Slashdot Mirror
Malware Posing As Official Google Play Store Evades Most Security Checks
DavidGilbert99 (2607235) writes Mobile malware on Android is nothing new, but now security company FireEye has discovered in the Google Play store a sophisticated piece of malware which is posing as....the official Google Play store. Using the same icon but a different name, the malware is not being detected by the vast majority of security vendors, is difficult to uninstall and steals your messages, security certificates and banking details.
Dear submitter,
Link me to an article. I don't want to search for the company's announcement, and I don't want to just take your word for it.
Can I buy a link? Timothy strikes again.
"National Security is the chief cause of national insecurity." - Celine's First Law
If you're dumb enough to download the Google Play store FROM THE REAL GOOGLE PLAY STORE THAT YOU'RE ALREADY ON... then you deserve to get some malware.
I mean, with the recent dumbing down of fine-grained authorizations when installing apps, it's Google Play itself that feels like a security liability.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Not sure how this brief blurb with no link got posted, but here is a link to an actual story.
Why doesn't Android have a permissions structure that allows the user to explicitly manage the permissions for each app?
If I want to disable access to the contacts for any given app, I should be able to do that. If it breaks functionality of the app, then that is MY problem, but in most cases, it wouldn't cripple the app; I don't need my shopping list to be able to read my contacts and send premium text messages on my behalf.
the above is my personal opinion and does not necessarily reflect that of the little voices in my head
And this is the reason I won't do banking on an Android phone much the same as I refuse to do online banking from a Windows PC.
I've been sticking to my Linux distro for that and felt that it's the best way to function with some security on my end.
So I R'd TFA, and I can't see anything which says *how* you get this. Or if it's in there I can't find it.
I assume it either piggy backs on something else downloaded from the app store, or comes in from someone enabling apps to come from other places.
The fact that an application can even disable the uninstall feature is pathetic.
And, sadly, Google has removed even more permissions control, so this will only get worse.
I still maintain I should be able to go in at any time and remove permissions from apps -- because, quite frankly, why something like a Flashlight needs access to my messages and contacts has always been a mystery.
Lost at C:>. Found at C.
This is yet another piece of software which the user needs to download, enable installation of third-party apps, and install.
What do you mean "third party apps"? The summary and TFA claim that this one is in the official Google Play store.
URL: http://www.fireeye.com/blog/te...
Maybe it came already installed... sounds awfully like one that does (just buy the phone from the ad in the web page...):
http://www.theguardian.com/tec...
Good point. Mind you, that kinda makes anyone who installs it even dumber than I would have thought.
Log in or piss off.
Nahh, installing Cyanogenmod is quite easy and can get rid of this malware almost instantly.
Do not look at laser with remaining good eye.
So, all I have to do is enable apps from outside the official store, download from an unknown site, and then I'll have full access to 1,100 apps!, which almost all also exist in the Play store, which I don't have to enable outside apps and download from an unknown source?
Google Play doesn't. Go ahead. Provide the link to it -- you can't because it's not there.
Unless I install the developer tools on a separate machine, there's no telling if the downloadable .apk on f-driod matches the provided source on f-droid.
Using f-droid requires lowering your machine's security, and trusting another source -- f-droid, just because you said so.
This kind of thing probably wouldn't happen if Android were Free/Libre Open-Source Software. As Google quietly effectively close-sources Android piecemeal, by making it so that parts of the OS, as provided are Google-PROPRIETARY, like the store itself, security problems will abound. It's only natural. To save time, money, and ink, Google's shortened it's motto by one word, and didn't tell anyone. The one word, in case you didn't already guess, is "Don't". They're every little bit as bad as M$ ever was, they are the GE of information, or the Ma' Bell of data, and they do things like this.
They take a company like Android, (or whatever the company itself was called,) that took Linux, a free and open-source OS, strip off the GNU utilities and replace them with their own, tooled to work in a touch-based, mouse-free environment with no assurance of a physical keyboard being available, and buy it out. Then they take the parts they want to replace with their own versions, replace them, and fragment Android.
One version, the FL Android, is still available, but without kick-backs from Google, most phone manufacturers, tablet makers, etc., won't bother with it, because people it seems WANT access to Google's proprietary apps. So they are obliged to take Google/Android, with all its proprietary BS, which no one outside Google (or their hog-tied by NDA's developer community) can readily verify works the way its supposed to like they could if Android were provided in its original form, the FREE/LIBRE version...
Long story short, Android's become a huge, flaming pain in the ass, and if I'm going to surrender my personal info to a giant, multinational behemoth, I'd rather it be one that sells an actual physical product, so they have a way of making money to pay for the software development that DOESN'T involve selling my personal information to the highest bidder, (or anyone who wants it, actually) and whoring my eyeballs out to advertisers looking to push their bullshit on me, because Google sees the user as a product, a pair of eyeballs and support system for a wallet. I'll take my phone and mobile-OS from someone that has at least PRETENDING it's got my back as its core mission, (aside from making scads of money for its investors, naturally,) and wants me to feel like I'm getting value, and the best user experience for my money, though I won't say WHOM, because I'm not a shill.
~ Sent from my iPhone
I've never gotten an Android app anywhere but F-Droid. I don't know why anyone would.
Because F-Droid carries only free software, and there are several categories of application that aren't going to be free any time soon. These include (for example) games, applications to view rented movies, and applications to prepare a tax return. What's the free alternative to, say, Sonic the Hedgehog or the Netflix or H&R Block app?
Yes it is, so long as the separate features are factored into separate packages on Google Play Store. Under Android, packages signed with the same software publisher certificate can share data through the sharedUserId mechanism. This lets the user install one main interactive app, which appears in the launcher or IME chooser or whatever, and then several helper apps that expose content provider services to the main application. For example, a keyboard could have helper apps that extend its autocorrect dictionary. These would include one for each language, one that adds the names of nearby businesses (which requires Internet and location), and one that adds the names of your contacts (which requires access to your contexts). These might be named something like "Swype auf Deutsch", "Swype Local", and "Swype Knows Your Name", and the main app would open their respective Google Play Store pages when the user turns on the main app's features that require them.
Pretty much every app I try to install wants access to everything to function. I try to install a simple game, it wants access to my phone history, contacts, email, google accounts, and fuck knows what else.
Android phones were sold in some countries before Google Checkout (now Google Wallet). In countries without Google Checkout, Android Market (now Google Play Store) showed only freeware apps. In order to derive revenue from users in those countries, developers had to put ads in their apps. And in order to compete for users with developers that had embraced adware, other developers had to make their apps free as well. Google Wallet has since expanded to far more countries, but the expectation of a freeware price point in Google Play Store has continued. And the push for ad revenue has led to more targeted ad delivery systems, which need to see more of your PII. See also tlhIngan's comment.
It's not as widespread on iOS because Apple introduces the iTunes Store in each country before selling iProducts there. This means a payment system always precedes the App Store, preserving an international market for paywalled apps.
In any case, if you want to limit your exposure to Android adware that needs to see your PII, turn on "Unknown sources" and install F-Droid, which allows only applications distributed under a free software license. If you're worried about the security implications of turning on "Unknown sources", then turn on "Unknown sources" only when using F-Droid and turn it off when done. There's not nearly as much selection, especially because free and games mix like oil and water, but what you do get has fewer annoyances.