous Coward · 2012-12-27 11:56 · Score: 1, Insightful

Because people will download and run apps from that store.

And there's little/no AV protection.

Re:This is why you want a walled-off app store by masternerdguy · 2012-12-27 12:06 · Score: 4, Interesting

Actually the android sandbox is quite sophisticated. Jellybean will randomize the location of an application's memory region in order to make buffer overflow attacks harder. Granular permissions allow a user to know exactly what an app wants to do before they even install it (it's written into the API that the app must ask for these permissions). Also Google does automated malware testing on their store in order to weed out undesirables. This thing is spread by installing an APK off of a warez site and ignoring all the scary warnings.

--
To offset political mods, replace Flamebait with Insightful.
Re:This is why you want a walled-off app store by Anonymous Coward · 2012-12-27 12:13 · Score: 4, Interesting

Not to mention that by default you aren't allowed to install an APK from a source besides the play store, you have to manually disable that restriction.
Re:This is why you want a walled-off app store by Anonymous Coward · 2012-12-27 12:14 · Score: 3, Insightful

Because people will download and run apps from that store.
And there's little/no AV protection.
There is very little AV protection against users. They are the weakest link, but we can't have successful software companies without end users.
Re:This is why you want a walled-off app store by Anonymous Coward · 2012-12-27 12:37 · Score: 1, Informative

Actually the android sandbox is quite sophisticated. Jellybean will randomize the location of an application's...
It's too bad that it was released in June 2012, and still, nobody has it. So while I'm sure newer versions of Android are much improved, but it doesn't much matter to anyone if the horrible manufacturers won't put an ounce of effort into maintaining the devices.
Re:This is why you want a walled-off app store by alostpacket · 2012-12-27 12:47 · Score: 4, Insightful

Yes but this uses an official ICON. Clearly no way to forge that. I've never seen anyone think to use logos or icons for nefarious purposes before. Luckily I am protected here on my Windows 7 machine. I clicked an ad using the Windows 2000 theme that alerted me to major potential threats in my "regisetery"... Had a similar experience on my Macbook Air. Thank goodness for the altruism of all those interwebs ads and sites.
In all seriousness though, this could be a problem for people who root/ROM and install their Google apps from sources other than Google. Granted, when you root/ROM you should be aware of the risks, but it still presents a small danger.
Many Google apps however request permissions that need the app be signed with the same key as the ROM and/or the system key.
See: http://developer.android.com/guide/topics/manifest/permission-element.html#plevel

"signature"
A permission that the system grants only if the requesting application is signed with the same certificate as the application that declared the permission. If the certificates match, the system automatically grants the permission without notifying the user or asking for the user's explicit approval.
"signatureOrSystem"
A permission that the system grants only to applications that are in the Android system image or that are signed with the same certificate as the application that declared the permission. Please avoid using this option, as the signature protection level should be sufficient for most needs and works regardless of exactly where applications are installed. The "signatureOrSystem" permission is used for certain special situations where multiple vendors have applications built into a system image and need to share specific features explicitly because they are being built together.

--
PocketPermissions Android Permission Guide
Re:This is why you want a walled-off app store by rjr162 · 2012-12-27 12:55 · Score: 4, Informative

....
My Samsung galaxy s3 (gt-i9000) received the 4.1.1 update about 3 or so months ago (from samsung). My neighbors Motorola atrix 2 or whatever received the 4.1.2 update about 2 months or so ago (He has verizon). The Motorola xoom I got my grand father also has received 4.1.1 iirc when I set it up for him after I received it from eBay about 3 weeks ago
Re:This is why you want a walled-off app store by Anonymous Coward · 2012-12-27 13:15 · Score: 1

It shouldn't have even taken that long though. When Google releases an Android update, it trickles down to the phone manufactures like Samsung who put their tweaks into the code. Samsung in particular seems pretty fast about it (and I'm sure they get access to the pre-release source as well to speed up go-to-market time).
The real bottleneck are the carriers who absolutely drag their feet. AT&T (my carrier) took several months to do what is basically just adding in their bloatware and spyware garbage into Samsung's release of Jellybean - something that should realistically take a couple of weeks at most. That is why I'm running CM10.
AT&T just released 4.1 to the S3 a couple of weeks ago after months of waiting. What sucks about that is 4.2 is already out. 4.1, while still usable and relevant, is already out of date.
While I prefer Android personally on my phone, this is one area in particular where Apple has an edge. iOS updates don't go through this nonsense.
I hope Google can do something to get the carriers to cut out their bullshit, otherwise this is one area that is hurting Android's perception.
Re:This is why you want a walled-off app store by screwdriver · 2012-12-27 13:24 · Score: 2

It does sound more like a proof of concept than an actual attack.
Re:This is why you want a walled-off app store by BitZtream · 2012-12-27 13:42 · Score: 1

ASR is cute, but only stops the most trivial of exploit efforts. And this isn't exploiting anything other than the user so ASR is 100% useless.
Granular permissions in the style of Android are practically useless and heres why, a statement from my wife just last night as she played with her Nexus 7:
Does anyone even say no to these permissions since every app wants a bunch of them and you can't use it without click yes?
When every app including crap from Google asks for all sorts of shit, like access to your freaking call log, normal people quickly just click Ok instead of bothering with actually determining the permissions are needed. They've done the same thing as Microsoft. Made the 'security feature' so utterly obnoxious as to be practically useless.
How about letting the app run WITHOUT those permissions? Why do I have to decided if I want an app or not based on the fact that it wants access to my call log at install time rather than saying 'no, you cant see me call log' and still getting the app? Why can I not use the app but tell it to go fuck itself when it wants access to my contacts?
The answer is simple. Google doesn't actually want it to be too secure as that would prevent them from getting all the information they want to target you.
Its really not a great sandbox other than it functions the way it was intended. From a user perspective, its pretty shitty.

--
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
Re:This is why you want a walled-off app store by erroneus · 2012-12-27 14:12 · Score: 3, Insightful

Indeed this is the most significant truth of it all.
In iOS land alone are users "not responsible for their actions." For people to go around installing malware on PCs is a known problem. Save MSIE vulnerabiilities enabling drive-by installations and program execution, people install malware on their own machines.
Now if this story was about a vulnerability in Android devices which permitted this type of system compromise, we might have a much more significant story. But what we have, instead, is reaffirmation that with Android, users have freedom to install the software of their choice just as they have with MacOSX and Microsoft Windows and other Linux distributions. We also have the recognition that users are not invulnerable to attack because they are using something other than MS Windows.
Is this a sign that Android has "matured"? No. iOS is pretty mature and does not exactly suffer from such attacks. (oh wait, yes it does!) It is a sign that bad-wetware has recognized that Android is popular enough and free enough to make its users a target. At the end of the day, of course, it is the users which are being targetted and their devices, software and data are the means and the objective of the attack.
This story is useful in that it is important that everyone be aware of the risks of running any software, but especially software from dubious sources. But let's hope the real message is not lost in the hype and flag waving.
Re:This is why you want a walled-off app store by erroneus · 2012-12-27 14:19 · Score: 3, Interesting

Cricket.
I was investigating prepaid phone service options because I want to save money and prepaid service seems to be the way to do it. Once shop I visited was "Cricket." The first thing they asked was "what kind of phone do you have?" I said "unlocked GSM." They said, but we have to install our software on it... we have to flash your device before we can put it on our network. I was utterly shocked and then angered. I left before I said anything I might regret, but I will not be doing business with Cricket now or in the future. Bad enough the carriers I buy my phones from want to control my devices. Another carrier wants to modify my property so that I can be their customer.
No. And why would I object so much to that idea?
Because I don't know what they will be putting on my computer and nor will they tell me. And so for the same reason I would not do business with Cricket, I will not generally install software from unknown sources.
Re:This is why you want a walled-off app store by alostpacket · 2012-12-27 14:41 · Score: 1

Interesting. Did you get any sense of what they wanted to install? I dont know enough about that specific area but I wonder if there are any legit reasons they might do this. Maybe relating to ESN/MEID/etc, or some type of radio frequency tuning... Still, I would likely have done the same in your shoes.

