14 ms·

Fake WhatsApp update from “WhatsApp Inc.” with Unicode whitespace: 1M downloads

494 points by jakub_g 9y ago

JoshuaRLi 9y ago
Unicode strikes again!
pacetherace 9y ago
This is so typical of Google's policies. They will not fix something just because users report it. https://bugs.chromium.org/p/chromium/issues/detail?id=147 https://bugs.chromium.org/p/chromium/issues/detail?id=147
- codazoda 9y ago
  I wouldn't fix that "bug" either. I don't want confirmation dialogs all over the place. They are annoying when I try to close or delete. Yes, I clicked close on purpose. Google has done a good job with some of their "undo" notifications; these work much better imho.
  - a_t48 9y ago
    A "Don't ask me again" checkbox is a good compromise.
  - Godel_unicode 9y ago
    Especially considering there's a chrome option to have the startup tabs be the tabs that were last open. No dialogs necessary, just take me back to where I was.
    - Sylos 9y ago
      That's hardly going to help average users.
  - Sylos 9y ago
    Which is your personal opinion. Your personal opinion is not more important than the needs of a significant portion of users. The proper question here has to be what pisses off more users and to what degree does it piss them off: Having to click "Don't ask me again" once after a fresh installation or repeatedly losing some tabs they had opened in the background, because they forgot about them.
- hk__2 9y ago
  > They will not fix something just because users report it. Nobody should "fix" something only because users report it.
  - exikyut 9y ago
    What's the Chromium bugtracker for, then? O.o
    - ovao 9y ago
      For reporting and tracking actual bugs.
  - CodeWriter23 9y ago
    Right, they should only implement that style of feature if it is bugging Chrome Devs http://googlemac.blogspot.com/2011/06/q-i-didnt-mean-to-do-that.html http://googlemac.blogspot.com/2011/06/q-i-didnt-mean-to-do-t...
- nebulous1 9y ago
  That simply isn't a bug, it's a feature suggestion that was rejected.
QAPereo 9y ago
When people bitch about “walled gardens” I like to remind them just why people build walls. This... is why. Sure, a world without walls and locks would be ideal, but only if it’s also a world without thieves, saboteurs, and jerks.
- PeachPlum 9y ago
  "Good fences make good neighbors."
- hawski 9y ago
  Google Play is a walled garden. Maybe a wall is a little lower then some, but still. Is F-Droid a walled garden?
  - Spivak 9y ago
    Yeah, its walls are higher than most. What's the point?
- lactinfo 9y ago
  Err, isn’t the google play store exactly the type of walled garden people bitch about? It has walls and locks all over the place. To what are you referring?
- draw_down 9y ago
  Um.... it didn’t seem to do much good here. Not sure what your point is.
  - eric-hu 9y ago
    I think his point is that Apple's app store is commonly criticized for being a walked garden. While the Android app store may be as well, some complaints seem specific to the Apple side. For instance, releasing a new or updated app requires manual review from someone at Apple. I've only seen complaints about an app release taking an arbitrary amount of time with the Apple app store. There's a list of guidelines your app must conform to, and Apple is generally more aggressive about catching violations before app release compared to Google. There are consequences to this, like Safari-WebKit being the only permitted browser engine on iOS. Any other browser must wrap this engine. The grandparent post is likely pointing out the dissatisfaction that devs express regarding the Apple app store review process. It seems like it comes down to an engineering trade-off. At some point you have to choose between developer experience and end user security.
hawski 9y ago
Google. A search giant. A machine learning leader. They can save me from a typo in the web search, but can't in the Play store. That's another reason to switch to F-Droid.
- 27182818284 9y ago
  >they can save me from a typo in the web search, but can't in the Play store. Besides machine intervention, this seems like a company the size of Google could easily help (if not solve) while creating a lot of good will by hiring a few at-home workers to better flag or check in on certain applications. Off the top of my head, this wouldn't require a ton of training and you could even provide burner-like phones for folks to download the apps to and play a bit on.
  - notatoad 9y ago
    It could easily be hooked it into their existing opinion rewards program. Every time a new app is published on the play store or the name of an existing app is changed, just ask a half-dozen real verified humans if it matches the name of an app they've heard of before. I'd be happy to do it once a week or so for ten cents of play store credit.
