Slashdot Mirror

← Back to Stories (view on slashdot.org)

Popular Android Anti-Virus Software Fooled By Trivial Techniques

Posted by Unknown on from the never-trust-malware dept.

wiredmikey writes "A group of researchers from Northwestern University and North Carolina State University tested ten of the most popular AV products on Android, and discovered that they were easily fooled by common obfuscation techniques. In a paper (PDF), the researchers said they tested AV software from several well-know security vendors. In order to evaluate the mobile security software, the researchers developed a tool called DroidChameleon, which applies transformation techniques to Android applications. Known malware samples were transformed to generate new variants that contain the exact malicious functions as before. These new variants were then passed to the AV products, and much to the surprise of the paper's authors, they were rarely flagged — if at all. According to the research, 43% of the signatures used by the AV products are based on file names, checksums or information obtained by the PackageManager API. This means that, as mentioned, common transformations will render their protection useless for the most part. For example, the researchers transformed the Android rootkit Droid Dream for their test. DroidDream is a widely-known and highly dangerous application. Yet, when it was transformed, every AV program failed to catch at least two variants."

61 of 94 comments (clear)

  1. This just in! by Anonymous Coward · · Score: 5, Insightful

    AV products suck!

    The whole premise of trying to match a virus 'signature' is simply stupid and useless.

    1. Re:This just in! by hamjudo · · Score: 4, Informative

      Virus 'signatures" are an ideal technology for dealing with common threats from the late 1990s.

    2. Re:This just in! by Anonymous Coward · · Score: 1

      The ideal technology for dealing with common threats from the late 1990s are patches to fix the gaping security holes exploited by a virus.

      Instead computer users have been conditioned to believe that anti virus products are the solution.

      But there's no money in making a monopoly OS secure.

    3. Re:This just in! by cbhacking · · Score: 5, Interesting

      Oh, hardly even then. I wrote my first polymorphic program when I was 16, and I was late to the game for that. Making a completely trivial change to the binary - have a meaningless 32-bit constant that you add (modulo 0xFFFFFFFF) with the current time in miliseconds on each run, for example - will completely bypass typical types of checksum/hash checks unless you want to store 4 billion signatures. Slightly more complex signature schemes are nonetheless equally easy to defeat. Filename checks are even easier to defeat; there's lots of ways to indicate the next file to run which can use dynamic file names. It's a game of cat and mouse, but the cats are too dumb to do anything but watch known mouseholes, while the mice can make new holes whenever they please and it only takes a mouse getting out once for the cats to lose the game.

      --
      There's no place I could be, since I've found Serenity...
    4. Re:This just in! by ozmanjusri · · Score: 5, Interesting

      FUD sucks too.

      DroidDream is NOT "a widely-known and highly dangerous application". It was a malware variant identified early in 2011 and removed from both the Android Market (now Play Store) and from the infected devices. The vulnerability it exploited has been fixed in all Android versions newer than 2.2 (Froyo).

      AV vendors are terrified of Windows' plunging market share, and are desperate to find another host to leech off. This is the despairing screech of a buggy-whip maker watching their buggy-OS host vanish over a cliff.

      --
      "I've got more toys than Teruhisa Kitahara."
    5. Re:This just in! by UltraZelda64 · · Score: 1

      You just took the words right out of my mouth.

    6. Re:This just in! by DrXym · · Score: 1

      In fairness, there is malware on Android however I expect the risk for most people of catching it is pretty minimal. The Play market is proactively scanned and acts reactively to threats up to and including a remote kill capability. And in many cases those that do get infected have their own lack of sense to thank - installing pirated APKs, or dubious apps from untrusted sources and reaping the rewards.

    7. Re:This just in! by oldlurker · · Score: 5, Insightful

      In fairness, there is malware on Android however I expect the risk for most people of catching it is pretty minimal. The Play market is proactively scanned and acts reactively to threats up to and including a remote kill capability. And in many cases those that do get infected have their own lack of sense to thank - installing pirated APKs, or dubious apps from untrusted sources and reaping the rewards.