--
PocketPermissions Android Permission Guide
Re:This is why you want a walled-off app store by SomePgmr · 2012-12-27 15:44 · Score: 2

S2 here. It took them a year to deploy ICS after it came out. Seven months since Jelly Bean came out will actually be a huge improvement, even though it'll already be out-of-date.
While I still prefer Android over iOS, I've learned my costly lesson... don't even consider buying an Android device that isn't a Nexus.
Also, as someone that writes software for Android, I don't like having to target Gingerbread (circa 2010) or give up half the market. Google needs to do something about the savages leeching the platform just to pump out new devices and abandon them.
Re:This is why you want a walled-off app store by bedouin · 2012-12-27 17:37 · Score: 1

I was with Cricket for a couple years. I bought a new phone from them on one occasion, and when I asked for a data cable, the salesperson asked what I intended to do with it. I answered "sync my addresses" because I knew that was the answer she was looking for . . .
When did Cricket switch from CDMA to GSM?
Re:This is why you want a walled-off app store by bedouin · 2012-12-27 17:55 · Score: 2

The main reason is probably to lock you into their store for ringtones and games. Their guise for it all would probably be so-called security. At least that's the impression I got while I was their customer.
Check this out, to actually DOWNLOAD apps from their store they made you pay some sort of extra charge. Paying them money for apps wasn't simple enough. I passed and got busy modifying the firmware in a hex editor.
If you visit a Cricket location you'll see mostly poor folks who can't pass a credit check, and Cricket milks them hard for basic features -- like caller ID. To make matters worse, their coverage rarely goes beyond the city; travel 25 miles out and bam -- no service, no roaming even. It's an all around bad deal. For me I wanted a no contract plan since I hoped to move overseas.
Trying to cancel my account was a pain. The customer service people on the phone kept offering me new deals of some sort -- totally ignoring that I've moved to an area without coverage, and I reiterated that fact repeatedly.
Re:This is why you want a walled-off app store by Anonymous Coward · 2012-12-27 18:38 · Score: 1

Samsung has always (even with the SGS1) provided enhanced features from their updates.
Stock Android 4.1 is nowhere near as capable as Samsung's 4.1. You can, of course, add in software to Stock 4.1 to add features to make it equivalent to Samsung's 4.1. There is no "edge"; Samsung is already providing you with some 4.2 features in their 4.1 firmware PLUS a bunch of other things.
There is nothing Samsung or Android needs to do with "hurting Android's perception." Most aren't even aware what version of OS their running (even if it's prominently displayed on a boot screen; I've had someone come in thinking they were running Windows XP when they were running Vista -- even though they look completely different and it clearly says "Windows XP" on boot!
The ones that are aware of the version differences (and don't buy a Nexus) are generally smart enough to realize this and don't look bad on version numbers on two separate products.
Re:This is why you want a walled-off app store by segin · 2012-12-27 19:50 · Score: 1

When you said "GSM", they should have told you your phone won't work on their network, period. This "flashing" business is because they are a CDMA carrier, and US CDMA carriers don't use removable subscriber identities, instead your network authentication details are simply programmed into a small EEPROM on the phone itself and must be reprogrammed to switch between CDMA carriers. Yes, exactly the same way the giant bricks were reprogrammed to different carriersin the 1980s. Speaking of which, it is wholly possible to have your phone service stolen by a virus on a PC just by plugging your phone into your PC, but only if it is a CDMA phone. And all CDMA phones use the very same programming method. GSM uses SIM cards with inaccessible authentication keys - why I will never use a CDMA carrier for as long as I live. Their non-LTE phones lack a SIM slot due to this, and their LTE phones are still serviceable without the SIM, albeit only on the CDMA network.
Re:This is why you want a walled-off app store by segin · 2012-12-27 19:53 · Score: 1

Cricket CDMA handsets are useless overseas. The rest of the world uses GSM, and when you do find CDMA overseas, they use CSIMs, which your phone has no slot for. Overseas carriers don't use on board NVRAM programming like in the US nor will program in service details due to security concerns.
Re:This is why you want a walled-off app store by shutdown+-p+now · 2012-12-27 19:54 · Score: 1

Stock Android 4.1 is nowhere near as capable as Samsung's 4.1. You can, of course, add in software to Stock 4.1 to add features to make it equivalent to Samsung's 4.1. There is no "edge"; Samsung is already providing you with some 4.2 features in their 4.1 firmware PLUS a bunch of other things.
Can you give an example of any features in Samsung-"improved" 4.1 that are actually useful? The only one I can think of is that set of switches (auto-rotate lock, wifi, Bluetooth etc) that they offer in the notification drawer, but this can be provided by any app in 4.1, and those apps not only exist, but are infinitely more configurable. The only other thing that comes to mind is that stupid full memory access exploit.
Of course, since Nexus devices are already at 4.2, the more appropriate way would be comparing Samsung's 4.1 (if that's what they have current? I thought it's actually still ICS for SGS2, for example) to stock Android 4.2...
Re:This is why you want a walled-off app store by bickerdyke · 2012-12-27 20:54 · Score: 1

Does anyone even say no to these permissions since every app wants a bunch of them and you can't use it without click yes?
Why should someone do that? In 99% of the installs the required permissions match the purpose of the app, so there simply is NO REASON to say no. I definitly would (and did so) say no if suddenly a simple flashlight (or in my case metronome) app asks for access to contacts, location and internet.

How about letting the app run WITHOUT those permissions? Why do I have to decided if I want an app or not based on the fact that it wants access to my call log at install time rather than saying 'no, you cant see me call log' and still getting the app? Why can I not use the app but tell it to go fuck itself when it wants access to my contacts?
The answer is simple. Google doesn't actually want it to be too secure as that would prevent them from getting all the information they want to target you.
Sorry but that's BS. The reason why those rights are asked for at install time is that they are considered as required for the app. What use would a calendar application have that is denied access to the phone calendar? So there's no need to install an app without the requirements for it to work. The actual security check is "do the required rights match the apps purpose?" if not, don't install. But that's between you and the app developer.
However, there are two improvements I'd like to see to the android permission system:
Optional Permissions.
For exactly those cases you mentioned. Stuff that's not required for the base function of an app, but only for several specific features. Those wouldn't have to be granted at install time.
Limited Internet access.
I hate that I always have to grant full internet acces just because some app is adware. Would be cool if access could be limited to the ad network in use by that app. Or limit twitter app's internet permissions to the twitter.com domain.

