Slashdot Mirror
Malware Posing As Official Google Play Store Evades Most Security Checks
DavidGilbert99 (2607235) writes Mobile malware on Android is nothing new, but now security company FireEye has discovered in the Google Play store a sophisticated piece of malware which is posing as....the official Google Play store. Using the same icon but a different name, the malware is not being detected by the vast majority of security vendors, is difficult to uninstall and steals your messages, security certificates and banking details.
Dear submitter,
Link me to an article. I don't want to search for the company's announcement, and I don't want to just take your word for it.
Can I buy a link? Timothy strikes again.
"National Security is the chief cause of national insecurity." - Celine's First Law
If you're dumb enough to download the Google Play store FROM THE REAL GOOGLE PLAY STORE THAT YOU'RE ALREADY ON... then you deserve to get some malware.
I mean, with the recent dumbing down of fine-grained authorizations when installing apps, it's Google Play itself that feels like a security liability.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
This "story" has no link. Most personal blogs aren't this bad. WTF is going on people?
Not sure how this brief blurb with no link got posted, but here is a link to an actual story.
Because I haven't seen it included by the poster:
http://www.fireeye.com/blog/technical/2014/06/what-are-you-doing-dsencrypt-malware.html
Queue Android fanboi apologists in 3...2...1...
Why doesn't Android have a permissions structure that allows the user to explicitly manage the permissions for each app?
If I want to disable access to the contacts for any given app, I should be able to do that. If it breaks functionality of the app, then that is MY problem, but in most cases, it wouldn't cripple the app; I don't need my shopping list to be able to read my contacts and send premium text messages on my behalf.
the above is my personal opinion and does not necessarily reflect that of the little voices in my head
F-Droid unaffected.
Easy: Don't. Fucking. Install. It.
This is yet another piece of software which the user needs to download, enable installation of third-party apps, and install. Or the user might've installed it from a dodgy app store (in which case their device is likely already a teeming mess of malware).
Either way, the user needs to do something we've spent the last umpteen years trying to indoctrinate people against.
Wake me up when someone starts injecting this stuff through advertisements in web pages.
Log in or piss off.
And this is the reason I won't do banking on an Android phone much the same as I refuse to do online banking from a Windows PC.
I've been sticking to my Linux distro for that and felt that it's the best way to function with some security on my end.
So I R'd TFA, and I can't see anything which says *how* you get this. Or if it's in there I can't find it.
I assume it either piggy backs on something else downloaded from the app store, or comes in from someone enabling apps to come from other places.
The fact that an application can even disable the uninstall feature is pathetic.
And, sadly, Google has removed even more permissions control, so this will only get worse.
I still maintain I should be able to go in at any time and remove permissions from apps -- because, quite frankly, why something like a Flashlight needs access to my messages and contacts has always been a mystery.
Lost at C:>. Found at C.
It stands to reason if a company implements and allows users to Bring Their Own Device and requires them to install additional software on the device, say security certificates to be able to access the company VPN network. It's only a matter of time before some users install some sort of malware embedded into a game or another app store to allow this kind of attack. It seems to me that security on android is pretty much abysmal at worst, and ok assuming you have an intelligent user who doesn't install everything under the sun. What are other / dotter's opinions on security for android. Is it even able to be secured? ***Disclosure: I've only recently started using android myself in the last year ***
“The good news is that the risk of infection is low. Mouabad.p only works on Android versions older than 3.1....
The IOS fanboys go to great lengths to not mention that
The Play store now automatically grants full network access to any app that asks for it. And doesn't tell you about it.
This is my last Android phone.
the malware is not being detected by the vast majority of security vendors, is difficult to uninstall and steals your messages, security certificates and banking details.
to the "real" play store.
URL: http://www.fireeye.com/blog/te...
Nahh, installing Cyanogenmod is quite easy and can get rid of this malware almost instantly.
Do not look at laser with remaining good eye.
I do not do my banking on my Nexus tablet. Nope. No online bill pay either. I use the desktop with Comodo security.
This kind of thing probably wouldn't happen if Android were Free/Libre Open-Source Software. As Google quietly effectively close-sources Android piecemeal, by making it so that parts of the OS, as provided are Google-PROPRIETARY, like the store itself, security problems will abound. It's only natural. To save time, money, and ink, Google's shortened it's motto by one word, and didn't tell anyone. The one word, in case you didn't already guess, is "Don't". They're every little bit as bad as M$ ever was, they are the GE of information, or the Ma' Bell of data, and they do things like this.
