6 ms·

Android wallpaper app that steals your data was downloaded by millions

98 points by pkchen 16y ago

there 16y ago
so what were the security permissions requested by this app at the time of installation? i have to imagine that if it was taking web browsing history that it would have needed more permissions than just "uses network data". android's fine-grained security permissions, where the author has to explicitly request each type (network use, prevent the screen from turning off, etc.) and the user is shown the list of permissions requested before installing, is good from a security standpoint, but i think it's ended up being like windows vista. users either don't read, don't care, or don't understand what is being asked of them and they just click whatever is needed to continue. even an advanced user can't tell the difference between a free app requesting network access to download advertisements and a malicious one using it to upload private information.
- jsz0 16y ago
  It's a rarity to see any Android app that doesn't require half a dozen different permissions. I just installed the Google Maps update and it requires 9 including the ability to read my phone call logs (??)
  - there 16y ago
    maybe on-demand permission requests would be better for many of those things, like apple ios does when an app requests your location. if i did something in google maps and it popped up a dialog asking for access to my call logs, i would certainly deny it, but i just did that update this morning and didn't even notice anything about it accessing my call logs.
    - masklinn 16y ago
      > maybe on-demand permission requests would be better for many of those things, like apple ios does when an app requests your location. Wouldn't change much, 95% of users would still go WANNA USE APPLICATION, DISMISS MEAN BOX NOW
      - elliottkember 16y ago
        Cancel or allow?
        masklinn 16y ago
        Cancel doesn't give them APPLICATION NOW, so it's just training them to reflex-click allow. It's a pavlovian reaction: Cancel -> no application; Allow -> application. If they launched the application, they probably want to see what's in it.
  - TeHCrAzY 16y ago
    The google apps are an outlier in my experience so far. They tend to ask for many indepth permissions. Most apps just want full network access (for ad's) and sometimes phone call state/sdcard access etc.
- maxjg 16y ago
  Just out of curiosity, when an android app is updated, how are permissions handled? Do you receive a prompt to allow new privileges, or does it assume you approve of it already? You bring up an astute point on the vague "network access" permission, but there's really not an easy answer to this. How would you fix it? Ask the developer to simply say what the access will be used for? In an malicious app, they'd obviously just lie. Short of actually displaying what data an app is sending, I don't see an easy answer.
  - eli 16y ago
    Yes, if an update requires new permissions, it must be explicitly approved again and cannot be auto-updated.
  - there 16y ago
    froyo (finally) has an automatic update feature, so most apps update on their own. i have noticed a few that say they require manual updating, but i didn't know if it was due to a download failure or if it was for a changed set of permissions. it does show you the full permission list again before updating manually. How would you fix it? Ask the developer to simply say what the access will be used for? In an malicious app, they'd obviously just lie. Short of actually displaying what data an app is sending, I don't see an easy answer. maybe show a list of domains it's allowed to resolve/contact? i guess that wouldn't make it any easier for most users to decipher though. i think a lot of free apps require network access just to download ads; maybe there is a better way (in the android api) of handling that to segment it away from full-blown network access? maybe have a set of permissions common to each category? it's expected that a web browser app has access to do a lot of things, but if you have an app in a wallpaper category that requires those same set of permissions, it should be raising a red flag somewhere. perhaps apple's app review process wasn't so crazy after all...
  - papertiger 16y ago
    Maybe treating any ad network component as a "sub-app" with separate permissions would make it more obvious when a request for network access is unwarranted. As to how something like that might be implemented... I have no idea. I suspect people would ignore it anyway.
- shirtless_coder 16y ago
  And it DID request more than that. The thing is, that these wannabes like to paint themselves as "security experts", so they conceal facts and tell the story to the masses of non-techie users and scare them. Then, they sell a bogus security app.
  - guelo 16y ago