--
bickerdyke
Re:This is why you want a walled-off app store by erroneus · 2012-12-27 21:01 · Score: 1

All of this and the above replies are very interesting information.
I had no knowledge of their CDMA-ness. I use GSM phones.
One thing they mentioned was that they do not [yet] flash my phone model. (T-Mobile, Galaxy S2) That part didn't bother me as I was still stuck on the notion that they wanted to flash my phone at all.
I can see where they would be an "exploit the poor" type of company. It seems to fit.
Re:This is why you want a walled-off app store by segin · 2012-12-28 00:42 · Score: 1

I assume you are either not from the US, a poorly educated consumer, or an even bigger GSM zealot than I. Most US carriers use CDMA2000. Although CDMA2000 allows for removable identities, it's predecessors that are built around the same core network (AMPS, D-AMPS, and cdmaOne) do not, and as such, American CDMA carriers continue to use legacy internal authentication storage. This is for two reasons: To continue the myth that the only carrier a phone will ever work with is the one printed on the phone, making consumers believe that switching carriers will require the purchase of another expensive handset, and to control which devices are allowed to operate on the carrier network, on a device-to-device basis. The sole US carrier that actually speaks to the contrary in it's consumer advertising is T-Mobile, who advertises constantly that you can bring unlocked GSM handsets from other carriers and save money in doing so.
Re:This is why you want a walled-off app store by synapse7 · 2012-12-28 01:04 · Score: 1

Manually disabling is my favorite part.
Re:This is why you want a walled-off app store by synapse7 · 2012-12-28 01:07 · Score: 1

I'm curious what it is in Jelly Bean you are in such great need of that ICS is without?
Re:This is why you want a walled-off app store by synapse7 · 2012-12-28 01:12 · Score: 1

To add more, I have loaded Jelly Bean the S3 that I use and I've been considering restoring the samsung rom to gain back the motion gestures, some of which are quite handy.
Re:This is why you want a walled-off app store by erroneus · 2012-12-28 01:41 · Score: 1

I have always believed AT&T and T-Mobile are GSM carriers and that Sprint and Verizon are CDMA carriers.
Please educate me.
Re:This is why you want a walled-off app store by lengau · 2012-12-28 04:01 · Score: 1

Here's a list of devices that either have or will get Jelly Bean.
Also, this page shows a (fairly complete, though I hesitate to say "complete" for the fact that there's almost certainly at least one Android phone/tablet not mentioned on it that exists somewhere...) list of Android devices, including what version they run. It contains 41 mentions of 4.1 and 11 mentions of 4.2.

--
I really wanted to change my sig to something witty, but all I could come up with is this.
Re:This is why you want a walled-off app store by Applekid · 2012-12-28 08:27 · Score: 1

The internal permissions manifests are actually much more granular. For whatever reason (probably ease of use, but I don't know for sure), Google grouped them up into easy to understand chunks.
Full list is here: https://developer.android.com/reference/android/Manifest.permission.html
I do wish, however, you could tick a box in your settings to get the full story in the permissions confirmation window if you know what you're doing. Looking at that list, though, I can understand why they would choose to fold in some of the more obtuse permissions into some higher-level definitions.

--
More Twoson than Cupertino
Re:This is why you want a walled-off app store by SomePgmr · 2012-12-28 11:40 · Score: 1

a) Most devices that are still stuck on Gingerbread are cheap feature phones. These are the people who won't buy your app anyway.
That 50% number is from people in the Play store.

b) Even giving up half the market, you still have a larger audience than any other smartphone OS. Android is sitting at ~70-80% worldwide marketshare; the nearest is sitting at like 30%ish.
That doesn't change the fact that you're giving up on 50%* of the Android users. I'm not here making a case for iOS over Android, just that the situation among Android devices absolutely sucks in this regard.
* You're actually throwing out 61%, if you also consider that more people are using Froyo (2.2) than Jelly Bean.
Re:This is why you want a walled-off app store by node+3 · 2012-12-28 18:24 · Score: 1

Sorry but that's BS. The reason why those rights are asked for at install time is that they are considered as required for the app. What use would a calendar application have that is denied access to the phone calendar? So there's no need to install an app without the requirements for it to work. The actual security check is "do the required rights match the apps purpose?" if not, don't install. But that's between you and the app developer.
No, sorry, but that's bullshit. Most apps you'll find on the Play store require permissions to read the phone status, including identity, regardless of whether they have anything to do with the phone or not. Some want access to your location (like Facebook), even if it's not core to the app.
On iOS, any requests for location, contacts, photos, or calendar must be authorized by the user *explicitly*, and it can be denied if the user wishes, yet the app will still run.
Now, your example of a calendar app is simple-minded. What about an app that has a calendaring aspect, but does other things as well? Such as a task management app? Perhaps I want to use it as a to do list, but don't want it to include my calendar appointments as to do items, and I don't want it to store to dos into my calendar? The app will still work without access to my calendar, and my privacy will be just a little bit more protected.
Or like Facebook. Some people want to tag their posts with location. But maybe I don't want to, or maybe I just don't want to *this one time*, not even accidentally? Again, it's all or nothing on Android.
The idea that permissions are usually essential to the app such that it can't function without them is false. The only time that's sufficiently true is for apps that need access to the Internet. Even apps that you'd think might need what they are asking for, like a maps app, still will work fine without access to the thing they most logically need, like GPS. You can easily find a maps app useful, even if it doesn't have access to your location.
And this is Android we're talking about here. Isn't "choice" the Android mantra? The permissions system in Android is one aspect where they are severely lagging behind Apple. And even if it does break the app's core functionality, shouldn't that be the user's choice? On iOS, if an app wants access to the user's photos, it has to ask for permission to read the user's location. That's because photos can contain location metadata. If the user says "no", the app won't be able to open photos or the camera, which would break something like Instagram.
So, what happens? Instagram crashes? The iPhone explodes? No! It just tries and fails to open the photos (or camera), and then pops up a dialog saying, "hey, we need permission to read your location if you want the app to work, please say yes", and if the user decides it's ok, they can. If not, they can just not use the app.
On Android, you have to accept permissions, most of which are not necessary, but neither you *nor even the developer*, can say, "yes" to this and "no" to that. It's all or nothing. Maybe I don't know why Facebook wants access to my location, but I notice it only asks when I post if I check the "include location" button, so I figure, ok, cool, it's not tracking me all the time, just when I choose the option. Or maybe some chat app asks for access to my contacts, but only when I choose the "find friends" feature, and isn't just siphoning off my address book every time it launches.
Or maybe it is! On iOS, I can tell if it is or not, and make an educated decision. On Android, I just have to cross my fingers.
Re:This is why you want a walled-off app store by bickerdyke · 2012-12-29 01:25 · Score: 1

Read my complete post. I completly agree with you that optional permissions are lacking on Android.
I don't agree with you that it should be the users choice to break the core funcionality of an app. That would be contradictory to Apples "it just works" philosophy.

--
bickerdyke
Re:This is why you want a walled-off app store by node+3 · 2012-12-29 13:44 · Score: 1

Read my complete post. I completly agree with you that optional permissions are lacking on Android.
That's not the part I'm calling bullshit. The bullshit is where you claim that the permissions are only about "essential" requirements for the app to work at all. Please take your own advice and read my complete post.

I don't agree with you that it should be the users choice to break the core funcionality of an app. That would be contradictory to Apples "it just works" philosophy.
That's consistent with making an ecosystem that the user can trust and feel safe with. Better to slightly break an app (you are vastly overblowing the impact here!) than to force a user to give up privacy just to even try out an app.
I gave numerous examples of apps working just fine, even when you remove what you seem to think are part of their "core functionality". And what's the worst, absolute *worst* case? The app will try do to the thing it wants, fail, and pop up a dialog saying, "you didn't grant permission to X, the app needs it in order to Y, please try again and grant permission when asked, or close the app, kthxbye!"
Easy as pie. No apps were harmed in this process, and no user had to give up their privacy. Everyone's a winner!

Android.DDoS.1.origin by Anonymous Coward · 2012-12-27 11:58 · Score: 1

nice disguise

Re:Android.DDoS.1.origin by SternisheFan · 2012-12-27 12:07 · Score: 1

This is not from the Android PlayStore, it may originate from a Russian website.

Re:The firm lies. by Zontar+The+Mindless · 2012-12-27 12:07 · Score: 1

If people are fooled into thinking it's a legitimate app, then it has successfully disguised itself as a legitimate app, I'd say--your failed attempt at pedantry notwithstanding.