- eli 9y ago
  What keeps someone from doing the same thing to f-droid?
  - thriftwy 9y ago
    Maybe they have package vetting process with an actual human inside?
    - avodonosov 9y ago
      They have software dev process with actual human, inside.
    - nolok 9y ago
paulryanrogers 9y ago
Why don't they have a normalized slug to ensure name uniqueness? Or if so why would it consider whitespace differences unique?
- dfc 9y ago
  What is a "normalized slug"?
  - nerdponx 9y ago
    All names get reduced using Unicode normalization.
    - rspeer 9y ago
      Recently, thousands of users were duped into installing "АdВIосk РIuѕ" in Chrome. Every one of those letters is Unicode normalized. (Hint: it's not just the I's masquerading as l's.)
      - nerdponx 9y ago
        Fair enough. I'm a little surprised that those hold up under NFK normalization. А sure as heck seems compatible with A.
  - Arnt 9y ago
    The kind of excerpt-like thing you see on the end of many many modern URLs. "rare-white-moose-captured-on-film-in-sweden" in this one: www.bbc.com/news/av/world-europe-40918494/rare-white-moose-captured-on-film-in-sweden It's machine-produced and surprisingly good at revealing accidental/unintentional/evil duplicates, considering how cheap it is.
  - 27182818284 9y ago
    slug is a term leftover from newspapers. You most commonly see slugs today where a title might be "Did you know this mushroom is off the hook?" and the URL is turned in to a "slug" like example.com/mushroom-off-the-hook/ Here is an example of the Django framework's "slugify" https://github.com/django/django/blob/master/django/utils/text.py#L403 https://github.com/django/django/blob/master/django/utils/te...
apeacox 9y ago
But gmail doesn’t make any differences between user.name and username.
- nolok 9y ago
  Why would this be relevant? What I do with one field in one of my product for one set of reasons has very little to do with what I do with another field entirely, in another product entirely, for a whole other set of reasons...
- ovao 9y ago
  By design. It isn’t accidental.
deleted 9y ago
[deleted]
pasbesoin 9y ago
Recently, I went to install the Amazon Kindle app onto my new phone. From the Google Play store. It all looked good, except for the strangeness of an individual's name listed as the name for the street address and contact information for the app. That was something I did not recall from previous visits to the app in the Google app store. So, the Kindle app's not on my new phone. Because the validation portion of curation is, ultimately, left up to the individual. And I didn't have time to go chasing around the Web making sure I was hitting the correct/official app store page. I probably was. But I've been well-trained to "pause and check" on such details. P.S. I now recall, causing further hesitation, the "other apps" sections of the search results and/or Kindle app page, included an Amazon Video app. And that app had the same name listed in its details. Now, the last I recall, Amazon Video was specifically NOT available in the Google app store. Forcing people on non-Amazon devices who wanted to use it, to have to add the Amazon app store and adjust permissions to allow installing apps from it. At least, temporarily; once you had that or whatever app you wanted from Amazon, you could then adjust your devices settings back to their defaults. Unless/until you wanted to pull an update to such an app -- then, rinse and repeat. So... I see a weird bit of contact information. And I see it also for an app that prior experience taught me was not available in the Google app store... And, with repeated stories like the OP, I can't trust the Google app store to be well-curated. What else can I say? Meh...
- kuschku 9y ago
  That’s interesting. All of them have "Suhail Mirza, 500 9th Avenue N, Seattle, WA 98109" listed as author. But they are the real apps: https://play.google.com/store/apps/developer?id=Amazon+Mobile+LLC https://play.google.com/store/apps/developer?id=Amazon+Mobil... That person’s LinkedIn profile claims "I own Engineering for Amazon's Mobile Shopping iOS, Android and Windows Mobile Teams. I am looking for developers globally. Reach out if you are interested."
- hesarenu 9y ago
  Amazon prime video is available on play store.
  - 9y ago
jwilk 9y ago
"Unicode whitespace" apparently means non-breaking space (U+00A0).
