8 ms·

Exploiting Android Users

192 points by Rudism 11y ago

robin_reala 11y ago
Site’s struggling for me. Google cache: https://webcache.googleusercontent.com/search?q=cache:http%3A%2F%2Fwww.codeword.xyz%2F2015%2F08%2F09%2Fexploiting-android-users-for-fun-and-profit%2F https://webcache.googleusercontent.com/search?q=cache:http%3...
pests 11y ago
There was a single mention of Paint.NET in the article with no other comment. Is that the company involved in this? It was not clear to me nor do I recognize the name of the author. There are two technical holes in how this was achieved, disregarding the initial drive-by update install: * Unprotected browser cookie storage * Android web-based App Install requires no user interaction past a request to a web endpoint Are these holes still open?
- nly 11y ago
  Yes, they're still open.
- RyanZAG 11y ago
  It would not be Paint.NET itself - lots of Windows freeware apps are approached by advertising companies. The advertising company pays the freeware company a lot of money to add a checkbox during install. It's this kind of checkbox that the author is talking about. They probably gave Paint.NET (and Java, winzip, winrar, etc etc) a ton of money to put that there.
  - tracker1 11y ago
    Paint.net has ads on their pages, right next to the download page... Their own download link is non-obvious, and the advertisers create full-size ads with a big green button saying "download" ... what the user gets isn't the installer from paint.net proper. I think the fact that the paint.net guys are resorting to allowing ad networks on their main page instead of an inline donate option (like ubuntu) is pretty bad. Another example, as recently as 3 months ago a search on google for "chrome" would result in a few ads that were for malware like this. The ones that are in the actual installers upset me a lot... more so in open-source, and one of the reasons people are starting to avoid source-forge like the plague.
    - pests 11y ago
      I thought SF rescinded their new policies? Regardless, I still won't be using them unless I must. I guess this might be one benefit of the Windows Store, as long as that hasn't been taken over. I haven't checked it in awhile nor know their guidelines.
      - fapjacks 11y ago
        They're trying to sell SF right now (and slashdot), so who knows what's going to happen next.
        tracker1 11y ago
        I don't know if either have the funding, but Github or Atlassian would be better stewards of sourceforge, at least in terms of migrating the whole thing into the fold of Github or Bitbucket. As it stands, I get a little sad when I see a project still on or using SF.
  - pests 11y ago
    Okay, thank you. I must have skimmed the intro the first time. Still he only mentions once that he works at the advertising agency and not Paint.NET, in his second sentence. I was thoroughly confused about what type of company Paint.NET had become.
  - thaumasiotes 11y ago
    Based on the text of the article: > Over time, those notification and opt-in screens were “optimized” away as much as possible. They already “agreed” to our 23 page EULA when they were trying to install Paint.NET but accidentally clicked the wrong download button anyway, right? I'd say that what he's talking about is those sites that offer software for download, and the download button is displayed under an advertisement which also shows an image of a download button. If you click on the ad (showing an image of a download button), you get the malware, instead of the Paint.NET installer that you were trying to download.
  - zyx321 11y ago
    There's also a lot of sites that package adware without the developer's consent. See for example the semi-recent Sourceforge controversy: SF approached devs asking if they'd be interested in using their new download manager that would automatically install third-party 'offers' (unless the user declined the EULA the first 2 times and accepted on the third try). The GIMP team not only declined, but abandoned SF altogether - so now SF's version of GIMP includes adware, and the devs don't see a single dime from it.
- nl 11y ago
  There was a single mention of Paint.NET in the article with no other comment. I suspect this was an example of one of the bait-apps that shonky download sites (download.com and now sourceforge.com etc) repackage with toolbar installers.
- teh_klev 11y ago