      Apps are not the only way in though. Web and email coupled with vulnerability exploits are obvious vectors, Bluetooth and NFC exploits have been demonstrated. I'm using an Android phone myself, but I think we are doing ourselves the same disservice Mac users did (and ended up with the biggest malware epidemic in modern times in terms of percentage of user base affected with Flashback) if we discount the malware threat to be just AV vendor marketing and not a potential real threat. Especially since such a large portion of the Android user base is on old vulnerable versions long after Google has patched vulnerabilities and improved security.

    8. Re:This just in! by Hentes · · Score: 1

      But at least they only have access to what you allow them.

    9. Re:This just in! by cbhacking · · Score: 2

      A lot of the world does not heavily use the Play market and prefers to use alternatives. Studies have estimated that around 40% of Android devices in Russia are infected, for example, mostly due to installing apps from third-party sources.

      --
      There's no place I could be, since I've found Serenity...
    10. Re:This just in! by DrXym · · Score: 1

      I very much doubt 40% of Android devices in Russia are infected, although I can well believe the rates of infection are much higher in countries which have a culture of piracy over those that don't.

    11. Re:This just in! by neokushan · · Score: 1

      Yeah, gaping security holes like email attachments with names similar to "bigtits.exe" and "funny.exe".

      Not all viruses exploit security weaknesses, some are just malicious programs that idiot users run.

      --
      +1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
    12. Re:This just in! by Sockatume · · Score: 1

      What about heuristic analysis?

      --
      No kidding!!! What do you say at this point?
    13. Re:This just in! by Anonymous Coward · · Score: 1

      I think gaping holes such as goatse.cx can do more permanent damage ...

    14. Re:This just in! by BasilBrush · · Score: 1

      Not all viruses exploit security weaknesses, some are just malicious programs that idiot users run.

      No, those would be trojan horses. Actual viruses can only work on modern OSs by exploiting security holes.

    15. Re:This just in! by Hizonner · · Score: 2

      The fact that I can't easily run an arbitrary program without giving it the ability to screw up random data on my computer, let alone install a rootkit, is a gaping security hole. In fact, it's a gaping hole that programs are not restricted by default.

      All of the popular general purpose operating systems have hideously weak security architectures that amount to gaping holes, and the phone operating systems are only a little better.

    16. Re:This just in! by neokushan · · Score: 1

      To be honest, I don't actually disagree with you on this one. But then what are these "android viruses" if not trojans themselves?

      --
      +1 IDisagreeSoHeMustBeATrollOrAnAstroturferOrAShill
    17. Re:This just in! by tlhIngan · · Score: 2

      I very much doubt 40% of Android devices in Russia are infected, although I can well believe the rates of infection are much higher in countries which have a culture of piracy over those that don't.

      Chinese Android phones as well, because the only way to get apps is third party stores, which often host said infected apps (most new discoveries of Android malware come from China). Of course, whether or not it's pirated or not is very hard to tell - the legit stores don't do a very good job themselves.

      And Play isn't available in China, either.

      Though, it wouldn't surprise me if a lot of stuff on Play gets pirated because it isn't available elsewhere - if there's a game you want and it's only available via Play, then one really doesn't have much choice other than to pirate it if Play isn't available.

    18. Re:This just in! by cbhacking · · Score: 1

      Ahahahaha, that's a good one. I lived on a sailboat cruising tropical islands. The US - even Hawaii, which I came through on the way back from Tahiti once - is downright prudish compared to that lifestyle. Sure, holding a steady relationship wasn't really an option, but almost anything else was - not much chasing needed. As for professional success, I keep that off my profile but it's not hard to figure out who I am if you really want to. "Lack of professional success" indeed!