    If a wallpaper app requests access to your contacts and millions of users install it anyways that is a flaw in Android's security model. After a while you become conditioned to just hitting Install without even looking at the permissions being requested. Just because users are lazy or even stupid is not an excuse for leaving them vulnerable.
    - zmmmmm 16y ago
      I agree it's a flaw. I do think it is better than iOS but it is still a huge problem. It is one of simultaneously too much and too little granularity. If you provide too much granularity it overwhelms users, while if you provide too little it forces people to approve too wide a scope. For example, the music app I just installed wants access to the phone state and identity. At first I baulked and said WTF does a music app need that for? And of course, the answer is it wants to make the music quieter / pause when a call comes in. But to do that it needs access to the identity of my phone because that seems to be lumped into the same bucket as the "state" of my phone. It also needs internet access because it wants to download album art. So these completely innocuous features also mean it could be tracking my location and reporting it to the web. How do I tell an evil app from a good one? I don't know - all I do is read the comments. I think Android needs to make the model richer while also streamlining certain sets of permissions into standard profiles that people can understand. For example, the set of minimal permissions to support ads in an app should be simply presented as "to present location based ads", not a set of 5 permissions that overwhelm people. This should in turn be honed by Google into a minimal set of permissions internally so that an app that just wants to present ads can't actually track me and report my location to arbitrary web sites. I hope Google is thinking about this stuff. I think it's in a reasonable state at the moment if it is just on a development curve. If this is how Google thinks it should stay then it is not enough and is going to become a serious problem.
- orangecat 16y ago
  users either don't read, don't care, or don't understand what is being asked of them and they just click whatever is needed to continue. True. That's sort of ok as long as advanced users can tell when something fishy is going on and flag the app. even an advanced user can't tell the difference between a free app requesting network access to download advertisements and a malicious one using it to upload private information. Also true. The Internet and SD card permissions are all-or-nothing, and therefore essentially useless. Apps should be able to declare that they only contact specific hosts or access specific directories, and there should be a standardized directory for per-app storage, like "Application Support" on OS X.
  - flatulent1 16y ago
    It's really not even safe to have an app without strong credentials and audit trail bringing in ads. There's no protection against objectionable ads, or those doing things like taking advantage of Flash vulnerabilities etc. Isn't the Apple approach to host the ads themselves? While app developers still get data access, at least there's a healthy isolation between the client and the advertiser. Apple can certainly provide things like basic client stats and direct ads appropriately based on location. The Windows anti-virus / anti-spyware model is too flawed to be trusted. It's like having a bouncer at the door of a party that keeps out offenders from previous parties. The default is to trust everything else, so every zero day attack can get through. Defaulting to not trusting things and only allowing what's known okay would be far more effective. If apps had to request all net connections through IPs stored at Apple/Google etc, the potential to direct to some hostile developer or botnet would be greatly reduced. Although the plans may be for video and other high bandwidth content streaming, that huge server city Apple is building could certainly host any static non-generic content apps need, and perhaps be a proxy for much of the rest (news sites etc). Google certainly has the infrastructure to do something similar. Granted Google is better set to do that on a global level. Even advanced users can be tricked if granting access for something trivial opens the gates to something nasty. At least on a consumer device it makes sense to protect users from themselves. Limiting hosts and local directories is certainly prudent.
- cludwin 16y ago
  Again since the article doesn't mention which app was malicious it's hard to say but when I looked up the wallpaper apps developed by "jackeey,wallpaper" I see the apps requiring the following permissions: android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.SET_WALLPAPER android.permission.WRITE_EXTERNAL_STORAGE It seems strange for a wallpaper app to require internet access.
  - Tichy 16y ago
    I must admit I didn't know that READ_PHONE_STATE includes browsing history. But I don't know what is the message shown to the user. I have decided to not install apps that ask for too much several times. Maybe another way to categorize the security rights is needed.