  I'll put this comment here as a response to sibling and child comments about Paint.NET and to defend the author (Rick Brewster) regarding misleading installers. Rick has had numerous problems over time with scammers wrapping Paint.NET with scumbag installers and with "backspaceware" distributions. He's documented these issues in his blog: http://blog.getpaint.net/2009/11/06/a-new-license-for-paintnet-v35/ http://blog.getpaint.net/2009/11/06/a-new-license-for-paintn... http://blog.getpaint.net/2007/12/04/freeware-authors-beware-of-%E2%80%9Cbackspaceware%E2%80%9D/ http://blog.getpaint.net/2007/12/04/freeware-authors-beware-... http://blog.getpaint.net/2011/10/03/paint-net-v3-5-9-and-download-com/ http://blog.getpaint.net/2011/10/03/paint-net-v3-5-9-and-dow... http://blog.getpaint.net/2010/12/22/photoshop-filters-and-more-silly-business-proposals/ http://blog.getpaint.net/2010/12/22/photoshop-filters-and-mo... For as long as I've used Paint.NET (since v1) his home page and download page have never obfuscated or tried to lure users into downloading and installing crapware. EDIT: Just turned off my adblocker and see I'm sadly very wrong about the crapware download ads. My other points still stand though.
  - bwohlergo 11y ago
    you're probably using adblock then. homepage: right below his link (paint.net 4.0...) is a "GET IT HERE" picture add which installs crapware download page: pig green banner "START DOWNLOAD" above his text link for the download.
    - teh_klev 11y ago
      Oh, I see your point. about the ads (just turned off uBlock), makes me sad to see that :( It used to be much cleaner than that. I'd be interested to know how much control he has over those.
      - ZoFreX 11y ago
        He has total control. Its his website, he has made the choice to work with scummy advertisers for a larger cut. Make no mistake: He could choose to run adverts that are not immoral and are not pushing malware, and in return he would earn slightly less money. I have no sympathy whatsoever for him - he's directly benefiting from the same scummy industry he's complaining about.
- Rudism 11y ago
  The replies are correct--I mentioned Paint.NET mainly becaues that was/is a highly effective site to get people to click the misleading "Download" button ads. As for browser cookie storage, there's not much the browsers can do. Even if they were encrypted or obfuscated somehow, the browsers themselves would still need access so people would always be able to reverse-engineer the process. The only way I could see them preventing the web-based install exploit would be to always require a password first (and not just rely on session cookies to identify the user). I'm not sure if Google is doing that now or not.
tracker1 11y ago
I can't speak for anyone else, but there's only so far I would be able to go in a job. I once turned down a job because a major client of the company was the RIAA. It reminds me of what LinkedIn did with their iPhone app and Email.. I can't believe that either Android or iOS would allow any of their apps after they did that. I don't have either FB or FB messenger installed, since the split... mostly because they ate my battery life, and breaking apart existing/working functionality sucks. Not to mention they've been gimping their mobile website ever since, I've been avoiding them much more lately. But FB is nowhere near this level of sleaze.
- icebraining 11y ago
  I don't use Facebook at all, but I've heard good things about their new Lite app. It still asks for permission to spy on your whole device, though.
  - jzzskijj 11y ago
    Then no amount of (other) good things can make that app installable.
    - NoGravitas 11y ago
      [Tinfoil for Facebook][0] is good, and only wants network, location, and storage permissions (and you can turn off location). It doesn't provide background notifications, though. [0]: https://github.com/velazcod/Tinfoil-Facebook https://github.com/velazcod/Tinfoil-Facebook
      - syntheticnature 11y ago
        I turned off notifications for FB a long time ago, so that's not a problem. Thanks for the link!
      - mike-cardwell 11y ago
        Also, "Tinfoil for Facebook" has explicit Orbot support (Tor for Android). Works very nicely. There is a "Tinfoil for Twitter" too which works much the same way.
gbin 11y ago
But why? Money? You said "thousands" of "users", even if you sell those owned computers/phones at let's say $1 you don't make that much as a company. Fame/street creds? Look how I got those lusers ? Or you don't even care? you could optimise the deadliness of an atomic weapon and you would feel the same: code done ! Awesome !
- maehwasu 11y ago
  You can make way more than $1/user if the users are in good geos and each user can install lots of apps. In general, it's best to assume the market knows something you don't, rather than the other way around.
- ufmace 11y ago