      But sure, call me arrogant for pointing out that I also knew how to code from a relatively young age (or whatever thell you felt was arrogant about my prior post), my good Anonymous Coward. I'm sorry you both were and still are too immature to get over your bitterness at those who have had a good life.

      --
      There's no place I could be, since I've found Serenity...
    19. Re:This just in! by cbhacking · · Score: 1

      I wasn't even trying to defeat AVs, mind you - just messing with polymorphic code because the concept sounds cool. That said, defeating heuristics is a *lot* harder - which is why any self-respecting AV scanner uses them. There's lots of techniques, of course - things like self-decrypting code, for example, where any given instance of the actual malicious code (on disk) bears no resemblance to any other one because they use random keys and/or IVs - but there still has to be a decryptor that bootstraps the process, and that can be heuristically identified. I'm waiting to see somebody write malware that lives inside a variety of completely innocuous codebases via ROP gadgets, where the payload executes by "exploiting" a vulnerability in the malicious program and using ROP to generate a completely different instruction sequence out of all that benign code. You still have the bootstrap problem, though; the the ROP stack needs to be loaded and traversed, and that means some heuristically-detectable portion of the malware.

      On the other hand, you have to be careful about false positives as well when using heuristics. A number of legitimate programs, such as Skype, use self-decrypting code. The more broad a net you use to catch malware, the more non-malicious programs you'll inadvertently block. "File has the Execute permission set" is a (taken to extremes) example of a heuristic for detecting Trojans, for example... but a 100% true positive rate isn't that impressive when you also get a 100% false negative rate!

      --
      There's no place I could be, since I've found Serenity...
    20. Re:This just in! by cbhacking · · Score: 1

      I didn't find the article positing that number in my first 10 secodns of searching, but I did find this: http://www.esecurityplanet.com/mobile-security/lookout-predicts-18-million-android-malware-infections-by-end-of-2013.html .

      The likelihood that new Lookout users will encounter malware or spyware is heavily dependent on their geography and behavior, varying from 0.20 percent in Japan to 0.40 percent in the US and as high as 34.7 percent in Russia

      Almost 35% will "encounter" malware in a given year. What precentage of those end up infected, I'm not sure - that would require more investigation into what "Lookout" is and how it works - but the subtitle of the article indicates that "encounter" means infection. Then there's the many devices that will already be infected. 40% doesn't sound high in that light.

      --
      There's no place I could be, since I've found Serenity...
    21. Re:This just in! by Sockatume · · Score: 1

      Thanks, I've not really kept up with antivirus software since the '90s.

      --
      No kidding!!! What do you say at this point?
  2. Compare to recognizing people by rebelwarlock · · Score: 5, Funny

    "Ma'am, is this your son?"

    "Well, my son was wearing a hat, so no."

    1. Re:Compare to recognizing people by Anonymous Coward · · Score: 1

      Slashdot readers cannot relate to this. Do you have a computer, caffeine and basement analogy?

    2. Re:Compare to recognizing people by Trepidity · · Score: 2

      That's closer to how it works when trying to recognize people you don't know well, though. Police sketch-artists sometimes make a few different versions of a sketch, e.g. one with and one without a hat, one with short and one with long hair, etc., because it's not necessarily easy for people to recognize one as the other if it's a stranger.

      --
      10 PRINT CHR$(205.5+RND(1)); : GOTO 10
    3. Re:Compare to recognizing people by Canazza · · Score: 1

      Your computer has been stolen.

      The police call you into the station and show you your computer and ask: "Is this your computer?"

      You respond with: "No, it can't be, this isn't in my basement"

      You all laugh and have coffee and doughnuts.

      --
      It pays to be obvious, especially if you have a reputation for being subtle.
  3. Re:Lucky Android Users by mlw4428 · · Score: 2

    Chances are it does. Just because you're too stupid to believe there's no possible way a virus can get onto your phone, doesn't mean that there's someone out there with the know-how and the skill to do just that. There is (and has never been) anything that is 100% secure.