- colanderman 9y ago
  To which the term "Unicode whitespace" applies as equally well as it does to plain old U+0020 :)
nebulous1 9y ago
I assume the downloads were fake, thus giving Google an easy excuse to get rid of it (it's gone now). Although probably all they needed was the obvious impersonation. Unicode has a boat load of security issues. http://unicode.org/reports/tr36/ http://unicode.org/reports/tr36/
jordache 9y ago
F-ing Google
nvr219 9y ago
I seriously don't understand how people let their aging parents or young children or friends use Android phones.
- colejohnson66 9y ago
  Android enthusiasts who think they’re elite because "Apple sucks! Android’s has that feature for 5 years!" But not to be naïve; iOS has problems with fake apps too, just not nearly as bad as Android.
  - saagarjha 9y ago
    Yes, it might, but: 1. There are fewer of these apps. 2. There's less that they can do–on Android apps can do anything and everything once installed.
    - tonyztan 9y ago
      > "on Android apps can do anything and everything once installed." Not necessarily. Modern Android devices have granular permissions, just like the iPhone. https://developer.android.com/training/permissions/requesting.html https://developer.android.com/training/permissions/requestin...
      - ClassyJacket 9y ago
        Unless this has been changed, this only occurs if the app agrees to it, making it entirely pointless. A malicious app needs only to target Android 5 and gets free reign over the phone.
        dep_b 9y ago
        I think that means not using a newer SDK than 5, in which case the feature doesn't exist yet.
      - saagarjha 9y ago
e9 9y ago
I hope there are no fake banking apps like that...
microcolonel 9y ago
This is why even some of ASCII is a mistake, maybe we shouldn't even bother with case. Every time something like this comes about I just get more cynical about the complexity of multilingual systems, or systems with interesting typesetting routines.
- jstimpfle 9y ago
  ASCII is very well defined. Control characters were needed at the time (and still are today, if you're using a terminal emulator). It's easy to handle, just disallow < 32 and > 127, which are invalid or non-printable chars (but think about tab/cr/lf). Basically every font you can find can display all of the ASCII printable range without room for confusion.
- colejohnson66 9y ago
  What ASCII characters are a mistake? If we required all apps to only use characters in the ASCII charset (the 127 codepoint one, not the Windows-1291 "ASCII" garbage), these tricks wouldn’t work.
  - irl_zebra 9y ago
    The poster said some ascii is a mistake. I’m assuming those chars that don’t translate to much/anything.
    - colejohnson66 9y ago
      Like basically anything in the 0x1 to 0x1F range?
enord 9y ago
Trust is hard. It cannot be automated, it's inherently social and demands vigilance. This is as true IRL as it is online and on "curated" federations (of software, news, contacts etc). The "killer app" for trust is one that extends our natural skepticism and social awareness, and this will _never_ be easier online than in meatspace. This is obvious when we raise our perspective from the purely technological (the "means") to the fundamentally social (the "ends"). All the automated or manual safeguards that Google could enact would never prevent people from pulling a fast one, the old switcheroo, a kansas shuffle on each other because it's just something that we do. And we will use whichever means (technology) available, in whatever way feasible. This particular example looks egregious (or ingenious, depending) for cosmetic reasons, but it's fundamentally an interaction between people however fraudulent. Google is in the business of interactions between people.
- djrogers 9y ago
  > All the automated or manual safeguards that Google could enact would never prevent people from pulling a fast one We don’t expect perfection, but they’ve at least gotta make it harder than the copy and paste bs that litters the Play Store. ‘It’s hard’ is the worst possible reason to do nothing.
- smsm42 9y ago
  Solving trust 100% is hard. Having people review apps that have names which are within a short Levenshtein distance (accounting for Unicode tricks etc.) of a popular apps' names and banning those apps, the accounts that created them and their suppliers of fake votes is not that hard, especially for a company like Google. And look at those apps' descriptions, they are complete baloney, and any two-bit text classifier which a capable intern can mock up together in a weekend from off-the-shelf components can recognize that. These guys aren't even trying, and still aren't getting caught. Yes, it may require some monetary investment, but we're talking about $700bn company. They could afford it if they wanted to. If they are not doing it, that means they do not want to.