  You know, I think that optimizing the deadliness of atomic weapons is a lot more defensible than this. The nukes have arguably prevented large-scale industrial war since WWII. I'm having a tough time coming up with a defense for building malware, though.
  - Rudism 11y ago
    There really is no defense. It's just a money grab. When I was working there I dealt with it through compartmentalization and rationalization ("if I wasn't doing this someone else would, so I might as well earn that paycheck anyway"). Others there probably just didn't care. The culture was very money-centric... everyone's compensation included a bonus component that was directly tied to how much revenue your products generated, and there would be big celebrations whenever new milestones were met.
- Rudism 11y ago
  The point was never to sell access to compromised computers or anything quite as nefarious as that. The point with all of these schemes is to get users to install applications on their computer (or phone) that we were getting paid for on a per-install basis. A user who ran through our installer and installed all of the offers might net you $3. Multiply that by thousands a day, hundreds of thousands a month. On the mobile side, as I mentioned in the article, finding desktop users who we could actually make money off of on mobile offers was much harder, which is why I suspect the practice hasn't caught on and become much more widespread in the industry.
godknows 11y ago
Ab v qbag guvax gur pbzcnal ur vf gnyxvat nobhg vf cnvag.ARG ... V guvax ur vf : Ehqvf F Zhvmavrxf Ur unf yvirq va 3 pvgvrf gvyy abj : Senaxyva Sbeg Zlref Pncr Pbeny Sebz: Havirefvgl bs Pnytnel 1998 Ongpu Pheeragyl ng : Arkgtkqk Pbzcnal ur vf gnyxvat nobhg : Nqxabjyrqtr Obhtug n ubhfr va Senaxyva sbe $420,000. Naq lrf lbh pna fgvyy vafgnyy fghss ba naqebvq ol fgrnyvat pbbxvrf . Naq qb gryy zr ubj vg srryf gb or genpxrq naq nohfrq .
- choult 11y ago
  This is not cool to be posting on HN; they have chosen to remain anonymous for obvious reasons, and regardless, the practice of doxing someone is pretty obnoxious.
  - gjm11 11y ago
    Actually, at the end of the OP you can find the author's name, email address, and photograph. Doxxing is obnoxious, but in this case it's not a matter of exposing the identity of someone who was trying to remain anonymous.
    - Rudism 11y ago
      I missed the original comment before it was deleted, but you are correct in that I wasn't trying to write this anonymously.
  - godknows 11y ago
    Yes i know its not cool ... but it irks me the most when i find things like this ... the big reason I stopped using google products also ..
- fwn 11y ago
  Wow, why? HN isn't 4chan. Things like that will lead to nothing more than a worse enviroment for everyone.
avinoth 11y ago
This. This is what pisses me off at the Android and it's ecosystem. I'm an avid android user, and more and more witnessing how it's turning exactly what windows was(is) and how crappy they are in protecting their users. You can submit an app to the play store and get it approved within a day. I mean, come one, phone data are some of the valuable possessions one has in this century and they care less about it being abused. I wish there can be a tightly knit app store similar to iOS with stringent reviews & regulation, but I know it's never going to happen.
- matthiasb 11y ago
  If it takes 2 weeks for Apple to approve your app, it doesn't mean they are looking into it for 14 consecutive days.
  - avinoth 11y ago
    Ofcourse it doesn't mean they are looking into it continuously. but it's way better than not looking at all. All I'm saying is atleast a pair of eyes are looking into the app before it's reaching their users.
    - makomk 11y ago
      Google started manually looking at and approving all Android apps submitted to the Play Store a while ago, if I recall correctly. They just don't take 14 days to do it.
      - threeseed 11y ago
        Neither does Apple. It's currently 6 days. http://appreviewtimes.com http://appreviewtimes.com
- deleted 11y ago
  [deleted]
- blfr 11y ago
  OP claims they were getting routinely banned and Google was plugging the holes they were using. I use a ton of apps, usually install them from my browser, and never had any issues.
tomaskafka 11y ago
Thanks for honesty!
FilterSweep 11y ago
Along the same vein, I highly recommend this read from Aral Balkan[0] on how advertising and analytics data is now really just a fancy word for what we considered spyware back in the older (freer) days of the Internet. [0]: https://aralbalkan.com/notes/spyware-2.0/ https://aralbalkan.com/notes/spyware-2.0/
methou 11y ago