  4. Re:Lucky Android Users by DaHat · · Score: 1

    Chances are it does. Just because you're too stupid to believe there's no possible way a virus can get onto your phone, doesn't mean that there's someone out there with the know-how and the skill to do just that. There is (and has never been) anything that is 100% secure.

    Really? I've got an HTC 8X on a wireless charger right in front of me (hence the Verizon version)... care to point to a virus or three (or just malware) that targets Window Phones?

    Don't worry... I'll wait.

    While I will admit that nothing is 100% secure... the protection model on Windows Phone does sure seem to keep malicious code away better than Android.

    --
    Help Brendan pay off his student loans
  5. Re:Lucky Android Users by multiben · · Score: 1

    Heh heh heh. Successful troll.

  6. Re:Lucky Android Users by cbhacking · · Score: 1

    It was possible on WP7, at least in the earlier patch versions. I'm not aware of any malware anybody actually created, but there were a few known vulns in most devices that could be exploited for elevation of privilege. They were routinely used for beneficial homebrew software, though.

    On WP8... well, there's no malware known to exist for it yet, but there's nothing much in the way of homebrew either. Microsoft locked the OS up so tightly that it's somewhat limited in terms of actual usability and very limited for extensibility.

    --
    There's no place I could be, since I've found Serenity...
  7. So would it be safe to conclude... by pongo000 · · Score: 2

    ...that AV apps not tested (such as avast!) are immune from this problem, and the authors only chose to report on those AV programs that failed their tests?

  8. Re:Lucky Android Users by DaHat · · Score: 2

    It was possible on WP7, at least in the earlier patch versions. I'm not aware of any malware anybody actually created, but there were a few known vulns in most devices that could be exploited for elevation of privilege.

    Citation please.

    As I recall... the initial 'exploit' used by the ChevronWP7 folks involved running a local web server on your PC... then tricking your phone into developer unlocking against it... rather than the official Microsoft servers.

    I wouldn't exactly call this a vector for virus infiltration.

    Ditto when it comes to homebrew apps (which could only run on developer unlocked device (legit or not unlocked))... and required manual side-loading of the app.

    Claiming malware was possible on WP7 is like claiming it's possible to infect the Pentagon with your super-l33t virus... provided you can trick someone into going into one of the secure server rooms, logging in as a local administrator, accessing your hax0red website... then clicking "Yes, I want to run configure; make; make install".

    --
    Help Brendan pay off his student loans
  9. Not specific to android by detain · · Score: 1

    The same can be said for most any AV software , especially ones on mobile platforms.

    --
    http://interserver.net/
  10. Re:Lucky Android Users by Anonymous Coward · · Score: 1

    Nobody targets Windows phone because nobody cares about windows phone. Nobody uses it. Microsoft is constantly striving to be even relevant, let alone get a remarkably sized userbase.

  11. Re:Lucky Android Users by DaHat · · Score: 1

    Nobody targets Windows phone because nobody cares about windows phone. Nobody uses it. Microsoft is constantly striving to be even relevant, let alone get a remarkably sized userbase.

    I seem to recall that as an excuse around these parts for a decade or so regarding Linux... as well as the claim that "many eyes make bugs shallow"... and yet quite often we hear about a bug in the Linux kernel, or Bind, or some other major component that has been undiscovered for years and years.

    How'd that work out? Oh right... Android (Linux based) is the most easily hackable mobile phone OS out there!

    --
    Help Brendan pay off his student loans
  12. Re:Lucky Android Users by DaHat · · Score: 1

    Security by obscurity works in that it'll take longer before vulns are discovered in rare devices.

    I remember that being said about Linux devices round the parts for so long... which are obviously still (like Oracle DBs) unhackable/unbreakable.

    Just be patient, those W8 things aren't exactly interesting to tech-heads.

    How much longer should I wait? My old HTC Trophy (running Windows Phone 7.x) also (as far as I am aware) never had any major exploits against it.