--
Il n'y a pas de Planet B.

Re:The firm lies. by p0p0 · 2012-12-27 12:08 · Score: 1

How do you figure? The app takes on the icon/text of the play store app and launches itself and the legitimate play app when activated. Where have you been confused?

Re:Linux your next... by masternerdguy · 2012-12-27 12:10 · Score: 2, Informative

Linux has EXCELLENT intrusion detection as long as you're running the SELinux tools. That thing is so paranoid out of the box that an application making a file in /tmp will throw a warning. You can set it up so that an application doing anything remotely suspicious is just killed immediately and a notification sent to the admin. If you don't trust SELinux there's more proprietary tools such as AppArmor that can do the same job and are a bit friendlier to configure.

--
To offset political mods, replace Flamebait with Insightful.

I'm not sure you understand. by tuppe666 · 2012-12-27 12:20 · Score: 4, Insightful

I know your trying to defend Apples "lets gouge our customers policy" by limiting customer choice (and competition) to Apple on its (not your) phone...but to do do so I think you need to understand that on Android you have to actually go into the settings and *enable* his voluntary, and have to agree to a warning screen...Apple users are do desperate to have this functionality they "Jailbreak" Apples phone, even though Apple have attacked their customers for doing so.

Re:I'm not sure you understand. by rjr162 · 2012-12-27 12:58 · Score: 2

Apps without ads?? Christ I get just as many on the games for the iPad as I do my android phone
Re:I'm not sure you understand. by LurkerXXX · 2012-12-27 13:17 · Score: 5, Funny

I want a phone I can hold any way I want, thanks.
Re:I'm not sure you understand. by tlhIngan · 2012-12-27 18:21 · Score: 1

I know your trying to defend Apples "lets gouge our customers policy" by limiting customer choice (and competition) to Apple on its (not your) phone...but to do do so I think you need to understand that on Android you have to actually go into the settings and *enable* his voluntary, and have to agree to a warning screen...Apple users are do desperate to have this functionality they "Jailbreak" Apples phone, even though Apple have attacked their customers for doing so.
And practically every US Android user has it checked.
Why? Amazon. Or if you want to install those cheap Humble Android Bundles.
Which means yes, it's a superior system, except it's broken because it's an all-or-nothing. Why should I have to enable it to install an app from Amazon? (Which to be honest is probably why AT&T was forced to put the option back in). Why can't I just enable it for Amazon? Or why can I just install the Humble Bundle apps?
In fact, why isn't the option more like "Allow installation of unsigned apps"? Then Amazon and Humble Bundle and AppsLib and other stores can provide their own certificates for the user to install so that store is "trusted" and they can't install some random APK from facebook because their friends call it cool?
Re:I'm not sure you understand. by kiddygrinder · 2012-12-27 18:53 · Score: 1

anyone smart enough to understand that option would be smart enough to not install apps from a non-reputable source.

--
This is a joke. I am joking. Joke joke joke.
Re:I'm not sure you understand. by shutdown+-p+now · 2012-12-27 20:18 · Score: 1

If I wanted a hobby phone I could kick around I would get an Android. I want a phone that works and apps without ads.
So, how did those maps work for you till Google released their app?
Re:I'm not sure you understand. by shutdown+-p+now · 2012-12-27 20:19 · Score: 2

Funny that - this advice is 100% applicable to Android as well.

Stupid disguise by tuppe666 · 2012-12-27 12:26 · Score: 1

nice disguise

I thought the opposite. The first think someone is going to do when they see a two stores on their phone...is look up why? It even has a different name, they would have been better hiding it behind a simple RSS feed or torch app

Re:Stupid disguise by BasilBrush · 2012-12-28 06:59 · Score: 1

The first think someone is going to do when they see a two stores on their phone...is look up why?
No, if the user notices the duplication, and cares, their fist step is likely to be to click on each of them to see what the difference is.
"looking up why" (in Google or the manual) is what people might do after they've looked for themselves.

Re:LMAO - Oh boy: You SURE you want to post that? by Anonymous Coward · 2012-12-27 12:35 · Score: 1

MY RAVEN WAS EQUIPPED WITH THE FOLLOWING

HIGH
06 x Cruise Missile Launcher I
01 x SMALL TRACTOR BEAM 1
01 x SALVAGER I

MEDIUM
04 x LARGE SHIELD EXTENDERS
01 x 'HYPHNOS' ECM
01 x MEDIUM SHIELD BOOSTER

LOW
01 x EMERGENCY DAMAGE CONTROL
01 x ARMOR KINETIC HARDENER I
01 x ARMOR THREMIC HARDENER I
02 x WARP CORE STABILIZER I

DRONES
02 x WARRIOR I DRONES
03 x HAMMERHEAD I DRONES

UPGRADES
01 x ROCKET FUEL CACHE PARTINTION I
01 x BAY LOADING ACCELERATOR I

Seriously? by tuppe666 · 2012-12-27 12:36 · Score: 1

But but but I thought the zealots assured us the Linux was immune to exploits? Or did they LIE????

This is about Android...and Ya its pretty secure :) Linux is pretty good too. I'm not sure calling people zealots(maybe you don't know what one is) because they have chosen platforms with better balance of security/flexibility than your own (clearly your upset), makes your own secure. In fact its a really strange comment to make at all, about either OS, as what is true about both is they put an inordinate amount of effort into ensuring their platforms are secure. That is why both have incredibly good track records.

Re:Seriously? by BitZtream · 2012-12-27 13:32 · Score: 1

Android is just as much Linux as Debian, Ubuntu and Redhat. Its just another distribution. Its just the only one that happens to be popular, and as such ... guess what ... just like Windows its becoming a malware target. and just like Windows you don't have to 'hack' the OS, just the user.

--
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager

The app does not spread... by mythosaz · 2012-12-27 12:41 · Score: 2, Informative

Users SPREAD the app. The app itself does not spread. It's an important distinction.

Re:The app does not spread... by mythosaz · 2012-12-27 22:00 · Score: 1

"The threat, detected as "Android.DDoS.1.origin" by Russian security firm Doctor Web, likely spreads via social engineering tricks"
That, from the summary, says that the threat spreads by social engineering -- and clearly identifies the threat as the malware, not the social engineering bit. TFA says that the malware spreads. Passive or active is important. The author of the summary is a twit. That's my point.

Apple bought Quattro :) by tuppe666 · 2012-12-27 12:56 · Score: 1

If I wanted a hobby phone I could kick around I would get an Android. I want a phone that works and apps without ads. I went Apple after finding out the not-so-stellar truth about Android.

LOL the irony of your post is one of the reason the iPhone is so unsuccessful is its price, and please don't pretend that Apple do not make money from Advertising, they famously made siri useless with advertising. The sad fact is your post is not only off topic but irrelevant...Android outsells Apple 6:1 and sells 1.5million a day...its doing something right, and what Apple is doing wrong, and nothing you or I is going to change that. Personally I would love Apple to create a competitive product.

Re:Apple bought Quattro :) by aaronfaby · 2012-12-27 13:02 · Score: 1

The iPhone is unsuccessful? Apple has 53.3% of the smartphone market: http://bgr.com/2012/12/21/apple-market-share-u-s-262731/
Re:Apple bought Quattro :) by aaronfaby · 2012-12-27 13:04 · Score: 2

US smart phone market that is.

Re:Linux your next... by bbelt16ag · 2012-12-27 13:08 · Score: 1

are there any good tutorials about setting this up? i think my friends need to stay using this in production and i might need to help em out.