As living in China, it doesn't seem they were crossing a line. Things gone mad here. If you want to type Chinese, you'll need an IME. Most of Chinese people relies on them. It was indeed an exploitable point, that you slip a lot of stuff into it: - News pop-ups of course; - System information gatherer? Sure; - Search engine, convenient; - Anti-Malware software, certainly; - Anti-Virus software, you'll have it; - Homepage? Come on, let's make a bolder move - Browser! - A PC Manager. It's a combination of AV/AM and a software catalog, and the sweetest feature is to tell you how many seconds it took to boot up to your desktop, and shows a % of population you've beat across the nation, people can be bitchy over this. Not just one major software vendor did this, everyone capable did, and still doing. There's also large internet companies that used by people on daily basis uses 0day exploits to push their desktop software. Like if you browse the Chinese part of the internet for one day, you'll end up with bunch of cute little Anti-Virus/cleanup/tweaking goodies rest in your notification area, some times they fight each other and cause BSoD.
- egeozcan 11y ago
  This sounds horrible. I always hear how Chinese internet access is under too heavy regulation, isn't there any penalty for such behavior?
  - billyhoffman 11y ago
    I think the word you are looking for is "censorship" instead of regulation. Though I suppose "heavy regulation" could a clever/funny euphemism for "censorship"
    - thaumasiotes 11y ago
      The chinese euphemism for censoring something is "harmonize", from the slogan: https://en.wikipedia.org/wiki/Harmonious_Society https://en.wikipedia.org/wiki/Harmonious_Society
- gcr 11y ago
  Is there a reason not to use the default IME provided by the operating system? Mac OSX includes a decent IME for Japanese, for example.
joshstrange 11y ago
This raises an interesting point I've thought a lot on which is "Developer Moral Responsibility" (Best way I can sum it it). I've started 2-3 blog posts on this subject only to shelve them indefinitely as the "gray" things I've been involved in were minor on the grand scale and the places I worked at when those things occurred were 99% "good" and I wouldn't want to smear their names over things that were minor at best (the "everyone else is doing it argument/excuse"). I would love it if a "Developer Morality Manifesto" or similar were created and accepted at both a developer and company level to cover some of these "dark" practices
obisw4n 11y ago
Its funny the author mentions all the Google Play stuff about installing apps to users phones without them ever even knowing.. I actually found a company exploiting this in the wild using browser extensions, I wrote about it on this blog: http://extensiondefender.com/blog/ http://extensiondefender.com/blog/ I'm not sure if the news I released had any effect, but they rapidly pivoted from a "desktop to mobile" ad network: https://web.archive.org/web/20141209085229/http://vulcun.com/ https://web.archive.org/web/20141209085229/http://vulcun.com... To some kind of e-Sports betting site: https://vulcun.com/ https://vulcun.com/ Oddly enough I submitted a bug report to google telling them they should set a content-security-policy on play.google.com, and was basically told "wont-fix" so the vulnerability to play store still exists.
- TorKlingberg 11y ago
  Thanks. Btw, you forgot to put any link from your blog to the main site.
adamzubi 11y ago
http://googler700.blogspot.com/ http://googler700.blogspot.com/
dpifke 11y ago
For those wondering how to protect against a "malware-steals-cookie" attack, see: http://www.browserauth.net/channel-bound-cookies http://www.browserauth.net/channel-bound-cookies I believe Google does this now for their auth cookies.
- gcr 11y ago
  How can this fix prevent this class of attacks? The malicious app has local access to the user's machine, which means it has the ability to read and overwrite all files that the browser manages. In the worst case, we could create malware that just reads the browser's client public key and create our own session with the same one.
fapjacks 11y ago
Way back when I was young and webvan.com was hot, I also worked on similar stuff. I didn't know then who I was, or even slightly what I wanted in life. Typical early-20s kind of thing. Anyways, I understand exactly what this guy feels like, as I feel the same way about the things I did back then. And these days I have turned down a couple of jobs that I felt were being too aggressive about advertising. One company's product was to give you a kind of GMail search, at the cost of collecting all kinds of information about you and aggregating it on remote servers to use for advertising. The founders were real cool guys, but this was just not something I am willing to contribute to.