    While it's easy to say "no one cares about targeting an OS with a .0000000002% market share"... call be silly... but I'm still kind of surprised no one wanted to make a name for themselves as the first person to hack Windows Phone.

    --
    Help Brendan pay off his student loans
  13. Anti Virus software is a scam by Anonymous Coward · · Score: 1

    Anti-virus software is a scam anyway, the OS should be secure enough not to let a program damage your device or corrupt stuff anyway. As anti-trojan detectton it's completely useless too. Any trojan than can make off with your data and sell it anyone and everyone is a bad thing, and yet not a single Facebook app is ever flagged as malware!

    1. Re:Anti Virus software is a scam by inflex · · Score: 1

      I don't know about mobile platforms, but certainly on the PC arena, judging by the features and tricks in recent AV-suite releases, vendors have to been running out of oxygen in their world. Lately I have been repairing more consumer machines due to AV suites going rogue than I have for actual viruses ( AFP/randsom-ware had a burst of popularity recently ).

      These days I just go with Microsoft Security Essentials and leave it at that. The clients still feel protected, they're not out of pocket, and at least it's not as likely to go utterly insane and take out the system and then refuse to be uninstalled cleanly.

  14. Re:Lucky Android Users by AJWM · · Score: 2

    How'd that work out? Oh right... Android (Linux based) is the most easily hackable mobile phone OS out there!

    You say that like it's a bad thing.

    --
    -- Alastair
  15. Bye-bye smartphone virus cleaning software writers by knorthern+knight · · Score: 4, Insightful

    Tell the guys writing the smartphone virus cleaning software that our world is in danger of obliteration by a large asteroid, and we're building a series of Ark ships to get everybody off the planet to safety. The smartphone virus cleaning software writers will depart on the "B" Ark, along with hairdressers and middle-managers.

    Then the rest of us will laugh our asses off.

    --

    I'm not repeating myself
    I'm an X window user; I'm an ex-Windows user
  16. Re:what about the worst virus of all: ANDROID?!?!? by Zaelath · · Score: 1, Funny

    Fuck me, Steve. Get over it already. RIP.

  17. Re:Lucky Android Users by cbhacking · · Score: 2

    Not talking about ChevronWP7 or anything like it. The actual homebrew stuff for WP7 wasn't well publicized, partially because a lot of it was flying under the MS radar so far as possible, but it existed. The best-know "root" program is called WP7 Root Tools (http://www.wp7roottools.com) and exploits various firmware bugs in HTC, LG, and Samsung firmware (and possibly others) for WP7 to gain near-complete control over the OS, disable many of the "security" restrictions (such as the prohibitions on third-party non-"app" executables), give full access to the filesystem, registry, and certificate store, and allow running any other app as TCB (WP7's equivalent of "root" or "Admin"). Other apps before it, including things like TouchXplorer and Advanced Config, took less complete control but nonetheless had permission to do any number of nasty things had that been the intention of the developers. Additionally, once the later versions of Root Tools (with the "elevate other apps" feature) came out, a considerable number of homebrew apps that needed such permissions immediately sprung up, providing a perfectly good avenue for somebody to slip in a Trojan app. Indeed, it was a considerable concern.

    The point about requiring manual sideloading is valid (in fact, installing WP7 Root Tools would have been a lot easier if Microsoft would have signed it and put it in the store, since otherwise it could be difficult to install on some devices after Mango introduced the interop-lock). However, I fail to see the important difference between installing an app you think is safe because it's on the store, and an app you think is safe because it comes out of the developer community that has been adding such cool features to your phone. Either way, it's a manual action on your part to install the app, and most people aren't going to decompile it and examine it for malicious code even if they had the know-how to do so. As for whether Trojans in general constitute "real" malware, that's all that the Android apps in question are, or the malicious iOS apps for jailbroken phones, or similar.

