4 ms·

The article doesn't go into details of how the app manged to do all these things, isn't there some sandboxing that was broken, know vulnerability or some 0day t

The article doesn't go into details of how the app manged to do all these things, isn't there some sandboxing that was broken, know vulnerability or some 0day that was used or anything like it? I've heard that android security is broken but it's seems a little too easy.

deprave 10y ago
Sandboxing isn't a magical solution. All it does is limit resources available to an app. Usually, until a user authorizes access to such resources. "Here's a list of thirty privileges this app needs to run. Do you approve?" Given you just downloaded it, why wouldn't you? After all, every other app requires a huge set of privileges to run, too. Do you see the problem? :)
- StavrosK 10y ago
  Not any more, Marshmallow permissions are on-demand.
  - nitrogen 10y ago
    It's not all that effective; some apps (like the Hue app) just crash if you deny them anything. Why didn't Android add the option to provide blank data to apps?
    - StavrosK 10y ago
      > It's not all that effective I find it perfectly effective: If you deny an app a permission, it doesn't get any information for that permission. > some apps (like the Hue app) just crash if you deny them anything That sounds like the app is badly implemented, really. > Why didn't Android add the option to provide blank data to apps? Because it's a completely new API and it shouldn't have to, apps should check the return code to see if the permission was denied or not. Are you talking about denying permissions to apps that don't support the new-style permissions natively, perhaps?
      - nitrogen 10y ago
        That sounds like the app is badly implemented, really. Yeah, it really is badly implemented, but the blame for that lies in part with Android for making it so easy to write apps that break. It would have been perfectly easy to write the code so that it returned "GPS signal lost" for location, "no contacts" for contacts, "SD card is empty" for storage, "no phone call in progress" for phone, etc. In fact, modders of Android have been doing that kind of thing for years. It's truly astonishing that Google got this so wrong when there are so many better examples. Because it's a completely new API and it shouldn't have to, apps should check the return code to see if the permission was denied or not. Sometimes an app should believe the permission was granted when it actually wasn't, because of the aforementioned bad (or even malicious) apps. Maybe you have to use a particular app in order to control the lights in your house, or your car, or to chat with someone who refuses to use anything that doesn't have a permission list a mile long. Privacy controls are useless if the true control is still in the hands of the app. Are you talking about denying permissions to apps that don't support the new-style permissions natively, perhaps? No, I'm not, but clearly old-style permissions could have been reimplemented as forwarding calls to a new-style API that returned blank data if the user chose blank data for that app's permission, just as privacy mods for rooted phones have already done.
        JonnyaiR 10y ago
        They have two different privacy solutions implemented in Android 6 (marshmallow): The first one is comparable to iOS' model - the app must ask for permission on first access. If the user denies said access, the app gets this information. Ghe second solution is aimed at apps designed for older Android versions, if the user denies access, the app gets empty data back (e.g. Empty contact lists, no GPS satellite etc). An app designed for Android 6 should handle negative feedback (disable functions, show a warning/explanation or something else), it shouldn't break. If you don't want to handle this, design for Android <6 and let the system take care of it. But it should be a difference between permission not granted and no data available, apps should handle these issues differently. If I were to deny my navigation app access to my location, it should ask me to revoke this decision and not warn me about not finding GPS satellites (which would make me run around with my phone hold up in the air hoping to get a GPS fix).
ianpurton 10y ago
From what I can say the main functionality is to take from one server and run them as HTTP requests on another. i.e. click fraud. The only permission required for this would be internet access. There's some extra functionality for users who have rooted their phone.

deprave 10y ago

Sandboxing isn't a magical solution. All it does is limit resources available to an app. Usually, until a user authorizes access to such resources. "Here's a list of thirty privileges this app needs to run. Do you approve?" Given you just downloaded it, why wouldn't you? After all, every other app requires a huge set of privileges to run, too. Do you see the problem? :)

StavrosK 10y ago
Not any more, Marshmallow permissions are on-demand.
- nitrogen 10y ago
  It's not all that effective; some apps (like the Hue app) just crash if you deny them anything. Why didn't Android add the option to provide blank data to apps?
  - StavrosK 10y ago
    > It's not all that effective I find it perfectly effective: If you deny an app a permission, it doesn't get any information for that permission. > some apps (like the Hue app) just crash if you deny them anything That sounds like the app is badly implemented, really. > Why didn't Android add the option to provide blank data to apps? Because it's a completely new API and it shouldn't have to, apps should check the return code to see if the permission was denied or not. Are you talking about denying permissions to apps that don't support the new-style permissions natively, perhaps?
    - nitrogen 10y ago
      That sounds like the app is badly implemented, really. Yeah, it really is badly implemented, but the blame for that lies in part with Android for making it so easy to write apps that break. It would have been perfectly easy to write the code so that it returned "GPS signal lost" for location, "no contacts" for contacts, "SD card is empty" for storage, "no phone call in progress" for phone, etc. In fact, modders of Android have been doing that kind of thing for years. It's truly astonishing that Google got this so wrong when there are so many better examples. Because it's a completely new API and it shouldn't have to, apps should check the return code to see if the permission was denied or not. Sometimes an app should believe the permission was granted when it actually wasn't, because of the aforementioned bad (or even malicious) apps. Maybe you have to use a particular app in order to control the lights in your house, or your car, or to chat with someone who refuses to use anything that doesn't have a permission list a mile long. Privacy controls are useless if the true control is still in the hands of the app. Are you talking about denying permissions to apps that don't support the new-style permissions natively, perhaps? No, I'm not, but clearly old-style permissions could have been reimplemented as forwarding calls to a new-style API that returned blank data if the user chose blank data for that app's permission, just as privacy mods for rooted phones have already done.
      - JonnyaiR 10y ago
        They have two different privacy solutions implemented in Android 6 (marshmallow): The first one is comparable to iOS' model - the app must ask for permission on first access. If the user denies said access, the app gets this information. Ghe second solution is aimed at apps designed for older Android versions, if the user denies access, the app gets empty data back (e.g. Empty contact lists, no GPS satellite etc). An app designed for Android 6 should handle negative feedback (disable functions, show a warning/explanation or something else), it shouldn't break. If you don't want to handle this, design for Android <6 and let the system take care of it. But it should be a difference between permission not granted and no data available, apps should handle these issues differently. If I were to deny my navigation app access to my location, it should ask me to revoke this decision and not warn me about not finding GPS satellites (which would make me run around with my phone hold up in the air hoping to get a GPS fix).

ianpurton 10y ago

From what I can say the main functionality is to take from one server and run them as HTTP requests on another. i.e. click fraud. The only permission required for this would be internet access. There's some extra functionality for users who have rooted their phone.