Slashdot Mirror
Stealthy Google Play Apps Recorded Calls and Stole Emails (arstechnica.com)
An anonymous reader quotes Ars Technica:
Google has expelled 20 Android apps from its Play marketplace after finding they contained code for monitoring and extracting users' e-mail, text messages, locations, voice calls, and other sensitive data. The apps, which made their way onto about 100 phones, exploited known vulnerabilities to root devices running older versions of Android.... As a result, the apps were capable of surreptitiously accessing sensitive data stored, sent, or received by at least a dozen other apps, including Gmail, Hangouts, LinkedIn, and Messenger. The now-ejected apps also collected messages sent and received by Whatsapp, Telegram, and Viber, which all encrypt data in an attempt to make it harder for attackers to intercept messages while in transit... To conceal their surveillance capabilities, the apps posed as utilities for cleaning unwanted files or backing up data.
Google reports that the malicious apps also had these functions:
Google reports that the malicious apps also had these functions:
- Call recording
- VOIP recording
- Recording from the device microphone
- Location monitoring
- Taking screenshots
- Taking photos with the device camera(s)
- Fetching device information and files
- Fetching user information (contacts, call logs, SMS, application-specific data)
12 hours later an antivirus provider reported two more Google Play apps could surreptitiously steal text messages by downloading a malicious plugin -- and that the apps had already been downloaded at least 100,000 times.
Another false sense of security that walled-gardens try to trick people into believing they provide (it's purely a money grab for the store providers). Sure, they can remove the apps, but the deed was already done and you can't take that back.
This has virtually nothing to do with Linux. If/when google switches their kernel to something different (it's in the works now), the play store will still have this wild Wild West model. Torvaldes has 0 control over this because he doesn't work on the android user space, just the kernel. And this has happened in the iOS App Store, just in much much smaller quantities and less often
Whatever you do don't provide a list of the apps...
That's not sad at all. "Safe spaces" have their appropriate uses. I consider the iOS walled garden to be a valuable feature. Since I don't have the time or inclination to mess around with my phone's internals, I don't care that I'm forbidden from doing so. I just want it to work, and it does, in a mostly secure way.
Honest question: Why is it possible for application A from company X to access information from application B from company Y? I could understand if they were both from company X and were signed with the same certificate but it's nothing like that! No application should EVER have full system access.
Anons need not reply. Questions end with a question mark.
As a result, the apps were capable of surreptitiously accessing sensitive data stored, sent, or received by at least a dozen other apps, including Gmail, Hangouts, LinkedIn, and Messenger.
"Hey! That's our business model!" was proclaimed inside Google HQ.
Just how often does one take a selfi? I don't trust any forward facing camera.
I use Finger nail polish to cover it as it's almost permanent - used to use electrical tape.
Most apps ask for complete access to the phone. For example, why does a guitar tuner need access to my contacts? Or my camera? Or my location?
And I see it for MOST of the apps on Google Play. Therefore, I don't use many apps from Google Play. And we're not even talking about what Google slips into the base system.
There is no justifiable reason or excuse for this behavior.
When I download apps for my iPad, I don't have any such issues. And it's not a take it or leave it proposition, either. iOS apps put a popup and asks explicitly for access.
iOS is superior. I only use Android because the phones are much cheaper - and I only use a smartphone because people prefer texting over calling these days.
I mean I guess they could have hid this in a game app, but it would have been more questionable why it wanted all of those permissions.
They should just ban cleanup/AV/nonsense utility scumware as a category from their stores, these things aren't really needed on such locked down mobile OS. They might have had some value in the day of like Windows 95 but now they are just the computer equivalent of a scummy mechanic charging an old lady for 'turn signal fluid'.
You too can obtain this ability, just sign up and pay the cost.
I can't view the site as it's in my Routers block file, but it used to be google now appears to of been taken over by Yahoo.com
You need to opt out of flurry.com, twice Google flurry.com requires a number only your phone has. Yahoo a opt out google will take you to a selection you can turn off.
Okay fine, I have two: Rocket Player and one for local highway traffic provided by the city.
That's it, though. All the other apps that are installed came with the phone. I should probably remove those...
Palaces, barricades, threats, meet promises
I do.
The best TOS I've encountered was the one for Angry Birds Rivio.com at the time. It told one everything it was going to do with your data it was the 2% overseas that I never caught or yet to of figured out. It also led me to flurry.com.
Samsung HDTV's - their TOS tells you they will be recording everything you do and keeping it, While it's meant to predict your needs, I know of two /. articles of Samsung having to tell people they can hear everything you say.