    To address your little analogy, social engineering is one of the best ways to bypass security there is; the weakest link in computer security usually sits between the user's ears. Also, your analogy seriously falls flat on its face when you consider that it wasn't supposed to be *possible* to "[log] in as a local administrator" on WP7. A seriously locked-down system wouldn't allow your scenario either.

    Then there's the minor, but really easy, attacks which were possible against WP7 without requiring firmware access or bypassing interop-lock or any such thing. For example, the XAP files that would let you access other device or operator marketplaces could just have easily crippled your phone's marketplace functionality, overwritten your personal documents, broken your installed apps, and other things. Those were just carefully crafted ZIP archives with a .XAP extension and some XML files to make the installer recognize them; the same attack was actually possible using .ZIP files as well and wouldn't have been that hard to socially engineer somebody to try, or could have been bundled into an otherwise-legit XAP on the store.

    --
    There's no place I could be, since I've found Serenity...
  18. Copy protection prevents scanning by ensignyu · · Score: 5, Informative

    This doesn't surprise me at all. The so-called virus scanners can't actually scan for viruses (i.e. examine the code of third-party apps) because that would break the copy protection. The paper mentions this at the beginning.

  19. Re:Lucky Android Users by cbhacking · · Score: 4, Interesting

    Do you have WP7 Root Tools installed on your Trophy? If so, at least three different exploits were used: the ZIP path traversal that made the interop-unlock "app" work (all the work was actually done by the installer), the Connection Setup hack that achieved interop-unlock by hijacking the network database using some debug code to inject a script that modified the registry, and the exploit that Root Tools itself used in the HTC drivers to gain arbitrary code execution in the kernel.

    Just because Heathclif74 was not, so far as anybody knows, embedding any malware in his software doesn't mean he couldn't have been, or one of the many other authors posting their work on XDA-Devs and WPCentral.

    --
    There's no place I could be, since I've found Serenity...
  20. Amazing, new variants of malware go undetected.... by Dr+Black+Adder · · Score: 2

    Modifications of the binaries creates a new variant of a virus, which may go undetected. I'm shocked! If you'd like an AV solution that performs a deep inspection on every binary, each time they are executed on your device, it's going to be a sloooooow ride.

  21. Re:Lucky Android Users by mtb_ogre · · Score: 1

    How much longer should I wait? My old HTC Trophy (running Windows Phone 7.x) also (as far as I am aware) never had any major exploits against it.

    Maybe another 5 million users or so? Oh wait...

  22. Re:Lucky Android Users by crutchy · · Score: 5, Insightful

    yet quite often we hear about a bug in the Linux kernel, or Bind, or some other major component that has been undiscovered for years and years

    i seem to recall that as an excuse around these parts for a decade (continuing today) regarding linux... and yet those bugs aren't exploited, even when the potential target is driving much of the consumer embedded world, servers (including probably majority of web servers and many large corporate intranets), and now smartphones.

    Android (Linux based) is the most easily hackable mobile phone OS out there!

    calm down a bit there sunshine... android is really a userland running on a virtual machine (dalvik). if you find an android vulnerability that affects the underlying linux kernel, then you'll have a major story. yes android is probably pathetically insecure (it would be nice if it were as secure as linux), but the linux kernel underneath dalvik is as tight and tested as the numerous datacenters around the world require it to be.

    some slashdotters like to pick on how linux fans claim android = linux when it suits and not when it doesn't. android is an application layer running inside a virtual machine (so it is separated from the linux kernel), but there is still linux underneath (so every android deployment is also a linux deployment). linux and android are usually lumped together when arguing about market share, and separated when arguing about security, but there's nothing contradictory if you take the context of the argument into account.

  23. Re:what about the worst virus of all: ANDROID?!?!? by crutchy · · Score: 1

    what about the worst virus of all: ANDROID?!?!? that entire OS is a virus masquerading as a useful product. it needs to obliterated

    regards,

    steve ballmer

  24. Re:Lucky Android Users by Nerdfest · · Score: 1

    Malware that targets your phone? You realize that the software comes from Microsoft, right?