--
NEVER NEVER NEVER NEVER NEVER NEVER NEVER NEVER GIVE UP! "No limitations, no boundaries, there is no reason for them."

Apple has only 1.6% Market share. by tuppe666 · 2012-12-27 13:11 · Score: 4, Insightful

The iPhone is unsuccessful? Apple has 53.3% of the smartphone market:

LOL in the US...worldwide it had dropped from 23% to 14.9%. This is original report for your figures http://www.kantarworldpanel.com/global/News/Apple-achieves-its-highest-ever-Smartphone-share-in-US they are on in a pdf but include figures like in Brazil Apple dropping from 3.2% to 1.6% while Android moves from 28.9% to 60.7% of the market.

Better Specification than Apple, at less cost :) by tuppe666 · 2012-12-27 13:26 · Score: 1

Android outsells Apple 6:1 in the "I use a smartphone like a featurephone and don't know what apps are, oh and this phone is only $79 on prepaid" area.

Absolutely not. In China for example the Average price of a smartphone is $250. Lets look at the best selling phones are on Amazon China http://translate.google.com/translate?sl=auto&tl=en&js=n&prev=_t&hl=en&ie=UTF-8&eotf=1&u=www.amazon.cn. The top phone is Lenovo with a dual core processor, 2000mAh, Android 4.0, 2nd Phone is and 3rd Phone are both Huawei is both dual and quad cores with larger screens than your beloved iPhone :) (and includes a dual sim interestingly ), The third Phone comes with 2GB of RAM!! ....I hate to say it but these phones seem to have better specifications (and arguably software) than your beloved Apple iPhone, its not surprising really as Apple overcharge their customers so much.

Re:He's points out a common-sense fact though by Zontar+The+Mindless · 2012-12-27 13:36 · Score: 1

Yes, it has really got to the point where I can read the first line of one his posts, cut straight to "Dear APK, Please die in a fire," and move on.

--
Il n'y a pas de Planet B.

Does it affect the kernel :) by tuppe666 · 2012-12-27 13:37 · Score: 1

Android is just as much Linux as Debian, Ubuntu and Redhat. Its just another distribution. Its just the only one that happens to be popular, and as such ... guess what ... just like Windows its becoming a malware target. and just like Windows you don't have to 'hack' the OS, just the user.

I understand the argument...and have even made it myself "in context" except this attack won't work on "Debian, Ubuntu and Redhat"...and no its nothing like windows :).

Re:Does it affect the kernel :) by BitZtream · 2012-12-27 18:42 · Score: 1

And only a Linux fanboy would argue that distort incompatibility is a feature.

--
Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager

Re:You would think by Zontar+The+Mindless · 2012-12-27 13:39 · Score: 1

Sucks for you that Ohio Arts isn't a supported platform, I guess.

--
Il n'y a pas de Planet B.

Android phones are taking a bite out of Apple by tuppe666 · 2012-12-27 14:11 · Score: 1

Apple makes 80% of all mobile phone profits.

It doesn't and it hasn't for a long time [and never did :)], and there is no such thing as % of profits. It does produce a phone which it sells at a vastly overinflated price to small market share of customers, that strategy has been so successful it had made the largest company by market cap in the world...but that was three months ago, Apple have now lost 30% of its market cap, and its whole strategy is looking weak for the company...it always looked shitty for their customers [its kind of sad you point it as an advantage in absence of better hardware/software/price], Its no wonder their small market share continues to shrink. Perhaps if they had had a long term strategy things would look different now.

Android has over 710Million users :) by tuppe666 · 2012-12-27 14:51 · Score: 1

I see their success or failure determined by 'dumb users' who WILL download what is available and get pwned, complain, and eventually give up and buy the damn iphone

I guess the proof is the the pudding with Android hitting 710Million users(last quarter) with activations of 1.5Million daily, and is set to become the primary computing platform, taking the crown away from Microsoft Next year. I think when the platform that has the better hardware/software/value unsurprisingly gets the most users by a massive...calling them dumb(sic) might be somewhat inappropriate.

Re:Linux your next... by Gaygirlie · 2012-12-27 14:56 · Score: 1

Any machine anywhere can get a rootkit, or worse

Rootkits aren't the problem, you don't need root privileges to do DDOS-attacks, to spy on users, to delete their files and so on -- it all can be done as a regular user just fine. Often you don't even have to hide the malware package in any way or form, just fool the user into thinking it's useful! That said, in general I agree with you: there is no OS that can protect against gullible users, not even Linux can do that. There are ways of increasing security by leaps and bounds, but those ways would really require a whole new OS.

Typical Apple User by tuppe666 · 2012-12-27 15:15 · Score: 1

Fuckle Assdroid is continually proving to be the M$ Windoze of the mobile world.This is just the icing on the cake when it comes to why Fuckle Assdoid cannot be trusted. Glad I went with iOS rather than the steaming pile of shit called Fuckle Assdroid.

I always admire the enthusiasm of Apple Users, and another well thought out post that was. You raise several important points. I can't help questioning your point that Android is the new Microsoft Windows. It isn't and never will be...that privilege is Windows Phone which is currently 6th most popular OS; Popularity alone is not a measure of similarity. The reality is right now Microsoft is pushing for an "ecosystem" read its Desktop monopoly on your phone...and nobody is buying what they are selling [Literally of Figuratively], but undeniably there is a move towards a unification of Mobile/Tablet/Desktop OS's through a shared store/look and feel/API, what is most interesting is Google who make no money directly from Android is pretty OS Agnostic, but has unified services...even on the iPhone, and as yet had not made Chrome a desirable!? platform.

Re:Typical Apple User by BasilBrush · 2012-12-28 07:11 · Score: 1

You're easily trolled. Suggest you raise your sights a bit above -1 rated ACs.

Re:Better Specification than Apple, at less cost : by Kenshin · 2012-12-27 15:29 · Score: 1

Ya, China's probably not the best market to compare to.

In North America and Europe similarly spec'd phones run in the same price range, which means everyone loves making a healthy profit off their customers.

--

Does it make you happy you're so strange?

I have yet to read .. by twistofsin · 2012-12-27 16:13 · Score: 1

I have yet to read an article on an Android virus that isn't a trojan. No drive by's, API or OS exploits.

Trojan's will always exist. They are wolves in sheep's clothing.

Re:I have yet to read .. by shutdown+-p+now · 2012-12-27 20:21 · Score: 1

There were certainly enough exploits in Android (or manufacturer's versions of it, like the recent Sammy one) to make such a thing. It's just that it's not worth the bother - why do it the hard way, if you can just have users install it on their own?
Windows is in the same situation today - it's not like there's a shortage of exploits, but most malware you see out in the wild is of the "click here to install this super-useful toolbar!" kind. It doesn't need exploits, because the users will happily download and run it, and elevate it to admin when it asks for it.

Re:Going to quote you troll (you prove my points) by Zontar+The+Mindless · 2012-12-27 16:29 · Score: 1

*yawn*

--
Il n'y a pas de Planet B.

Re:"Rinse, Lather, & Repeat", troll... lmao! a by Zontar+The+Mindless · 2012-12-27 16:51 · Score: 1

Dude, if this is supposed to be some sort of a contest... you're the only one competing.

--
Il n'y a pas de Planet B.

Re:"Rinse, Lather, & Repeat", troll... lmao! a by Zontar+The+Mindless · 2012-12-27 17:33 · Score: 1

Despair.com is thataway ->

--
Il n'y a pas de Planet B.

Granular permissions up-front worse for security by SuperKendall · 2012-12-27 20:05 · Score: 1

Granular permissions allow a user to know exactly what an app wants to do before they even install it

No they do not.