  - enord 9y ago
    Of course, in hindsight you "only" have to calculate the Levehnstein distance between any product name and _all other_ product names on the store. That scales well. In order to close one single avenue for fraudulent advertisement. Maybe it's a big one, and maybe the cost is recouped through improved customer relations. Maybe. And maybe they implement this, and calculate hundreds of millions (billions?) of Levehnstein distances every day, but the next day someone publishes the same app but with a germanized name ("Was ist App Update") and fools a couple'o hundred thousand germans. Now the solution is obvious, run the names through Google Translate for ALL languages and calculate the respective levehnstein distances! I'ts foolproof! Shame on you google for not doing it already! Simply irresponsible.
shpx 9y ago
Here are three fake uBlock Origins that have over 4 million users between them https://chrome.google.com/webstore/detail/ublock-plus/kjagjnchnnlgiafjjlahaedeagnmhefi?hl=en-US https://chrome.google.com/webstore/detail/ublock-plus/kjagjn... https://chrome.google.com/webstore/detail/ublock-adblock-plus/fdecnmmdccnkogcidionikojplkjfgie?hl=en-US https://chrome.google.com/webstore/detail/ublock-adblock-plu... https://chrome.google.com/webstore/detail/ublock-adblocker-plus/pnhflmgomffaphmnbcogleagmloijbkd?hl=en-US https://chrome.google.com/webstore/detail/ublock-adblocker-p... The last two are exploiting the fact that uBlock Origin doesn't come up when you search "adblock". There's tons more, just look through the search results for "adblock" https://chrome.google.com/webstore/search/adblock?hl=en-US&_category=extensions https://chrome.google.com/webstore/search/adblock?hl=en-US&_... and results for "ublock" https://chrome.google.com/webstore/search/ublock?hl=en-US&_category=extensions https://chrome.google.com/webstore/search/ublock?hl=en-US&_c... Note that firefox doesn't have this problem (tons of adblockers, maybe some are fake, but none pretending to be uBlock Origin) https://addons.mozilla.org/en-US/firefox/search/?platform=mac&q=ublock https://addons.mozilla.org/en-US/firefox/search/?platform=ma... maybe has something to do with the fact that they show usage numbers on the results page.
- md67 9y ago
  I just use the host file to block stuff. There are enough crowd sourced github lists out there that relying on a thirdparty browser extension that is doing god knows what, controlled by god knows who just doesn't make sense. The rest of the family has been trained to update their files. Update it every two months
  - orf 9y ago
    That's great until you need to selectively disable it for a single (poorly coded) site.
    - dredmorbius 9y ago
      There are many other problems with the concept, though of this one: High-level blocks (domains, TLDs) can be bypassed using, say, dnsmasq, by providing specific pass-throughs. As for sites that use widely-blocked services: the message is to feed back to them and tell them not to do that. The fact of countermeasures does not mean that there will be no collateral damage. In fact, that's kind of precisely the situation that got us into this mess in the first place: putatively legitimate advertising that isn't.
fiatjaf 9y ago
Apparently a-z0-9 usernames work better than these full business names. It would be much harder to fake a github.com/whatsapp account than it is to fake "WhatsApp Inc.". Besides the invisible codepoints, one would easily do "WhatsApp Inc", "WhatsApp Messenger Inc.", "WhatsApp IM" and so on.
Waterluvian 9y ago
Take the top apps and automatically raise a list of apps with similar names each week. Pay someone to investigate and flag if necessary. I feel like there's a general unwillingness in some realms to do anything at all if the solution is "manual labor until a better tool is available."
- nitely 9y ago
  Or don't allow apps with similar name than a popular one in the first place.
- TylerE 9y ago
  There might be legal concerns as well. I know under the DCMA safe harbor provisions that basically as soon as you start doing manual moderation you are now liable for anything that gets through.
  - pvillano 9y ago
    Could you expand on that?
    - hidenotslide 9y ago
      Not an expert, but the only part I see like this is section 512(a) here: https://en.wikipedia.org/wiki/Online_Copyright_Infringement_Liability_Limitation_Act https://en.wikipedia.org/wiki/Online_Copyright_Infringement_... This seems to apply to network traffic, whereas I'd guess what to host on the Play Store would be covered by 512(c) instead. If so, the "red flags" test would seem to require at least some automated content checking. But all the above refers to copyright, rather than the trademark violation and fraud in the WhatsApp clones.
