7 ms·

Took a look at DroidJack[0], and it's impressively nefarious. Seems like Android is Windows all over again when it comes to security. I already see people runni

by pcr0 10y ago

Took a look at DroidJack[0], and it's impressively nefarious. Seems like Android is Windows all over again when it comes to security. I already see people running virus scanners on their phones. [0]: http://www.symantec.com/connect/blogs/droidjack-rat-tale-how-budding-entrepreneurism-can-turn-cybercrime http://www.symantec.com/connect/blogs/droidjack-rat-tale-how...

tdkl 10y ago
OK, it's a RAT, but how do we get from receiving a supposed .ppt on email to having DroidJack .apk installed on the system ? Assuming user isn't tricked into confirming the install (not to mention disabling the manual apk install protection).
- Buge 10y ago
  I'm not sure if this was how it's done. But if the app is on the Play store, it can be remotely installed on your Android device via the Play website.
  - tdkl 10y ago
    Ah, it's all described perfectly here [1] and Android specifically [2]: [1] https://citizenlab.org/2016/08/group5-syria/ https://citizenlab.org/2016/08/group5-syria/ [2] https://citizenlab.org/2016/08/group5-syria/#part4 https://citizenlab.org/2016/08/group5-syria/#part4 Good old fake Flash update. But still relies on user to be installed, so nothing sophisticated or "Android is bad" here. If anything the Powerpoint malware looks interesting. The .ppsx extension kinda gives it away, since it's unusual for casual presentations, but that's hard to spot for Joe User.
    - duaneb 10y ago
      The fact that installing an app can give people arbitrary access to your phone without understanding WHAT you installed definitely implies Android app installation is broken in some way.
      - tdkl 10y ago
        Well, it's exactly what the warning popup when enabling side-loading states ;] But it's still possible, so that's pretty fine in my book compared to the fruit company.
        duaneb 10y ago
        It's a little too easy for non-technical users to accidentally enable it. The moms & pops of the world would probably never need to side-load.
        Nullabillity 10y ago
        Who is the right person to decide who "needs" to side-load? Besides, there are loads of legitimate reasons to, there's a reason Humble Bundles aren't a thing on iOS.
        duaneb 10y ago
        > Who is the right person to decide who "needs" to side-load? The person who decides to explicitly opt in to allowing side-loading. Just don't allow apps, web pages, etc etc to opt-in for you to ensure the technically non-adept have a difficult time getting themselves into trouble.
        Nullabillity 10y ago
        Which is already the case...?
mordocai 10y ago
I can practically guarantee that iphone, windows phone, blackberry, etc also have similar exploits out there being used by nation state level attackers and the people who sell to them. But yes, android is a bit more "wild west"/less curated so that plus the fragmentation/lack of good update channels leads to lots of attack vectors.
- bitmapbrother 10y ago
  And yet the exploitation of Android phones is extremely low according to Google and their live analytics. Meanwhile, iOS devices not running OS 9.3.3 are susceptible to a TIFF image attack that requires no user interaction whatsoever and allows an attacker to steal all of the passwords on the device.
gbl08ma 10y ago
> I already see people running virus scanners on their phones. From what I've read and seen, those virus scanners are of little help, mainly because they are subject to the same sandbox restrictions as all the other apps (and aren't going to break the sandbox like the viruses). Most of them appear to be as good as those "Android cleanup" apps that do nothing but constantly clear caches (meaning they will be rebuilt unnecessarily) and bother the user with notifications and adverts.

by pcr0 10y ago

tdkl 10y ago

OK, it's a RAT, but how do we get from receiving a supposed .ppt on email to having DroidJack .apk installed on the system ? Assuming user isn't tricked into confirming the install (not to mention disabling the manual apk install protection).

Buge 10y ago
I'm not sure if this was how it's done. But if the app is on the Play store, it can be remotely installed on your Android device via the Play website.
- tdkl 10y ago
  Ah, it's all described perfectly here [1] and Android specifically [2]: [1] https://citizenlab.org/2016/08/group5-syria/ https://citizenlab.org/2016/08/group5-syria/ [2] https://citizenlab.org/2016/08/group5-syria/#part4 https://citizenlab.org/2016/08/group5-syria/#part4 Good old fake Flash update. But still relies on user to be installed, so nothing sophisticated or "Android is bad" here. If anything the Powerpoint malware looks interesting. The .ppsx extension kinda gives it away, since it's unusual for casual presentations, but that's hard to spot for Joe User.
  - duaneb 10y ago
    The fact that installing an app can give people arbitrary access to your phone without understanding WHAT you installed definitely implies Android app installation is broken in some way.
    - tdkl 10y ago
      Well, it's exactly what the warning popup when enabling side-loading states ;] But it's still possible, so that's pretty fine in my book compared to the fruit company.
      - duaneb 10y ago
        It's a little too easy for non-technical users to accidentally enable it. The moms & pops of the world would probably never need to side-load.
        Nullabillity 10y ago
        Who is the right person to decide who "needs" to side-load? Besides, there are loads of legitimate reasons to, there's a reason Humble Bundles aren't a thing on iOS.
        duaneb 10y ago
        > Who is the right person to decide who "needs" to side-load? The person who decides to explicitly opt in to allowing side-loading. Just don't allow apps, web pages, etc etc to opt-in for you to ensure the technically non-adept have a difficult time getting themselves into trouble.
        Nullabillity 10y ago
        Which is already the case...?

mordocai 10y ago

I can practically guarantee that iphone, windows phone, blackberry, etc also have similar exploits out there being used by nation state level attackers and the people who sell to them. But yes, android is a bit more "wild west"/less curated so that plus the fragmentation/lack of good update channels leads to lots of attack vectors.

bitmapbrother 10y ago
And yet the exploitation of Android phones is extremely low according to Google and their live analytics. Meanwhile, iOS devices not running OS 9.3.3 are susceptible to a TIFF image attack that requires no user interaction whatsoever and allows an attacker to steal all of the passwords on the device.

gbl08ma 10y ago

> I already see people running virus scanners on their phones. From what I've read and seen, those virus scanners are of little help, mainly because they are subject to the same sandbox restrictions as all the other apps (and aren't going to break the sandbox like the viruses). Most of them appear to be as good as those "Android cleanup" apps that do nothing but constantly clear caches (meaning they will be rebuilt unnecessarily) and bother the user with notifications and adverts.