Two things wwould fix this:
1. Instead of being "Google Play" or "Everything else" the user should be able to say: I trust Google Play, F-Droid, and APK Pure only.
2. All the handset makers need to provide support for Vanilla Stock Android VIA Lineage OS or Similar. Cough up Driver APKs, and stop allowing handset makers to bake Malicious software like ADUPS in the System area.
This means no matter how much skill Android users possess Android users can't usefully investigate and fix the leveraged vulnerabilities themselves should they wish to do so or hire someone to do so on their behalf. The most they could do is write an exploit which demonstrates the bug, report the bug with the exploit program, and hope the proprietor takes corrective action. Upgrading to another version of proprietary software is no real fix as it could (at best) mean trading in fixes for these bugs in for other bugs the users are prevented from usefully investigate and fix. The user being rather helpless to improve their own situation or help their community all along the way. This is how proprietary (read: non-free, user-subjugating) software treats its users.
All complex software has bugs, proprietary OSes and apps are no exception, but as the GNU Project points out, "The difference between free software and nonfree software is in whether the users have control of the program or vice versa. It's not directly a question of what the program does when it runs. However, in practice nonfree software is often malware, because the developer's awareness that the users would be powerless to fix any malicious functionalities tempts the developer to impose some.". Since there aren't any free software tracker (none might be possible so long as the phone network insists on proprietary control over the user's device) this is also an opportunity to learn to say no to proprietary control and do without a tracker (and, yes, particularly given the context of this thread it is proper to call them 'trackers' and not 'cell phones' or 'mobile phones', names which help obscure the main reason organizations want users to get these devices and install apps in the first place).
Digital Citizen
Short answer: no.
Android is the MS Windows of the mobile world but hey, those phones are cheap nigga!!!
No, this story was about, only apps can app you up the app.
So some crappy app from the play stire can root my phone but I can't?
All 3rd party apps destroy smartphone security, because you can never be certain they didn't find a back door exploit and aren't elevating their privileges to root - which can do anything.
Don't do anything personal or sensitive on any smartphone or tablet. Definitely don't use them for banking.
With apps doing their own license checks, cloud-storage clients, or server-side AI (eg. voice commands), they become more vulnerable to attack and more likely to hold Trojan malware by design.
Google created this mess in the first place. Now I'm seeing tablets and phones where you're not allowed to root and as such I don't even want it anymore. Things that I used to be able to do, I'm not allowed to do anymore and I'm not dictated by Google or Apple how I'm supposed to do things. And now with the years going by, there is a huge mess of applications that are not even supported anymore on both Apple's store and Googles play store, which in itself is creating another security nightmare.
A decade ago, we had this problem solved. Google and Apple, with their absolute greed, destroyed all this and every package manager that actually worked. Their solution is to just put massive limitations on everything where you might as look in the dustbin for that old Nokia phone and dump your smart phone.
Sorry to trouble you, but, um ... what are the apps? What are they named?
... why Apple's walled garden is such a bad thing?
......a Samsung stock app
Remember ActiveX? There were a lot of things wrong with the design, but one of the worst things that it did, from a security perspective, was condition users to hit 'okay' to dialog boxes saying 'this bit of untrusted code needs complete access to your computer, allow?' Android has done the same thing: encouraged users to accept that every app needs complete access to your call log, browsing history, text message history, and so on.
iOS is somewhat better in this regard, because apps are expected to start with no permissions and prompt for permissions that they need as they need them. Most non-malicious apps need few permissions and users get into the habit of tapping 'deny' when the permission doesn't seem like one that the app should need.
Note that this has nothing to do with Linux vs XNU (both models could easily be implemented on either kernel), it is a UI design issue and Apple is generally a lot better than Google at HCI.
I am TheRaven on Soylent News
Actually, this is wrong. The problem isn't Android as such, but rather that Google has always been far too lenient with developers and applications which demands far too much access to device. If they had started to throw out applications and their developers on their asses from the start when they started nosing around where they have no business being, it wouldn't be a problem.
iOS is somewhat better in this regard, because apps are expected to start with no permissions and prompt for permissions that they need as they need them.
I'm pretty sure the OS is prompting for permission and not the App.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
Guzzle piss you vatnik fucking moron.
I don't think he wants to put you out of work snowflake
Since POTUS loves to tweet from an old Android phone, what are the odds he's infected?
Thanks alot google. Hope you got paid for the data at least.
How to fix.
"Requires permission for blah blah blah" "Yes" "No" "Report App For Excessive Permission Demands"