  - Zak 16y ago
    A wallpaper app is likely to need the ability to download new wallpapers. I'm not sure why it would need your location though.
    - tvon 16y ago
      It wouldn't need it, but it could be used to find wallpapers relevant to your location (photos).
jlgosse 16y ago
If this is true, I'm disturbed by the fact that: 1. Google has failed to tell any of us this, 2. I don't even know if I had any of the vendor's applications in the past, as they have been removed entirely, AND 3. Google has failed to tell any of us this! I mean what the hell, at least send us an email telling us that because we downloaded AppXYZ, our data has been compromised by some low-life(s) in China. I'm going to end up being a lot less likely to download random apps now, not only because of this really sketchy incident, but because of the lack of transparency on Google's part. Damn.
- TeHCrAzY 16y ago
  It's quite clearly stated, when you install an app from the market, what permissions is it requesting. If your wallpaper app wants to know your location, SMS content etc etc, and you still install it, more fool you.
- SoftwareMaven 16y ago
  Does Android have the ability to remotely kill applications like iOS? If so, perhaps they did that, so your app just disappeared if you had it. I was going to say "I can't imagine Google hushing up a security issue", but it does have the potential to get thrown in their face by Apple, "See, our walled garden is a good thing." (Not that I believe for an instant that Apple's approval would catch something like this.)
  - megablast 16y ago
    Yes, they do. I am pretty sure they have already removed one application. Lets wait to hear what google says before we all go crazy.
    - masklinn 16y ago
      > Yes, they do. I am pretty sure they have already removed one application. Two, I believe (though at the same time and by the same author)
  - masklinn 16y ago
srjk 16y ago
This scared me. I just installed a wallpaper app yesterday and while doing so thought "that's weird, why does it my personal information, phone calls etcs". But I still got the app. I guess my excuse is being used to my iphone, I didn't think about exactly how much access I was granting to this random app. Anyway, I just checked, and the wallpaper app I had wasn't from jackeey. It's a top free app on the marketplace named Backgrounds by Stylem Media. And, it requires access to network communication, personal information, storage, phone calls, and system tools. I have no idea how the warnings are generated. Maybe devs are just including random libraries in their app (copy paste?) which are setting off these warnings? If not, why does this wallpaper app need my personal info? Anyway, good wake up call, I will definitely be more careful wrt what I install on my phone. EDIT: App request: something that logs/polices information going out from my phone. Firewall? we'll be needing a anti-virus next :(
- argsv 16y ago
  "And, it requires access to network communication, personal information, storage, phone calls, and system tools." This seems like a clear warning to me for wallpaper app. Would you install such an app on your PC/Mac?
credo 16y ago
It seems like Android has three choices 1. The current approach (which made it possible for the wallpaper app to steal user data from millions of users) 2. Prevent apps from accessing data such as voicemail-password, web-browsing history etc. (but it is possible that some apps may have a legitimate reason to do this and blocking these apps may not be fully consistent with the open platform goals) 3. Throw a big warning message EVERY time an app tries to access sensitive data (or perhaps for the first 10 times and the first 10 days...). It is a compromise solution, but users may find this annoying. Either way, this is a somewhat tough problem.
cubicle67 16y ago
It collects ... your voice mail password Do the security dialogs reflect the differing levels of importance of the data you're providing access to? If an app is requesting access to my voice mail password, I'd expect a pretty big red strobe light stuck on the dialog; something to really catch your attention, especially if you're trying to 'yes' your way through 9 (number stated by jsz0 for Google Maps) of the things
orangecat 16y ago
I'm pretty sure the article is not entirely accurate. There are several apps from "Jackeey Wallpaper" in the Android Market, all of which seem to be apps to download wallpapers of various themes. The dozen or so I've checked have these permissions: - "modify/delete SD card contents" - "coarse (network based) location" - "full Internet access" - "read phone state and identity" As far as I know none of those allow reading your browser history or text messages, and certainly not your voicemail password. We need to see a network capture of what was sent to their site.
- tlrobinson 16y ago