192 points by Rudism 11y ago

Site’s struggling for me. Google cache: https://webcache.googleusercontent.com/search?q=cache:http%3A%2F%2Fwww.codeword.xyz%2F2015%2F08%2F09%2Fexploiting-android-users-for-fun-and-profit%2F https://webcache.googleusercontent.com/search?q=cache:http%3...

pests 11y ago

There was a single mention of Paint.NET in the article with no other comment. Is that the company involved in this? It was not clear to me nor do I recognize the name of the author. There are two technical holes in how this was achieved, disregarding the initial drive-by update install: * Unprotected browser cookie storage * Android web-based App Install requires no user interaction past a request to a web endpoint Are these holes still open?

nly 11y ago
Yes, they're still open.
RyanZAG 11y ago
It would not be Paint.NET itself - lots of Windows freeware apps are approached by advertising companies. The advertising company pays the freeware company a lot of money to add a checkbox during install. It's this kind of checkbox that the author is talking about. They probably gave Paint.NET (and Java, winzip, winrar, etc etc) a ton of money to put that there.
- tracker1 11y ago
  Paint.net has ads on their pages, right next to the download page... Their own download link is non-obvious, and the advertisers create full-size ads with a big green button saying "download" ... what the user gets isn't the installer from paint.net proper. I think the fact that the paint.net guys are resorting to allowing ad networks on their main page instead of an inline donate option (like ubuntu) is pretty bad. Another example, as recently as 3 months ago a search on google for "chrome" would result in a few ads that were for malware like this. The ones that are in the actual installers upset me a lot... more so in open-source, and one of the reasons people are starting to avoid source-forge like the plague.
  - pests 11y ago
    I thought SF rescinded their new policies? Regardless, I still won't be using them unless I must. I guess this might be one benefit of the Windows Store, as long as that hasn't been taken over. I haven't checked it in awhile nor know their guidelines.
    - fapjacks 11y ago
      They're trying to sell SF right now (and slashdot), so who knows what's going to happen next.
      - tracker1 11y ago
        I don't know if either have the funding, but Github or Atlassian would be better stewards of sourceforge, at least in terms of migrating the whole thing into the fold of Github or Bitbucket. As it stands, I get a little sad when I see a project still on or using SF.
- pests 11y ago
  Okay, thank you. I must have skimmed the intro the first time. Still he only mentions once that he works at the advertising agency and not Paint.NET, in his second sentence. I was thoroughly confused about what type of company Paint.NET had become.
- thaumasiotes 11y ago
  Based on the text of the article: > Over time, those notification and opt-in screens were “optimized” away as much as possible. They already “agreed” to our 23 page EULA when they were trying to install Paint.NET but accidentally clicked the wrong download button anyway, right? I'd say that what he's talking about is those sites that offer software for download, and the download button is displayed under an advertisement which also shows an image of a download button. If you click on the ad (showing an image of a download button), you get the malware, instead of the Paint.NET installer that you were trying to download.
- zyx321 11y ago
  There's also a lot of sites that package adware without the developer's consent. See for example the semi-recent Sourceforge controversy: SF approached devs asking if they'd be interested in using their new download manager that would automatically install third-party 'offers' (unless the user declined the EULA the first 2 times and accepted on the third try). The GIMP team not only declined, but abandoned SF altogether - so now SF's version of GIMP includes adware, and the devs don't see a single dime from it.
nl 11y ago
There was a single mention of Paint.NET in the article with no other comment. I suspect this was an example of one of the bait-apps that shonky download sites (download.com and now sourceforge.com etc) repackage with toolbar installers.
teh_klev 11y ago
I'll put this comment here as a response to sibling and child comments about Paint.NET and to defend the author (Rick Brewster) regarding misleading installers. Rick has had numerous problems over time with scammers wrapping Paint.NET with scumbag installers and with "backspaceware" distributions. He's documented these issues in his blog: http://blog.getpaint.net/2009/11/06/a-new-license-for-paintnet-v35/ http://blog.getpaint.net/2009/11/06/a-new-license-for-paintn... http://blog.getpaint.net/2007/12/04/freeware-authors-beware-of-%E2%80%9Cbackspaceware%E2%80%9D/ http://blog.getpaint.net/2007/12/04/freeware-authors-beware-... http://blog.getpaint.net/2011/10/03/paint-net-v3-5-9-and-download-com/ http://blog.getpaint.net/2011/10/03/paint-net-v3-5-9-and-dow... http://blog.getpaint.net/2010/12/22/photoshop-filters-and-more-silly-business-proposals/ http://blog.getpaint.net/2010/12/22/photoshop-filters-and-mo... For as long as I've used Paint.NET (since v1) his home page and download page have never obfuscated or tried to lure users into downloading and installing crapware. EDIT: Just turned off my adblocker and see I'm sadly very wrong about the crapware download ads. My other points still stand though.
- bwohlergo 11y ago
  you're probably using adblock then. homepage: right below his link (paint.net 4.0...) is a "GET IT HERE" picture add which installs crapware download page: pig green banner "START DOWNLOAD" above his text link for the download.
  - teh_klev 11y ago
    Oh, I see your point. about the ads (just turned off uBlock), makes me sad to see that :( It used to be much cleaner than that. I'd be interested to know how much control he has over those.
    - ZoFreX 11y ago
      He has total control. Its his website, he has made the choice to work with scummy advertisers for a larger cut. Make no mistake: He could choose to run adverts that are not immoral and are not pushing malware, and in return he would earn slightly less money. I have no sympathy whatsoever for him - he's directly benefiting from the same scummy industry he's complaining about.
Rudism 11y ago
The replies are correct--I mentioned Paint.NET mainly becaues that was/is a highly effective site to get people to click the misleading "Download" button ads. As for browser cookie storage, there's not much the browsers can do. Even if they were encrypted or obfuscated somehow, the browsers themselves would still need access so people would always be able to reverse-engineer the process. The only way I could see them preventing the web-based install exploit would be to always require a password first (and not just rely on session cookies to identify the user). I'm not sure if Google is doing that now or not.