They take a company like Android, (or whatever the company itself was called,) that took Linux, a free and open-source OS, strip off the GNU utilities and replace them with their own, tooled to work in a touch-based, mouse-free environment with no assurance of a physical keyboard being available, and buy it out. Then they take the parts they want to replace with their own versions, replace them, and fragment Android.
One version, the FL Android, is still available, but without kick-backs from Google, most phone manufacturers, tablet makers, etc., won't bother with it, because people it seems WANT access to Google's proprietary apps. So they are obliged to take Google/Android, with all its proprietary BS, which no one outside Google (or their hog-tied by NDA's developer community) can readily verify works the way its supposed to like they could if Android were provided in its original form, the FREE/LIBRE version...
Long story short, Android's become a huge, flaming pain in the ass, and if I'm going to surrender my personal info to a giant, multinational behemoth, I'd rather it be one that sells an actual physical product, so they have a way of making money to pay for the software development that DOESN'T involve selling my personal information to the highest bidder, (or anyone who wants it, actually) and whoring my eyeballs out to advertisers looking to push their bullshit on me, because Google sees the user as a product, a pair of eyeballs and support system for a wallet. I'll take my phone and mobile-OS from someone that has at least PRETENDING it's got my back as its core mission, (aside from making scads of money for its investors, naturally,) and wants me to feel like I'm getting value, and the best user experience for my money, though I won't say WHOM, because I'm not a shill.
~ Sent from my iPhone
Why is this being posted when there is no article associated with it?
I've never gotten an Android app anywhere but F-Droid. I don't know why anyone would.
Because F-Droid carries only free software, and there are several categories of application that aren't going to be free any time soon. These include (for example) games, applications to view rented movies, and applications to prepare a tax return. What's the free alternative to, say, Sonic the Hedgehog or the Netflix or H&R Block app?
Yes it is, so long as the separate features are factored into separate packages on Google Play Store. Under Android, packages signed with the same software publisher certificate can share data through the sharedUserId mechanism. This lets the user install one main interactive app, which appears in the launcher or IME chooser or whatever, and then several helper apps that expose content provider services to the main application. For example, a keyboard could have helper apps that extend its autocorrect dictionary. These would include one for each language, one that adds the names of nearby businesses (which requires Internet and location), and one that adds the names of your contacts (which requires access to your contexts). These might be named something like "Swype auf Deutsch", "Swype Local", and "Swype Knows Your Name", and the main app would open their respective Google Play Store pages when the user turns on the main app's features that require them.
Concerning the recent behavior of Google...
see recent news about youtube and independent music publishers
see Ted Talk with Charlie Rose and Google found what's his name, where Page says "information wants to be free," while Google is screwing book publishers and authors, digitizing books, often with errors, and claiming a a new copyright for the 'digitized' version
I don't even need 20-40 phone calls at my business each day from scammers pretending to represent Google Maps or Google Woogle (Hey, I sound trademark that!) to make me want to shut out all things Google.
"Do no harm," my asphalt!
Pretty much every app I try to install wants access to everything to function. I try to install a simple game, it wants access to my phone history, contacts, email, google accounts, and fuck knows what else.
Android phones were sold in some countries before Google Checkout (now Google Wallet). In countries without Google Checkout, Android Market (now Google Play Store) showed only freeware apps. In order to derive revenue from users in those countries, developers had to put ads in their apps. And in order to compete for users with developers that had embraced adware, other developers had to make their apps free as well. Google Wallet has since expanded to far more countries, but the expectation of a freeware price point in Google Play Store has continued. And the push for ad revenue has led to more targeted ad delivery systems, which need to see more of your PII. See also tlhIngan's comment.
It's not as widespread on iOS because Apple introduces the iTunes Store in each country before selling iProducts there. This means a payment system always precedes the App Store, preserving an international market for paywalled apps.
In any case, if you want to limit your exposure to Android adware that needs to see your PII, turn on "Unknown sources" and install F-Droid, which allows only applications distributed under a free software license. If you're worried about the security implications of turning on "Unknown sources", then turn on "Unknown sources" only when using F-Droid and turn it off when done. There's not nearly as much selection, especially because free and games mix like oil and water, but what you do get has fewer annoyances.