  The app in question only sends your phone number, IMSI, and voicemail number. They posted a clarification here: http://blog.mylookout.com/2010/07/mobile-application-analysis-blackhat/ http://blog.mylookout.com/2010/07/mobile-application-analysi...
papertiger 16y ago
It would be nice if the article actually named the app rather than just the developer. Does anyone know the app name?
- orangecat 16y ago
  If you search the market for "Jackeey" you'll get several dozen wallpaper apps. I think the article is treating all of them as a single app, which explains the "1.1 to 4.6 million" downloads: they just added up the lower and upper bounds of the ranges for each individual app. And as I said above, they don't appear to be requesting permissions that would let them do most of the nasty things described.
- cludwin 16y ago
  I did some digging and ... The article doesn't mention which app was malicious however they did mention that the app publisher went by the name of "jackeey,wallpaper". I ran some queries and it seems like the developer that publishes apps under "jackeey,wallpaper" also publishes under "jackeey.wu". A list of the apps published by this developer are here (most of which are wallpaper apps): http://andbot.com/developer/jackeeywallpaper http://andbot.com/developer/jackeeywallpaper http://andbot.com/developer/jackeey-wu http://andbot.com/developer/jackeey-wu http://andbot.com/developer/jackeeywu http://andbot.com/developer/jackeeywu
  - cludwin 16y ago
    I compiled a more comprehensive list of the apps that could be affected and I'll be updating it when I find out more info: http://andbot.com/blog/index.php/2010/07/29/android-apps-suspected-of-stealing-your-information/ http://andbot.com/blog/index.php/2010/07/29/android-apps-sus...
jim_h 16y ago
I've gotten very selective about which android apps I install. It seems like some apps ask for more access than I would like to give them and what I think they need.
jacquesm 16y ago
A typical case of overblown 'user failure', not Android security model failure. If a wallpaper app wants internet access and you allow it you really only have yourself to blame. Wallpaper, cursors packages, screen savers and other dumb 'customisation' gadgets have been malware vectors on the windows platform for about 15 years now, why would phone platforms be any different ?
- nailer 16y ago
  Because this wasn't some random APK downloaded directly from the internet and thrown onto a phone after the 'APKs from the internet might harm your security' message. It was uploaded to Android Market and provided by Google, who as an arbiter of content, should realize that 'collect phone data' isn't an appropriate permission for a wallpaper.
  - jacquesm 16y ago
    So, Google has a responsibility to check each and every app for malicious intent by the uploader? I really think that goes one step too far, that's exactly what apple does with their market place and I think that is a big part of the problem. The ultimate responsibility of what you run on your computers lies with you, not with some entity providing you with a convenient way to get at a catalogue of stuff. This application seems to be malicious, and it seems that the security model is not broken, after all it asks for the permissions very explicitly. Now if only people would read those warnings and think for a bit before clicking 'ok'. This is analogous to people receiving an email that instructs them to open a malware attachment. It's simple, if you haven't inspected the source and it doesn't come from a source that has inspected the code and that gives you a guarantee that you can trust the stuff you download then you can not trust it. Pushing the responsibility to Google is utterly unfair, they could never in a lifetime review the source code of every application that every android app developer throws out there.
    - jsz0 16y ago
      The tricky part for Google is they have pulled apps in the past so they're not entirely absolving themselves of responsibility for the Market.
rodh257 16y ago
So the iPhone is too closed, and Android is too open. In my opinion, they should have a quality assured Market, but keep the ability to load .apk files whenever you want (and also the ability for others to create their own marked). Quality assurance on market should mainly be about maliciousness of applications. It sounds stupid arguing for android to be more closed, but really Google is very slack with their Market.
- drivebyacct2 16y ago
  QA at Apple would not have stopped this. I'm not surprised that people fall for this BS. Apple would have caught this just like Apple would have caught a flashlight with a SOCKS tunnel right? If the App requests permission, wtf do you expect? I don't think Google even has an obligation to remove or crackdown on these types of apps.
  - rodh257 16y ago
    every app asks for permissions, thats the problem. If I didn't use apps that had permissions which could possibly be exploited I would have barely any apps. At the very least malicious apps need to be removed quickly, along with spam + scam apps.