They know what RESOURCES an app would like to have beforehand. But having never run the app they have NO idea when and for what reason they are required.

On iOS you also have granular access. But the key is, you are asked at the time that resource is required. So for example, you are asked if the application can access your contacts only when you've hit the "send to a friend" button or whatever.

A big list of permissions that non-technical users hardly understand helps almost no-one. It allows a technical user to avoid some traps, but it screws over the large majority of users.

--
"There is more worth loving than we have strength to love." - Brian Jay Stanley

Re:Granular permissions up-front worse for securit by bickerdyke · 2012-12-27 21:00 · Score: 1

A big list of permissions that non-technical users hardly understand helps almost no-one. It allows a technical user to avoid some traps, but it screws over the large majority of users.

If a user is not technical enough to understand "This app requires access to your contacts" and "This app requires dialing phone numbers", they probably should donate their phone for their own good.

The more difficult thing is to judge if those permissions are reasonable for that app they want to install. But as they're the only one who know what for they're installing it, no one can take that burden from them.

--
bickerdyke

Re:No it does not by erroneus · 2012-12-27 21:23 · Score: 1

Though the function was different, the point is the same. Malware was installed by users using a trusted source (in this case the apple app store) and it did things the user were not aware of or gave permission for it to do. That the functions were different is not relevant. It was a compromise of the device and its contents by use of malware which is the relevant similarity.

And should Apple's app store let another one slip through, this process can and will repeat itself.

Where did you get this strange notion that this trojan horse program was also a virus in that it will infect other devices? I didn't read that anywhere. The point of infection is when the user voluntarily installs the malware to their device. It is a trojan because it pretends to be something safe.

In your belief and desire to defend Apple, I think you forgot to check facts long enough to know what you are talking about. But I have to ask. Why are you so defensive about Apple? They are a business like all the others. They serve their interests first and foremost. Customer satisfaction is primarily based on customer acceptance of Apple's terms and conditions because Apple does not make exceptions for its customers. Apple also has a history of blaming its customers before it blames itself for anything. ("You're holding it wrong" is not the only example of this.)

I totally understand the human aspects of this behavior. We do it all the time with sports, religion and politics. We care about things which do not return the affection. But as this phenomenon is extended into consumerism, it presents some very interesting psychology indeed. Your affection for Apple things does not make you who you are. It does not make you a better person. If you draw a sense of happiness from the notion that owning (excuse me, I mean licensing) some hardware and software makes you a member of some club, then I might invite you to read or watch Dr. Seuss' "Star-Bellied Sneetches" as it is a lesson for all of us everywhere. (Interestingly if it available here: http://www.youtube.com/watch?v=v3yJomUhs0g )

Re:Rootkits on Windows? NO PROBLEM & why by Gaygirlie · 2012-12-27 21:29 · Score: 1

Mate, nothing you said has anything to do with my comment, and I definitely am NOT going to start downloading some random files you recommend or trust you.

Re:The firm lies. by jez9999 · 2012-12-27 23:44 · Score: 1

Legitimate apps come from the Google Market/Play. So this app in no way "disguises itself as a legitimate app". Not that I'm for such a closed environment, but it exists for this reason.

This isn't Apple. With Android, it's perfectly possible to have a legitimate app that is on another store from Google Play, or no store at all.

--
== Jez ==
Do you miss Firefox? Try Pale Moon.

Seriously by tuppe666 · 2012-12-27 23:56 · Score: 1

http://bgr.com/2012/08/06/apple-mobile-industry-profit-share-q2-2012/

Eat it. Then put your foot in your mouth.

To repeat myself :) and no, a posting a 6month old guesswork is not going to change my statement.

It doesn't and it hasn't for a long time [and never did :)], and there is no such thing as % of profits. It does produce a phone which it sells at a vastly overinflated price to small market share of customers, that strategy has been so successful it had made the largest company by market cap in the world...but that was three months ago, Apple have now lost 30% of its market cap, and its whole strategy is looking weak for the company...it always looked shitty for their customers [its kind of sad you point it as an advantage in absence of better hardware/software/price], Its no wonder their small market share continues to shrink. Perhaps if they had had a long term strategy things would look different now.

Re:Seriously by BasilBrush · 2012-12-28 06:33 · Score: 1

To repeat myself
You can repeat yourself, but the other poster has shown that what you are repeating is false.
Re:Seriously by tuppe666 · 2012-12-28 08:42 · Score: 1

You can repeat yourself, but the other poster has shown that what you are repeating is false.
LOL to repeat myself yet again :)

It doesn't and it hasn't for a long time [and never did :)], and there is no such thing as % of profits. It does produce a phone which it sells at a vastly overinflated price to small market share of customers, that strategy has been so successful it had made the largest company by market cap in the world...but that was three months ago, Apple have now lost 30% of its market cap, and its whole strategy is looking weak for the company...it always looked shitty for their customers [its kind of sad you point it as an advantage in absence of better hardware/software/price], Its no wonder their small market share continues to shrink. Perhaps if they had had a long term strategy things would look different now.
Re:Seriously by BasilBrush · 2012-12-28 14:03 · Score: 1

You can repeat yourself, but the other poster has shown that what you are repeating is false.

Would love Android on Debian Chromebook by tuppe666 · 2012-12-28 00:11 · Score: 1

And only a Linux fanboy would argue that distort incompatibility is a feature.

Quite the reverse its not its just a simple fact. The reality is going forward I would love to be able to run my android apps on my ARM touchscreen chromebook running Debian...but right now the whole Userland is simply different to "Debian, Ubuntu and Redhat" and you know that. The benefits come from the massive shared development work going into Linux(the kernel) from Google and other companies now interested in Linux(the kernel) because its part of Android, which users of "Debian, Ubuntu and Redhat" benefit from :)

I post the figures as I see them by tuppe666 · 2012-12-28 00:14 · Score: 1

They are simply IDC's latest figures, although all major players figures match, but then you know that. Android Activate 1.5Million phones daily. Its a phenomena.

Re:I post the figures as I see them by SuperKendall · 2012-12-28 03:56 · Score: 1

They are simply IDC's latest figures
If they were you'd have a link.
Doing a simple google search for iOS IDC marketshare shows a much higher overall percentage for iOS.

--
"There is more worth loving than we have strength to love." - Brian Jay Stanley

Re:Take a read... apk by Ash+Vince · 2012-12-28 00:17 · Score: 1

Yes http://mobile.slashdot.org/comments.pl?sid=3344205&cid=42407663 and yes http://mobile.slashdot.org/comments.pl?sid=3344205&cid=42407763

APK

P.S.=> Take a read - be VERY "enlightened" on many fronts...

... apk

More like being owned by pointless and gratuitous use of bold tags. I thought using too many exclamation marks was bad enough but those posts both take the biscuit.

Maybe if you concentrated on posting stuff that wasn't so annoying to read people might not down mod you so much and you would be fine having an account like the rest of us. As it is your posts look like the demented ramblings of someone overly obsessed with markup.

--
I dont read /. to RTFA, I read /. to offend people in ignorance.

Re:Take a read... apk by Johann+Lau · 2012-12-28 00:58 · Score: 1

That'd just be one "front", namely your whiny gibberish which is telling indeed... you seem to be in a constant state of hurt, and also having issues with penguins. Awww.

All Sprint MVNOs are also CDMA2000 carriers by tepples · 2012-12-28 03:31 · Score: 1

Most US carriers use CDMA2000.

I have always believed AT&T and T-Mobile are GSM carriers and that Sprint and Verizon are CDMA carriers.

I was under the impression that more well-known mobile virtual network operators (MVNOs) in the United States were on Sprint than on AT&T or T-Mobile.