  25. Trivial Obfuscation by puddingebola · · Score: 1

    Landshark. Candygram.

  26. Re:Amazing, new variants of malware go undetected. by CastrTroy · · Score: 1

    Besides. Android does a pretty good job of controlling what each and every app can access. There's a sandbox around each app. As long as you are careful which apps you install, and look closely at the permissions they require, you should be relatively safe from most malware. If you're at all unsure about an app, it's probably better just to not install it. Sure there are problems, but I think Android is one of the better platforms out there. Not too many others I'm aware of have such fine grained control of what exactly each application may do on your system.

    --

    Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
  27. Re:Amazing, new variants of malware go undetected. by BasilBrush · · Score: 1

    "Deep inspection" would only be needed the first time an executable is run. It's easy and quick to check a file hasn't changed since last time.

  28. Re:Lucky Android Users by dano.obrien6682 · · Score: 1

    yes android is probably pathetically insecure ...but the linux kernel underneath dalvik is as tight and tested as the numerous datacenters around the world require it to be.

    Even if true, how exactly does this distinction matter to the millions of Android users out there?

    "My phone was so infected that it was unusable, all my accounts were hacked, and my porn stash was stolen, but at least it was just the vm and my linux kernel held up! (at least I think.. i can't really tell...)"

  29. Because..there are so many Linux viruses? by gelfling · · Score: 2

    I don't practice particularly careful practices with my phone AT ALL, installing and uninstalling things all the time, etc etc and at most, at the absolute most, I've seen one chunk of malware. The real problem is not malware it's the permissions you grant the legitimate stuff you put on. WHY, does such and such game or widget need my phone book, email address book, call log browser history and location db? That's the problem right there.

  30. Publish signatures of clean files by Cacadril · · Score: 1

    Why can't the major software vendors publish sha265sum signatures (hashes) of all their files?
    Why can't the major software vendors cooperate on a dns-like service where you look up the signature of a file you have on your disk in order to know if it is unaltered?
    Why can't we crowd-source a new service where people and everybody can submit the signatures of files they have and believe to be OK...
    - because the bad guy or his first victim would register the signature of the infected file?
    - Well, let's take some measures... The submitters need to have had a pgp/gpg key registered with a keyserver for at least two years,
    and the service response includes a field telling how many distinct submitters have submitted this same signature.
    All right, I come to think about more problems with this idea faster than I can write about them... But many of them have fairly obvious solutions, and some may not completely invalidate the benefits... Who would like to contribute to a discussion about such a concept?

    --
    There is no substitute for common sense. Especially, no body of rules will do.
  31. Re:Lucky Android Users by idunham · · Score: 1

    Point me to a few viruses for BeOS, OS/2 / eComStation, SolarOS, or Menuet.

    Android is the most hackable mobile phone OS out there? Sure, but if you're going to argue that that discredits the security of the kernel like you seem to be saying, go ahead and point out how much of that is due to kernel bugs. (As far as I can tell, the main kernel bug was Samsung's ugo+rwx access to system memory--which would only be an issue for those who haven't updated).

    The real issue is twofold:
    First, many eyes won't do a thing to help if half the phones never get a single update after source code goes public. If you can find and fix every single bug within a month of the source drop, it will not change security for a device that's stuck with a rom from just after the code drop.

    Second, notice that term "code drop". To quote Rob Landley, "Android isn't open source, it's regularly updated abandonware." "Many eyes" cannot work when there's no source before release; when you look at Honeycomb, applying it to Android becomes even more absurd.

  32. Re:Lucky Android Users by crutchy · · Score: 1

    Android does not run on a virtual machine, it uses the Dalvik VM to execute apps written in Java

    err... you do realize what the "VM" bit stands for right?

    i know "android" is the collective term for the kernel, vm and wm, libs, etc, but the insecure bit that TFA is probably talking about (who actually reads TFA anyway) is the app layer, not the kernel... if a virus were able to breach the kernel it would make front page news around the world because there are huge interests at stake (including corporate and government).

    from http://en.wikipedia.org/wiki/Dalvik_(software) ... "Dalvik is the process virtual machine (VM) in Google's Android operating system".