98 points by pkchen 16y ago

there 16y ago

so what were the security permissions requested by this app at the time of installation? i have to imagine that if it was taking web browsing history that it would have needed more permissions than just "uses network data". android's fine-grained security permissions, where the author has to explicitly request each type (network use, prevent the screen from turning off, etc.) and the user is shown the list of permissions requested before installing, is good from a security standpoint, but i think it's ended up being like windows vista. users either don't read, don't care, or don't understand what is being asked of them and they just click whatever is needed to continue. even an advanced user can't tell the difference between a free app requesting network access to download advertisements and a malicious one using it to upload private information.

jsz0 16y ago
It's a rarity to see any Android app that doesn't require half a dozen different permissions. I just installed the Google Maps update and it requires 9 including the ability to read my phone call logs (??)
- there 16y ago
  maybe on-demand permission requests would be better for many of those things, like apple ios does when an app requests your location. if i did something in google maps and it popped up a dialog asking for access to my call logs, i would certainly deny it, but i just did that update this morning and didn't even notice anything about it accessing my call logs.
  - masklinn 16y ago
    > maybe on-demand permission requests would be better for many of those things, like apple ios does when an app requests your location. Wouldn't change much, 95% of users would still go WANNA USE APPLICATION, DISMISS MEAN BOX NOW
    - elliottkember 16y ago
      Cancel or allow?
      - masklinn 16y ago
        Cancel doesn't give them APPLICATION NOW, so it's just training them to reflex-click allow. It's a pavlovian reaction: Cancel -> no application; Allow -> application. If they launched the application, they probably want to see what's in it.
- TeHCrAzY 16y ago
  The google apps are an outlier in my experience so far. They tend to ask for many indepth permissions. Most apps just want full network access (for ad's) and sometimes phone call state/sdcard access etc.
maxjg 16y ago
Just out of curiosity, when an android app is updated, how are permissions handled? Do you receive a prompt to allow new privileges, or does it assume you approve of it already? You bring up an astute point on the vague "network access" permission, but there's really not an easy answer to this. How would you fix it? Ask the developer to simply say what the access will be used for? In an malicious app, they'd obviously just lie. Short of actually displaying what data an app is sending, I don't see an easy answer.
- eli 16y ago
  Yes, if an update requires new permissions, it must be explicitly approved again and cannot be auto-updated.
- there 16y ago
  froyo (finally) has an automatic update feature, so most apps update on their own. i have noticed a few that say they require manual updating, but i didn't know if it was due to a download failure or if it was for a changed set of permissions. it does show you the full permission list again before updating manually. How would you fix it? Ask the developer to simply say what the access will be used for? In an malicious app, they'd obviously just lie. Short of actually displaying what data an app is sending, I don't see an easy answer. maybe show a list of domains it's allowed to resolve/contact? i guess that wouldn't make it any easier for most users to decipher though. i think a lot of free apps require network access just to download ads; maybe there is a better way (in the android api) of handling that to segment it away from full-blown network access? maybe have a set of permissions common to each category? it's expected that a web browser app has access to do a lot of things, but if you have an app in a wallpaper category that requires those same set of permissions, it should be raising a red flag somewhere. perhaps apple's app review process wasn't so crazy after all...
- papertiger 16y ago
  Maybe treating any ad network component as a "sub-app" with separate permissions would make it more obvious when a request for network access is unwarranted. As to how something like that might be implemented... I have no idea. I suspect people would ignore it anyway.
shirtless_coder 16y ago
And it DID request more than that. The thing is, that these wannabes like to paint themselves as "security experts", so they conceal facts and tell the story to the masses of non-techie users and scare them. Then, they sell a bogus security app.
- guelo 16y ago
  If a wallpaper app requests access to your contacts and millions of users install it anyways that is a flaw in Android's security model. After a while you become conditioned to just hitting Install without even looking at the permissions being requested. Just because users are lazy or even stupid is not an excuse for leaving them vulnerable.
  - zmmmmm 16y ago