tracker1 11y ago

I can't speak for anyone else, but there's only so far I would be able to go in a job. I once turned down a job because a major client of the company was the RIAA. It reminds me of what LinkedIn did with their iPhone app and Email.. I can't believe that either Android or iOS would allow any of their apps after they did that. I don't have either FB or FB messenger installed, since the split... mostly because they ate my battery life, and breaking apart existing/working functionality sucks. Not to mention they've been gimping their mobile website ever since, I've been avoiding them much more lately. But FB is nowhere near this level of sleaze.

icebraining 11y ago
I don't use Facebook at all, but I've heard good things about their new Lite app. It still asks for permission to spy on your whole device, though.
- jzzskijj 11y ago
  Then no amount of (other) good things can make that app installable.
  - NoGravitas 11y ago
    [Tinfoil for Facebook][0] is good, and only wants network, location, and storage permissions (and you can turn off location). It doesn't provide background notifications, though. [0]: https://github.com/velazcod/Tinfoil-Facebook https://github.com/velazcod/Tinfoil-Facebook
    - syntheticnature 11y ago
      I turned off notifications for FB a long time ago, so that's not a problem. Thanks for the link!
    - mike-cardwell 11y ago
      Also, "Tinfoil for Facebook" has explicit Orbot support (Tor for Android). Works very nicely. There is a "Tinfoil for Twitter" too which works much the same way.

gbin 11y ago

But why? Money? You said "thousands" of "users", even if you sell those owned computers/phones at let's say $1 you don't make that much as a company. Fame/street creds? Look how I got those lusers ? Or you don't even care? you could optimise the deadliness of an atomic weapon and you would feel the same: code done ! Awesome !