  - seanhunter 9y ago
    I don't think that's true. A safe harbor can't make you liable for something, it can carve out a specific case where you are not liable. So the DCMA safe harbor could say that they are not liable if they never moderate. That would mean that by moderating they would give up their ability to claim safe harbor. It would not make them liable. Their liability would then be judged based on what they did (ie was their moderation negligent in some way).
deleted 9y ago
[deleted]
repiret 9y ago
Several years ago I read [1] a proposal for internationalized domain names from DJ Bernstein from before puny-code took hold. The key observation was that there's nothing stopping you from just using UTF-8 in the existing DNS protocols, but it included a discussion of how to treat visually indistinguishable unicode characters to prevent fraud, which is why I bring it up now: The proposal was that the TLD administrators should whitelist in non-ASCII characters and generally require that domains are either entirely ASCII or entirely in a subset of Unicode that made sense for their native languages - .ru could allow all-ASCII or all-Cyrillic, .gr could require all-ASCII or all-Greek, .de could allow ASCII plus eszett and the umlauts, and could further require normalized encoding (ü must be FC and not CC 88 75) and consider ö.de and oe.de to be collisions [2], and so on. Weird varieties of spaces, dashes, non-printing characters, accents that are only needed to type Klingon, and so on would never get whitelisted in. I've always thought that was a great idea, and its a general principal App stores could use too. (Although I realize that app stores don't have as strong a concept of a native language as most TLDs do, which makes it a bit harder) [1]: Its possible it was https://cr.yp.to/djbdns/idn.html https://cr.yp.to/djbdns/idn.html, but I'm not convinced. Maybe it was an earlier revision. [2]: In German, you spell "ö" as "oe" if you don't have an ö key. German speakers wouldn't necessarily need "ö" and "o" to be collisions.
- fermienrico 9y ago
  This is a horrendous idea. What's to say, 0 and o can be mixed up and ban that too? How would you handle gray areas? Determining what's fishy and what's not is not a matter of black and white. What if you have a German name and want to set up a site in India with ö.in? This idea creates more problems than it solves. Policing/banning is never a good idea. Internet freedom is way more important than phishing attemps. Let's ban everything because anything can be phished if you're smart enough.
  - ta8374477 9y ago
    It is certainly not a horrendous idea; it is commonly used for serial numbers in engineering. For example a part number would have a serial number that is a subset of A-Z, skipping the easily ambiguous O,I and similar.
kornish 9y ago
For anyone curious, the name for this type of deception (using Unicode to pretend to be a known domain) is called a homoglyph attack: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/200146-Homoglyph-Advanced-Phishing-Attacks.pdf https://www.cisco.com/c/en/us/support/docs/security/email-se...
jeisc 9y ago
How is any end user to know what is the original whatsapp?
gear54rus 9y ago
Bullshit. Just like punycode TLDs. And I say this as a guy from a cyrillic country. We invented a footgun and then promptly shot themselves with it. Instead of making everyone use safe ascii charset for IDs (domains, names like the one in the article, etc.), we go for stupid fuckton of language charsets that cause such problems. All in the name of accessiblity or whatever. And all this does it let people continue living in their language-specific bubble instead of just learning the main international language: english and living happily ever after. And now people suggest some crutches like restricting the data to some subset of unicode. Never learn.
- kome 9y ago
  I am happy about unicode, the benefits are well worth the few problems. Scammer will always be scammer. We have to outsmart them, that's all.
- Jaxan 9y ago
  I don't think it's fair to force English upon people. It's not even the most spoken language on the planet. (There is more people speaking Chinese. And also more people speaking Spanish than English.)
  - gear54rus 9y ago
    Of course it's fair. Tech dominates the world, it's not about numbers, it's about being able to understand everyone using modern communication methods. Regarding china, they chose isolationist politics (just like russia lol), it's everyone else's duty to pull the blanket over to the 'everyone' side from 'china' side.
