Slashdot Mirror


Researchers Find Google Play Store Apps Were Actually Government Malware (vice.com)

Security researchers have found a new kind of government malware that was hiding in plain sight within apps on Android's Play Store. And they appear to have uncovered a case of lawful intercept gone wrong. An anonymous reader writes: This new case once again highlights the limits of Google's filters that are intended to prevent malware from slipping onto the Play Store. In this case, more than 20 malicious apps went unnoticed by Google over the course of roughly two years. Motherboard has also learned of a new kind of Android malware on the Google Play store that was sold to the Italian government by a company that sells surveillance cameras but was not known to produce malware until now. Experts told Motherboard the operation may have ensnared innocent victims as the spyware appears to have been faulty and poorly targeted. Legal and law enforcement experts told Motherboard the spyware could be illegal. The spyware apps were discovered and studied in a joint investigation by researchers from Security Without Borders, a non-profit that often investigates threats against dissidents and human rights defenders, and Motherboard. The researchers published a detailed, technical report of their findings on Friday.

8 of 41 comments (clear)

  1. Lacking information by BringsApples · · Score: 5, Informative

    Is anyone else tired of hearing about this sort of stuff (malware found in apps or whatever), where no one tells us what apps they determined to be malicious? Well, here ya go.

    --
    Politics; n. : A religion whereby man is god.
  2. Re:Meh ... whatever ... by Impy+the+Impiuos+Imp · · Score: 4, Funny

    "We use cookies to improve your* web site experience"

    * your adj : our e.g. "We improved your experience by telling a targeted ad company exactly what you click on, so they can improve our wallet experience."

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  3. Crap by fluffernutter · · Score: 2

    As an Android owner, I don't really care about this. Don't install all kinds of crap and you'll be reasonably safe.

    --
    Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
  4. Run new apps through a proxy... by SuperKendall · · Score: 2

    It's a pretty good idea to run new apps in an environment where you can monitor network traffic and see what they are sending.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Run new apps through a proxy... by MooseTick · · Score: 4, Insightful

      "It's a pretty good idea to run new apps in an environment where you can monitor network traffic and see what they are sending."

      Yeah. Everyone should do that the next time they install and/or update any app. It makes sense and we all love and know how to analyze network traffic. I'd also add waiting at least a year before using the app on a live device just in case it waits a while to exfiltrate data.

      Or, we can all use burner phones and rotate them monthly so its harder to be tracked. That would literally be an easier solution than isolating, monitoring, and analyzing network traffic for each app and determining they are not doing anything suspect.

  5. Re:Meh ... whatever ... by TigerPlish · · Score: 2

    Apps were good and interesting for a while, but they've pretty much degraded to ads and analytics, with shit privacy. Fuck that.

    That's true, that's true.. but there are still bizarre little apps that are useful and don't send data back to the mothership.. Gun Log SPC is godsend for avid shooters - it's the best gun / ammo / maintenance log i've seen, there's one called Mainspring that lets you tape your earpiece mic to the crystal of a watch so you can time it (a poor man's watch timer), ClockMaster (same but for clocks, better async detection). There's the various SPL meters.

    But I agree. Apps have for the most part turned into ad delivery platforms, and most paid apps have disappeared altogether, replaced by subscriptions.

    I went on a rampage on my phone, tossed all the freebies with ads, tossed most of the subs, and now refuse to buy sub apps unless it's abso-fucking-lutely necessary. I ended up with a stable core of apps that I use all the time, and that's pretty much it. I do'nt go app hunting in the app store like when I first got a smartphone 10 years ago. Now I go look when I have a specific need to fill that nothing else can do. Like Watch Tracker.

    My next app? a VPN of some sort. Time to deny AT&T all the info I can. Proton seems to rub the ussr the wrong way, so I'll take it.

    --
    The "Civilized World" jumped the shark ca. 1973.
  6. Don't bother telling us which apps are malware by Opportunist · · Score: 2

    That would be way more information than anyone could possibly want from an article like that. We want the ads and the fluff you create around it, certainly not the information which apps to avoid.

    --
    We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
  7. Oh, please by WillAffleckUW · · Score: 2

    You act is if Attorney General Barr authorized illegal wiretapping on all overseas telephone and other communication on Americans back during Iran-Contra, and never got legal authorization for any of this.

    Personally, I enjoyed visiting the Yakima facility back in the day.

    Now you act all shocked they upload apps designed to spy on you.

    --
    -- Tigger warning: This post may contain tiggers! --