maehwasu 11y ago
You can make way more than $1/user if the users are in good geos and each user can install lots of apps. In general, it's best to assume the market knows something you don't, rather than the other way around.
ufmace 11y ago
You know, I think that optimizing the deadliness of atomic weapons is a lot more defensible than this. The nukes have arguably prevented large-scale industrial war since WWII. I'm having a tough time coming up with a defense for building malware, though.
- Rudism 11y ago
  There really is no defense. It's just a money grab. When I was working there I dealt with it through compartmentalization and rationalization ("if I wasn't doing this someone else would, so I might as well earn that paycheck anyway"). Others there probably just didn't care. The culture was very money-centric... everyone's compensation included a bonus component that was directly tied to how much revenue your products generated, and there would be big celebrations whenever new milestones were met.
Rudism 11y ago
The point was never to sell access to compromised computers or anything quite as nefarious as that. The point with all of these schemes is to get users to install applications on their computer (or phone) that we were getting paid for on a per-install basis. A user who ran through our installer and installed all of the offers might net you $3. Multiply that by thousands a day, hundreds of thousands a month. On the mobile side, as I mentioned in the article, finding desktop users who we could actually make money off of on mobile offers was much harder, which is why I suspect the practice hasn't caught on and become much more widespread in the industry.

godknows 11y ago

Ab v qbag guvax gur pbzcnal ur vf gnyxvat nobhg vf cnvag.ARG ... V guvax ur vf : Ehqvf F Zhvmavrxf Ur unf yvirq va 3 pvgvrf gvyy abj : Senaxyva Sbeg Zlref Pncr Pbeny Sebz: Havirefvgl bs Pnytnel 1998 Ongpu Pheeragyl ng : Arkgtkqk Pbzcnal ur vf gnyxvat nobhg : Nqxabjyrqtr Obhtug n ubhfr va Senaxyva sbe $420,000. Naq lrf lbh pna fgvyy vafgnyy fghss ba naqebvq ol fgrnyvat pbbxvrf . Naq qb gryy zr ubj vg srryf gb or genpxrq naq nohfrq .

choult 11y ago
This is not cool to be posting on HN; they have chosen to remain anonymous for obvious reasons, and regardless, the practice of doxing someone is pretty obnoxious.
- gjm11 11y ago
  Actually, at the end of the OP you can find the author's name, email address, and photograph. Doxxing is obnoxious, but in this case it's not a matter of exposing the identity of someone who was trying to remain anonymous.
  - Rudism 11y ago
    I missed the original comment before it was deleted, but you are correct in that I wasn't trying to write this anonymously.
- godknows 11y ago
  Yes i know its not cool ... but it irks me the most when i find things like this ... the big reason I stopped using google products also ..
fwn 11y ago
Wow, why? HN isn't 4chan. Things like that will lead to nothing more than a worse enviroment for everyone.

avinoth 11y ago

This. This is what pisses me off at the Android and it's ecosystem. I'm an avid android user, and more and more witnessing how it's turning exactly what windows was(is) and how crappy they are in protecting their users. You can submit an app to the play store and get it approved within a day. I mean, come one, phone data are some of the valuable possessions one has in this century and they care less about it being abused. I wish there can be a tightly knit app store similar to iOS with stringent reviews & regulation, but I know it's never going to happen.

matthiasb 11y ago
If it takes 2 weeks for Apple to approve your app, it doesn't mean they are looking into it for 14 consecutive days.
- avinoth 11y ago
  Ofcourse it doesn't mean they are looking into it continuously. but it's way better than not looking at all. All I'm saying is atleast a pair of eyes are looking into the app before it's reaching their users.
  - makomk 11y ago
    Google started manually looking at and approving all Android apps submitted to the Play Store a while ago, if I recall correctly. They just don't take 14 days to do it.
    - threeseed 11y ago
      Neither does Apple. It's currently 6 days. http://appreviewtimes.com http://appreviewtimes.com
deleted 11y ago
[deleted]
blfr 11y ago
OP claims they were getting routinely banned and Google was plugging the holes they were using. I use a ton of apps, usually install them from my browser, and never had any issues.

tomaskafka 11y ago

Thanks for honesty!