    I agree it's a flaw. I do think it is better than iOS but it is still a huge problem. It is one of simultaneously too much and too little granularity. If you provide too much granularity it overwhelms users, while if you provide too little it forces people to approve too wide a scope. For example, the music app I just installed wants access to the phone state and identity. At first I baulked and said WTF does a music app need that for? And of course, the answer is it wants to make the music quieter / pause when a call comes in. But to do that it needs access to the identity of my phone because that seems to be lumped into the same bucket as the "state" of my phone. It also needs internet access because it wants to download album art. So these completely innocuous features also mean it could be tracking my location and reporting it to the web. How do I tell an evil app from a good one? I don't know - all I do is read the comments. I think Android needs to make the model richer while also streamlining certain sets of permissions into standard profiles that people can understand. For example, the set of minimal permissions to support ads in an app should be simply presented as "to present location based ads", not a set of 5 permissions that overwhelm people. This should in turn be honed by Google into a minimal set of permissions internally so that an app that just wants to present ads can't actually track me and report my location to arbitrary web sites. I hope Google is thinking about this stuff. I think it's in a reasonable state at the moment if it is just on a development curve. If this is how Google thinks it should stay then it is not enough and is going to become a serious problem.
orangecat 16y ago
users either don't read, don't care, or don't understand what is being asked of them and they just click whatever is needed to continue. True. That's sort of ok as long as advanced users can tell when something fishy is going on and flag the app. even an advanced user can't tell the difference between a free app requesting network access to download advertisements and a malicious one using it to upload private information. Also true. The Internet and SD card permissions are all-or-nothing, and therefore essentially useless. Apps should be able to declare that they only contact specific hosts or access specific directories, and there should be a standardized directory for per-app storage, like "Application Support" on OS X.
- flatulent1 16y ago
  It's really not even safe to have an app without strong credentials and audit trail bringing in ads. There's no protection against objectionable ads, or those doing things like taking advantage of Flash vulnerabilities etc. Isn't the Apple approach to host the ads themselves? While app developers still get data access, at least there's a healthy isolation between the client and the advertiser. Apple can certainly provide things like basic client stats and direct ads appropriately based on location. The Windows anti-virus / anti-spyware model is too flawed to be trusted. It's like having a bouncer at the door of a party that keeps out offenders from previous parties. The default is to trust everything else, so every zero day attack can get through. Defaulting to not trusting things and only allowing what's known okay would be far more effective. If apps had to request all net connections through IPs stored at Apple/Google etc, the potential to direct to some hostile developer or botnet would be greatly reduced. Although the plans may be for video and other high bandwidth content streaming, that huge server city Apple is building could certainly host any static non-generic content apps need, and perhaps be a proxy for much of the rest (news sites etc). Google certainly has the infrastructure to do something similar. Granted Google is better set to do that on a global level. Even advanced users can be tricked if granting access for something trivial opens the gates to something nasty. At least on a consumer device it makes sense to protect users from themselves. Limiting hosts and local directories is certainly prudent.
cludwin 16y ago
Again since the article doesn't mention which app was malicious it's hard to say but when I looked up the wallpaper apps developed by "jackeey,wallpaper" I see the apps requiring the following permissions: android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.SET_WALLPAPER android.permission.WRITE_EXTERNAL_STORAGE It seems strange for a wallpaper app to require internet access.
- Tichy 16y ago
  I must admit I didn't know that READ_PHONE_STATE includes browsing history. But I don't know what is the message shown to the user. I have decided to not install apps that ask for too much several times. Maybe another way to categorize the security rights is needed.
- Zak 16y ago
  A wallpaper app is likely to need the ability to download new wallpapers. I'm not sure why it would need your location though.
  - tvon 16y ago
    It wouldn't need it, but it could be used to find wallpapers relevant to your location (photos).

jlgosse 16y ago

If this is true, I'm disturbed by the fact that: 1. Google has failed to tell any of us this, 2. I don't even know if I had any of the vendor's applications in the past, as they have been removed entirely, AND 3. Google has failed to tell any of us this! I mean what the hell, at least send us an email telling us that because we downloaded AppXYZ, our data has been compromised by some low-life(s) in China. I'm going to end up being a lot less likely to download random apps now, not only because of this really sketchy incident, but because of the lack of transparency on Google's part. Damn.