Address book mining is not "malware" by SuperKendall · 2012-12-28 04:03 · Score: 1

the point is the same. Malware was installed by users using a trusted source

That's an incredibly stupid and ill-informed view because it masks the relative seriousness of two situations.

Having someone else get some of your contacts is nowhere near the same league as having an app that is contacting others and sending them apps. It is insane to claim that it has the same impact on users, and is doing them a HUGE disservice to hide the danger Android users are in compared to iOS users.

Not to mention, perhaps you missed the fact that more than 80% of iOS users are now protected against that malware attack and no Android user is? But user vulnerability means nothing to you so I guess that doesn't matter after all.

--
"There is more worth loving than we have strength to love." - Brian Jay Stanley

Re:Address book mining is not "malware" by erroneus · 2012-12-28 04:32 · Score: 1

Please explain how iOS users are protected?
Re:Address book mining is not "malware" by BasilBrush · 2012-12-28 06:02 · Score: 1

In iOS6, apps are not allowed to access the contacts database until the user has authorised the app to do so. Unlike Android, the authorization is asked for whilst the app is running, the first time it needs access, not at installation time.
Which means it's a dialog with a single question, about contacts, at the time when you can assess why the app would need it. And thus is far less likely to be affected by click-yes-to-continue-without-actually-reading problem that the Android sandbox has.
Re:Address book mining is not "malware" by AJodock · 2012-12-28 06:35 · Score: 1

Having someone else get some of your contacts is nowhere near the same league as having an app that is contacting others and sending them apps.
Step 1) Get contacts and send them back to C&C servers
Step 2) Spam contacts a link to the app with a faked e-mail address matching the infected users e-mail.
It seems like the outcome/risk is the same to me. It's not like the malware can actually force the users in your contact list to install the app.
In the end the safety is the same on both iOS and Andrioid. It all depends on what they allow into the market, but it's not like they have the code for these apps so no number of tests can be enough to prove that an app is trustable. Android also has the added risk of the "Other Sources" option being easy to turn on which is needed to install this particular malware, but that is no different than jailbreaking an iPhone, which is fairly common as well.
Bottom line any device that allows you to install software, from your TV to your PC is at risk when you start putting untrusted software on them, and just because Apple/Google has done some tests doesn't mean that any app should be trusted. Unless you can read (and understand) the code then compile it yourself...
Re:Address book mining is not "malware" by node+3 · 2012-12-28 18:09 · Score: 1

And not only that, the user can say "no", and still use the app!
Google really needs to work on protecting the privacy of its users. They are generally quite capable technologically, it shouldn't be hard to have an option to say yes or no to specific permissions. That they haven't done it shows that they either don't see it as a priority, or simply think the way it works now is correct.
I'd like to think it's the former, but I tend to suspect more and more that it's the latter. Hopefully this will be clarified at I/O 2013.
Re:Address book mining is not "malware" by erroneus · 2012-12-29 01:18 · Score: 1

A vulnerability is found in door lock #1 and in that case, the result of the vulnerability was a burglary.
A vulnerability is found in door lock #2 and in that case, the result of the vulnerability was a rape and murder.
Clearly, the house of door lock #1 is safer than the house of door lock #2 because of the severity of the instance which followed the breech.
Do you see a problem with that line of logic? I do. The point is the breech. Not what was done after the breech.

The Technical Elitist by SuperKendall · 2012-12-28 04:06 · Score: 1

If a user is not technical enough to understand "This app requires access to your contacts" and "This app requires dialing phone numbers", they probably should donate their phone for their own good.

That's odd, I would like to live in a world where even such people can make use of technology. The world I want to live it allows EVERYONE to benefit from technical advances, not a high-tech priesthood that snickers at the LUsers.

You can stay up in that ivory tower if you like but I'm trying to make the world better, not just the corner I inhabit.

Blame the users all you like, in the end they will abandon you when you treat them roughly.

--
"There is more worth loving than we have strength to love." - Brian Jay Stanley

Re:The Technical Elitist by bickerdyke · 2012-12-28 07:16 · Score: 1

If a user is not technical enough to understand "This app requires access to your contacts" and "This app requires dialing phone numbers", they probably should donate their phone for their own good.
That's odd, I would like to live in a world where even such people can make use of technology. The world I want to live it allows EVERYONE to benefit from technical advances, not a high-tech priesthood that snickers at the LUsers.
Well, let me rephrase it: In my ideal world, everyone would understand that "This app requires dialing phone numbers" means that this app might dial phone numbers - at your expense. That's not too difficult. OK, I would love to free users from the burden of permission checking, too. But you can't complety block phone or net access, when you WANT half of the apps to have phone or net access.
So how could anyone but the user decide if a required permission is neccessary for what the app is supposed to do? Evil-Flag anyone?
Or you would need a list of "sensible" permissions for each application and check the required permissions against that "sensible" permissions.

--
bickerdyke

Re:Granular permissions up-front worse for securit by BasilBrush · 2012-12-28 06:09 · Score: 1

If a user is not technical enough to understand "This app requires access to your contacts" and "This app requires dialing phone numbers", they probably should donate their phone for their own good.

Ah, the old "blame the user" tactic of the fanboy. Well, these are mobile phones. And mobile phones are meant for ordinary people. If they're not suitable for ordinary people, then that's the fault of the hardware/software, not the user.

The fact is that there's a better way to do it, and iOS shows the way. Ask the user for permissions for a resource whilst the app is running, the first time the app wants access to that resource. That way the user can better assess the app, and whether it is a reasonable request.

Re:Linux your next... by BasilBrush · 2012-12-28 07:07 · Score: 1

That said, in general I agree with you: there is no OS that can protect against gullible users, not even Linux can do that.

That's why it's a good idea to have a walled garden store, where apps are vetted before appearing. And where the few items of malware that get past the vetting can be removed from distribution once identified, thus preventing them affecting any more users.

Re:Linux your next... by Gaygirlie · 2012-12-28 07:20 · Score: 1

That said, in general I agree with you: there is no OS that can protect against gullible users, not even Linux can do that.

That's why it's a good idea to have a walled garden store, where apps are vetted before appearing. And where the few items of malware that get past the vetting can be removed from distribution once identified, thus preventing them affecting any more users.

I agree, and it's something I've been saying for a good while now: the Average Joe - user isn't knowledgeable enough to spot malicious software and generally doesn't even want to be knowledgeable -- ignorance is much easier on the brains -- and therefore curated app stores/repositories/whatnot are good. I just advocate that it should be easy enough to turn off the walled garden, too, for those users who do need more than what the garden offers. Currently Apple's walled garden is too strict, it cannot be turned off without jailbreaking the whole thing, and Google's approach is otherwise good enough, but Google isn't actually curating their garden's content! Too bad neither of them can be coerced to see the light.

Re:Ever heard of malwarebytes? by Gaygirlie · 2012-12-28 07:22 · Score: 1

(if you are a Windows user)

Indeed. The discussion was about Linux.

Re:Granular permissions up-front worse for securit by bickerdyke · 2012-12-28 07:46 · Score: 1

If a user is not technical enough to understand "This app requires access to your contacts" and "This app requires dialing phone numbers", they probably should donate their phone for their own good.

Ah, the old "blame the user" tactic of the fanboy.

No objection to that.

Well, these are mobile phones. And mobile phones are meant for ordinary people. If they're not suitable for ordinary people, then that's the fault of the hardware/software, not the user.

Cars are meant for ordinary people too. And that's why we don't let anyone drive but require driving licences. Not because we want to keep it some special privilege, but because it is potentially dangerous. And storing private data in a connected device is not without dangers, too. And with that, there are some responsibilities.