FilterSweep 11y ago

Along the same vein, I highly recommend this read from Aral Balkan[0] on how advertising and analytics data is now really just a fancy word for what we considered spyware back in the older (freer) days of the Internet. [0]: https://aralbalkan.com/notes/spyware-2.0/ https://aralbalkan.com/notes/spyware-2.0/

methou 11y ago

As living in China, it doesn't seem they were crossing a line. Things gone mad here. If you want to type Chinese, you'll need an IME. Most of Chinese people relies on them. It was indeed an exploitable point, that you slip a lot of stuff into it: - News pop-ups of course; - System information gatherer? Sure; - Search engine, convenient; - Anti-Malware software, certainly; - Anti-Virus software, you'll have it; - Homepage? Come on, let's make a bolder move - Browser! - A PC Manager. It's a combination of AV/AM and a software catalog, and the sweetest feature is to tell you how many seconds it took to boot up to your desktop, and shows a % of population you've beat across the nation, people can be bitchy over this. Not just one major software vendor did this, everyone capable did, and still doing. There's also large internet companies that used by people on daily basis uses 0day exploits to push their desktop software. Like if you browse the Chinese part of the internet for one day, you'll end up with bunch of cute little Anti-Virus/cleanup/tweaking goodies rest in your notification area, some times they fight each other and cause BSoD.

egeozcan 11y ago
This sounds horrible. I always hear how Chinese internet access is under too heavy regulation, isn't there any penalty for such behavior?
- billyhoffman 11y ago
  I think the word you are looking for is "censorship" instead of regulation. Though I suppose "heavy regulation" could a clever/funny euphemism for "censorship"
  - thaumasiotes 11y ago
    The chinese euphemism for censoring something is "harmonize", from the slogan: https://en.wikipedia.org/wiki/Harmonious_Society https://en.wikipedia.org/wiki/Harmonious_Society
gcr 11y ago
Is there a reason not to use the default IME provided by the operating system? Mac OSX includes a decent IME for Japanese, for example.

joshstrange 11y ago

This raises an interesting point I've thought a lot on which is "Developer Moral Responsibility" (Best way I can sum it it). I've started 2-3 blog posts on this subject only to shelve them indefinitely as the "gray" things I've been involved in were minor on the grand scale and the places I worked at when those things occurred were 99% "good" and I wouldn't want to smear their names over things that were minor at best (the "everyone else is doing it argument/excuse"). I would love it if a "Developer Morality Manifesto" or similar were created and accepted at both a developer and company level to cover some of these "dark" practices

obisw4n 11y ago

Its funny the author mentions all the Google Play stuff about installing apps to users phones without them ever even knowing.. I actually found a company exploiting this in the wild using browser extensions, I wrote about it on this blog: http://extensiondefender.com/blog/ http://extensiondefender.com/blog/ I'm not sure if the news I released had any effect, but they rapidly pivoted from a "desktop to mobile" ad network: https://web.archive.org/web/20141209085229/http://vulcun.com/ https://web.archive.org/web/20141209085229/http://vulcun.com... To some kind of e-Sports betting site: https://vulcun.com/ https://vulcun.com/ Oddly enough I submitted a bug report to google telling them they should set a content-security-policy on play.google.com, and was basically told "wont-fix" so the vulnerability to play store still exists.

TorKlingberg 11y ago
Thanks. Btw, you forgot to put any link from your blog to the main site.

adamzubi 11y ago

http://googler700.blogspot.com/ http://googler700.blogspot.com/

dpifke 11y ago

For those wondering how to protect against a "malware-steals-cookie" attack, see: http://www.browserauth.net/channel-bound-cookies http://www.browserauth.net/channel-bound-cookies I believe Google does this now for their auth cookies.

gcr 11y ago
How can this fix prevent this class of attacks? The malicious app has local access to the user's machine, which means it has the ability to read and overwrite all files that the browser manages. In the worst case, we could create malware that just reads the browser's client public key and create our own session with the same one.

fapjacks 11y ago

Way back when I was young and webvan.com was hot, I also worked on similar stuff. I didn't know then who I was, or even slightly what I wanted in life. Typical early-20s kind of thing. Anyways, I understand exactly what this guy feels like, as I feel the same way about the things I did back then. And these days I have turned down a couple of jobs that I felt were being too aggressive about advertising. One company's product was to give you a kind of GMail search, at the cost of collecting all kinds of information about you and aggregating it on remote servers to use for advertising. The founders were real cool guys, but this was just not something I am willing to contribute to.