TeHCrAzY 16y ago
It's quite clearly stated, when you install an app from the market, what permissions is it requesting. If your wallpaper app wants to know your location, SMS content etc etc, and you still install it, more fool you.
SoftwareMaven 16y ago
Does Android have the ability to remotely kill applications like iOS? If so, perhaps they did that, so your app just disappeared if you had it. I was going to say "I can't imagine Google hushing up a security issue", but it does have the potential to get thrown in their face by Apple, "See, our walled garden is a good thing." (Not that I believe for an instant that Apple's approval would catch something like this.)
- megablast 16y ago
  Yes, they do. I am pretty sure they have already removed one application. Lets wait to hear what google says before we all go crazy.
  - masklinn 16y ago
    > Yes, they do. I am pretty sure they have already removed one application. Two, I believe (though at the same time and by the same author)
- masklinn 16y ago

srjk 16y ago

This scared me. I just installed a wallpaper app yesterday and while doing so thought "that's weird, why does it my personal information, phone calls etcs". But I still got the app. I guess my excuse is being used to my iphone, I didn't think about exactly how much access I was granting to this random app. Anyway, I just checked, and the wallpaper app I had wasn't from jackeey. It's a top free app on the marketplace named Backgrounds by Stylem Media. And, it requires access to network communication, personal information, storage, phone calls, and system tools. I have no idea how the warnings are generated. Maybe devs are just including random libraries in their app (copy paste?) which are setting off these warnings? If not, why does this wallpaper app need my personal info? Anyway, good wake up call, I will definitely be more careful wrt what I install on my phone. EDIT: App request: something that logs/polices information going out from my phone. Firewall? we'll be needing a anti-virus next :(

argsv 16y ago
"And, it requires access to network communication, personal information, storage, phone calls, and system tools." This seems like a clear warning to me for wallpaper app. Would you install such an app on your PC/Mac?

credo 16y ago

It seems like Android has three choices 1. The current approach (which made it possible for the wallpaper app to steal user data from millions of users) 2. Prevent apps from accessing data such as voicemail-password, web-browsing history etc. (but it is possible that some apps may have a legitimate reason to do this and blocking these apps may not be fully consistent with the open platform goals) 3. Throw a big warning message EVERY time an app tries to access sensitive data (or perhaps for the first 10 times and the first 10 days...). It is a compromise solution, but users may find this annoying. Either way, this is a somewhat tough problem.

cubicle67 16y ago

It collects ... your voice mail password Do the security dialogs reflect the differing levels of importance of the data you're providing access to? If an app is requesting access to my voice mail password, I'd expect a pretty big red strobe light stuck on the dialog; something to really catch your attention, especially if you're trying to 'yes' your way through 9 (number stated by jsz0 for Google Maps) of the things

orangecat 16y ago

I'm pretty sure the article is not entirely accurate. There are several apps from "Jackeey Wallpaper" in the Android Market, all of which seem to be apps to download wallpapers of various themes. The dozen or so I've checked have these permissions: - "modify/delete SD card contents" - "coarse (network based) location" - "full Internet access" - "read phone state and identity" As far as I know none of those allow reading your browser history or text messages, and certainly not your voicemail password. We need to see a network capture of what was sent to their site.

tlrobinson 16y ago
The app in question only sends your phone number, IMSI, and voicemail number. They posted a clarification here: http://blog.mylookout.com/2010/07/mobile-application-analysis-blackhat/ http://blog.mylookout.com/2010/07/mobile-application-analysi...