    It's also perfectly capable of exerting native apps that bypass the VM

    i would be interested to know what native apps can bypass the vm without first gaining root access at least (with root of course you can do anything and so could a virus).

  33. Re:Lucky Android Users by crutchy · · Score: 1

    how exactly does this distinction matter to the millions of Android users out there

    1) i wasn't addressing the millions of Android users out there
    2) it was part of my argument with the parent comment (which was trying to conflate the insecure bit of android with linux)

    "My phone was so infected that it was unusable, all my accounts were hacked, and my porn stash was stolen, but at least it was just the vm and my linux kernel held up! (at least I think.. i can't really tell...)"

    that same kernel (well, mostly same) is shared by more than just android...if dalvik is corrupted to the point of destruction but the kernel holds up, that will probably matter more to the world that all the embedded and datacenter applications are still secure

  34. Re: what about the worst virus of all: ANDROID?!?! by crutchy · · Score: 1

    in all fairness to apple (i'm a linux fanboi, not an isheep)... users don't go looking for viruses to infect their system (windows and mac), but because mac has heritage in the multi-user unix platform it has some inherent security advantages over windows, which seems to get infected even without user intervention.

    windows has a virus problem not only because it is so easily infected by its design, but because it is so easily infected makes it even more of a target

    ballmer really hates the gpl because it prevents him from building the secure bits of linux into windows and solving all his virus woes... well maybe

  35. Googles Bouncer by PuZZleDucK · · Score: 1

    Does Bouncer detect the origional? I'd be (possibly more) curious to know if Bouncer could detect the variants too.

    --
    Can a person program a new solution to a problem? Why should anyone be able to stop such a thing? -Richard Stallman
  36. Re:Lucky Android Users by crutchy · · Score: 1

    err..yeah, I do. It's what "Android doesn't run on".

    i realize we're just talking across each other, but part of android does run inside dalvik (which is a virtual machine). in the context of this thread and TFA, the part of android in question is the part running inside the VM, which the post that i was originally replying to was conflating with the linux part (outside the VM).

    A recent Samsung kernel exploit was found in any phones that used the Exynos 4412 and 4210 CPU's. It did make the news, but not exactly around the world

    i guess if its not an inherent vulnerability that would make sense, and the vulnerability would have to be exploited for it to make front page news. vulnerabilities that can't really be exploited aren't as sensational. i'm not familiar with the samsung thing, but i'm guessing it wasn't a serious threat.

    apps written using the NDK are coded in C/C++ with light Java wrappers that do nothing but call the code

    native windows programs still run the same way when run on windows inside a virtualbox vm too, but they are still constrained by the limits of the virtual machine. dalvik is a process virtual machine, but i'm assuming even the c/c++ programs you mention are constrained by the limitations of the dalvik process. is it even possible to run a process outside dalvik from within dalvik? i wouldn't have thought so but i could be wrong. maybe if you had root access you could run malicious code on the next boot, or maybe create a cron job, but it would still require root filesystem permission. i'm still (even after reading a little bit about it) not really familiar with how you can gain root filesystem permissions from within dalvik given that i would assume dalvik would itself be running as a separate user with restricted filesystem permissions (kind of like apache). a wikipedia page on the topic talks about "exploiting security bug(s) in the firmware" but that would then be device-specific (like a bug in any device driver). if anyone has any experience in rooting an android device i would be interested to hear how it is done (practically speaking). there is a "su" app, but i imagine there is more to it than just installing the app. i'm not interested in rooting my android phone, but it might help my understanding of how android in general works (because abstract android framework diagrams don't really tell me a whole lot).