Like servicing your brakes. And if cars are for everyone, not everyone can do that. But the solution is not to do it, but to pay someone to do it. And in exactly the same way, someone has to check an apps data requests against the purpose of it. Either you can do it yourself, or you let someone else do it. Not doing it is a bad idea.

The fact is that there's a better way to do it, and iOS shows the way. Ask the user for permissions for a resource whilst the app is running, the first time the app wants access to that resource. That way the user can better assess the app, and whether it is a reasonable request.

No, definitly no. A user who can't assess OS privileges at install time can't do it at runtime either. We learned that from those personal firewalls that teached users to allow everything because something got blocked every few minutes.

It may come as a surprise to you, but even I think that overall safety is better on iOS. But that's not due to WHEN an app asks for privileges. It's the stricter checks before something goes into the store. It's as simple as with the brakes. You either check those permissions or you let apple do it. The costs here are a loss of flexibility and variety (alternate browser in iOS that is not merely a skin for the built in browser?)

Definitly reduces the malware risks, but not for me, thank you. But I know that this means more responsibility. That is no more elitist than any other kind of DIY.

--
bickerdyke

Then you need an Android Phone by tuppe666 · 2012-12-28 08:41 · Score: 1

They are simply IDC's latest figures

If they were you'd have a link.

Doing a simple google search for iOS IDC marketshare shows a much higher overall percentage for iOS.

https://www.idc.com/getdoc.jsp?containerId=prUS23771812#.UN4DmtE49yA seriously is google that hard :)

Android market-share 75% iOS 14.9%

Typical Apple User :) by tuppe666 · 2012-12-28 08:54 · Score: 1

Fuckle Assdroid is horrible compared to iOS and always will be. While you Assdroid lUsers feel the walled garden is a negative it is in all sense a positive. Apple products Just Work and the work unless there is a manufacturing defect. All iOS products get updates to where none of the Fuckle Assdroid products are ever updated.

Another well thought out, point by point discussion. I see you have all the propaganda "Just Work" "Walled Garden Good" "Manufacturing Defect" "Updates". The sad fact is All phones just work, Its just that some have working maps, and pretty much all phones have solid hardware, if they don't have battery problems/antenna problems/purple lens flare like Apple have :) bless them if only Steve were still here. As for Apple restricting competition on their not your platform, i'm sorry your choice is limited to just one store (one browser etc etc)...its not like Apple charge massive mark-ups they look after their customers...oh wait that is their whole business model to screw their customers...we used to call that lock-in back before marketing bullshit. Anyway back to my Nexus Tablet running Jelly Bean :)

The sad fact is you haven't got Unique hardware features, Products at every price point, Cutting edge hardware...or even software. ios is the has been platform. No wonder their market share is dropping through the floor. Nobody wants their(again not your) product

Insert free advert for Windows 2000 by dgharmon · 2012-12-28 10:27 · Score: 1

'I clicked an ad using the Windows 2000 theme that alerted me to major potential threats in my "regisetery"'.

--
AccountKiller

Re:Granular permissions up-front worse for securit by BasilBrush · 2012-12-28 14:06 · Score: 1

I think that overall safety is better on iOS. But that's not due to WHEN an app asks for privileges. It's the stricter checks before something goes into the store.

It's both.

Re:No it does not by node+3 · 2012-12-28 18:05 · Score: 1

I totally understand the human aspects of this behavior.

You understand it because you are engaging in it yourself in your condemnation of Apple. It's absurd to claim that Apple's app ecosystem isn't more secure than Android's. Everyone knows this, even the most ardent Android fanatic does.

You think that *one* piece of malware, that got through Apple's testing, which was caught and removed, which can't even automatically affect people on iOS 6, and stands out as an exception which is nowhere nearly as common as malware on Android, is exactly the same as malware on Android?

Of course not.

So, please, take your own advice and quit being so foolish. iOS is vastly more secure than Android. Android is vastly more open. Both are that way by design. Anyone who denies either of those two facts are engaging in exactly what you seem to think SuperKendall is guilty of, or is just simply ignorant, and you don't appear ignorant, just biased.

Re:No it does not by erroneus · 2012-12-29 01:14 · Score: 1

That one slip proves it is possible. And knowing it's possible, if I were to plan a massive hit, I would make sure the timing on activation was such that my trojan app would have the widest possible distribution before it became active.

I did not say anything in support of any particular platform as I mentioned them all in a neutral manner. But perhaps I should have said something about the notion of "giving up freedom for [the illusion of] security" has been a false notion for hundreds and hundreds of years.

Re:No it does not by node+3 · 2012-12-29 13:29 · Score: 1

That one slip proves it is possible. And knowing it's possible, if I were to plan a massive hit, I would make sure the timing on activation was such that my trojan app would have the widest possible distribution before it became active.

Possible, but not likely, and not easy either. Definitely not as possible nor as easy as it is on Android.

You're acting like this "possible" thing is just as bad as the actual thing that happens on Android at least a few times per year. They aren't equal.

I did not say anything in support of any particular platform as I mentioned them all in a neutral manner.

No, you distorted facts to an absurd level to make two disparate app ecosystems appear equally flawed.

Apple's is more restricted, but safer. Google's is more open, but more dangerous. They *are* different. By claiming equality between the two, you are tinting reality, in this case against Apple and for Google.

Then you went further and claimed that the person trying to say that they aren't the same is delusional and biased, and mocked and belittled him for it. You seem to think you aren't biased because you didn't use charged words. That's only one form of bias.

Now, I won't insult or belittle you. I do think you are smart enough to see the difference between iOS and Android here. It'd just be nice to see that reflected in your comments.

Re:No it does not by erroneus · 2012-12-29 15:12 · Score: 1

The difference is that you think because big brother Apple has locked things down in some way that you are safe. That just isn't the case. If Apple is in control, then you are not. Who does Apple serve?

In any case, Apple iOS is equally vulnerable. As another commenter pointed out, for this malware to get onto an Android, the user would have to enable other sources to install. Though it's not a simple check box, it's fairly easy to enable other sources on iOS at which point malware can be installed by the user.

Once in, each platform is comprimised. There is no difference.

Re:No it does not by node+3 · 2012-12-29 19:18 · Score: 1

The difference is that you think because big brother Apple has locked things down in some way that you are safe.

No, just safer.

That just isn't the case. If Apple is in control, then you are not. Who does Apple serve?

Me, the customer. Though that's a bit of misdirection on your part, since it doesn't have anything to do with whether the App Store is more secure or not.

In any case, Apple iOS is equally vulnerable.

Except it's not. This is proven out by the fact that Android malware is a regular occurrence, while iOS malware is all but non-existent.

As another commenter pointed out, for this malware to get onto an Android, the user would have to enable other sources to install. Though it's not a simple check box, it's fairly easy to enable other sources on iOS at which point malware can be installed by the user.

Again, misdirection. The Play Store has had more malware than the App Store. And, yet again, you are creating a false equivalency when you make it sound like jailbreaking an iPhone is in the same realm of difficulty as allowing outside sources an Android phone. It's not even *close*, and that, again, causes a difference between the two.

Once in, each platform is comprimised. There is no difference.

Are you saying that once both devices are infected, they are both infected? Well, even though it's a tautology, at least it's correct!

But also a misdirection. How is it you can't accept that iOS is safer than Android? Why the dishonesty? iOS is safer. That's proven by the rates of malware on the two systems. You can argue whether it's a worthwhile trade off, you can argue whether Google needs to do more, less, or is doing things just right, but you can't change reality.

That's the bias you are suffering from. Cut it out, you'll be better off for it.

Slashdot Mirror

New Android Malware Uses Google Play Icon To Trick Users

110 of 223 comments (clear)