papertiger 16y ago

It would be nice if the article actually named the app rather than just the developer. Does anyone know the app name?

orangecat 16y ago
If you search the market for "Jackeey" you'll get several dozen wallpaper apps. I think the article is treating all of them as a single app, which explains the "1.1 to 4.6 million" downloads: they just added up the lower and upper bounds of the ranges for each individual app. And as I said above, they don't appear to be requesting permissions that would let them do most of the nasty things described.
cludwin 16y ago
I did some digging and ... The article doesn't mention which app was malicious however they did mention that the app publisher went by the name of "jackeey,wallpaper". I ran some queries and it seems like the developer that publishes apps under "jackeey,wallpaper" also publishes under "jackeey.wu". A list of the apps published by this developer are here (most of which are wallpaper apps): http://andbot.com/developer/jackeeywallpaper http://andbot.com/developer/jackeeywallpaper http://andbot.com/developer/jackeey-wu http://andbot.com/developer/jackeey-wu http://andbot.com/developer/jackeeywu http://andbot.com/developer/jackeeywu
- cludwin 16y ago
  I compiled a more comprehensive list of the apps that could be affected and I'll be updating it when I find out more info: http://andbot.com/blog/index.php/2010/07/29/android-apps-suspected-of-stealing-your-information/ http://andbot.com/blog/index.php/2010/07/29/android-apps-sus...

jim_h 16y ago

I've gotten very selective about which android apps I install. It seems like some apps ask for more access than I would like to give them and what I think they need.

jacquesm 16y ago

A typical case of overblown 'user failure', not Android security model failure. If a wallpaper app wants internet access and you allow it you really only have yourself to blame. Wallpaper, cursors packages, screen savers and other dumb 'customisation' gadgets have been malware vectors on the windows platform for about 15 years now, why would phone platforms be any different ?

nailer 16y ago
Because this wasn't some random APK downloaded directly from the internet and thrown onto a phone after the 'APKs from the internet might harm your security' message. It was uploaded to Android Market and provided by Google, who as an arbiter of content, should realize that 'collect phone data' isn't an appropriate permission for a wallpaper.
- jacquesm 16y ago
  So, Google has a responsibility to check each and every app for malicious intent by the uploader? I really think that goes one step too far, that's exactly what apple does with their market place and I think that is a big part of the problem. The ultimate responsibility of what you run on your computers lies with you, not with some entity providing you with a convenient way to get at a catalogue of stuff. This application seems to be malicious, and it seems that the security model is not broken, after all it asks for the permissions very explicitly. Now if only people would read those warnings and think for a bit before clicking 'ok'. This is analogous to people receiving an email that instructs them to open a malware attachment. It's simple, if you haven't inspected the source and it doesn't come from a source that has inspected the code and that gives you a guarantee that you can trust the stuff you download then you can not trust it. Pushing the responsibility to Google is utterly unfair, they could never in a lifetime review the source code of every application that every android app developer throws out there.
  - jsz0 16y ago
    The tricky part for Google is they have pulled apps in the past so they're not entirely absolving themselves of responsibility for the Market.

rodh257 16y ago

So the iPhone is too closed, and Android is too open. In my opinion, they should have a quality assured Market, but keep the ability to load .apk files whenever you want (and also the ability for others to create their own marked). Quality assurance on market should mainly be about maliciousness of applications. It sounds stupid arguing for android to be more closed, but really Google is very slack with their Market.

drivebyacct2 16y ago
QA at Apple would not have stopped this. I'm not surprised that people fall for this BS. Apple would have caught this just like Apple would have caught a flashlight with a SOCKS tunnel right? If the App requests permission, wtf do you expect? I don't think Google even has an obligation to remove or crackdown on these types of apps.
- rodh257 16y ago
  every app asks for permissions, thats the problem. If I didn't use apps that had permissions which could possibly be exploited I would have barely any apps. At the very least malicious apps need to be removed quickly, along with spam + scam apps.