CM30 9y ago
Hang on, don't Google supposedly review apps before accepting them into the store? I mean, they apparently have both an automated system checking for rule violations and actual human staff checking every now and then: https://www.recode.net/2015/3/17/11560334/google-is-adding-manual-review-to-android-app-submission-process https://www.recode.net/2015/3/17/11560334/google-is-adding-m... So how is this stuff just waltzing past their quality control setup? That one unicode character can't really be messing up the whole system, right? If this stuff is supposedly moderated, who's actually doing the moderation here?
pfarnsworth 9y ago
I have personally and purposefully caused a lot of confusion on some sites by using Cyrillic letters that look exactly like English letters to impersonate other people. This was mainly for fun and for harmless trolling, but it's very easy to see that this could be used on any site that uses Unicode for usernames, etc. Phishing is extremely easy with this and something needs to be done otherwise no one will trust the Internet ever again, especially if someone can just "steal" Whatsapp so easily.
dep_b 9y ago
At least now it's easier to explain to customers why they have to get a DUNS to have apps under their company name in the App Store while the Play Store just allows it.
gaius 9y ago
I wish for security and simplicity there was a way to disable everything but 7-bit ASCII. Like, who actually thought that having identical characters for different things made any sense ??

494 points by jakub_g 9y ago

Unicode strikes again!

This is so typical of Google's policies. They will not fix something just because users report it. https://bugs.chromium.org/p/chromium/issues/detail?id=147 https://bugs.chromium.org/p/chromium/issues/detail?id=147

codazoda 9y ago
I wouldn't fix that "bug" either. I don't want confirmation dialogs all over the place. They are annoying when I try to close or delete. Yes, I clicked close on purpose. Google has done a good job with some of their "undo" notifications; these work much better imho.
- a_t48 9y ago
  A "Don't ask me again" checkbox is a good compromise.
- Godel_unicode 9y ago
  Especially considering there's a chrome option to have the startup tabs be the tabs that were last open. No dialogs necessary, just take me back to where I was.
  - Sylos 9y ago
    That's hardly going to help average users.
- Sylos 9y ago
  Which is your personal opinion. Your personal opinion is not more important than the needs of a significant portion of users. The proper question here has to be what pisses off more users and to what degree does it piss them off: Having to click "Don't ask me again" once after a fresh installation or repeatedly losing some tabs they had opened in the background, because they forgot about them.
hk__2 9y ago
> They will not fix something just because users report it. Nobody should "fix" something only because users report it.
- exikyut 9y ago
  What's the Chromium bugtracker for, then? O.o
  - ovao 9y ago
    For reporting and tracking actual bugs.
- CodeWriter23 9y ago
  Right, they should only implement that style of feature if it is bugging Chrome Devs http://googlemac.blogspot.com/2011/06/q-i-didnt-mean-to-do-that.html http://googlemac.blogspot.com/2011/06/q-i-didnt-mean-to-do-t...
nebulous1 9y ago
That simply isn't a bug, it's a feature suggestion that was rejected.

QAPereo 9y ago

When people bitch about “walled gardens” I like to remind them just why people build walls. This... is why. Sure, a world without walls and locks would be ideal, but only if it’s also a world without thieves, saboteurs, and jerks.

PeachPlum 9y ago
"Good fences make good neighbors."
hawski 9y ago
Google Play is a walled garden. Maybe a wall is a little lower then some, but still. Is F-Droid a walled garden?
- Spivak 9y ago
  Yeah, its walls are higher than most. What's the point?
lactinfo 9y ago
Err, isn’t the google play store exactly the type of walled garden people bitch about? It has walls and locks all over the place. To what are you referring?
draw_down 9y ago
Um.... it didn’t seem to do much good here. Not sure what your point is.
- eric-hu 9y ago
  I think his point is that Apple's app store is commonly criticized for being a walked garden. While the Android app store may be as well, some complaints seem specific to the Apple side. For instance, releasing a new or updated app requires manual review from someone at Apple. I've only seen complaints about an app release taking an arbitrary amount of time with the Apple app store. There's a list of guidelines your app must conform to, and Apple is generally more aggressive about catching violations before app release compared to Google. There are consequences to this, like Safari-WebKit being the only permitted browser engine on iOS. Any other browser must wrap this engine. The grandparent post is likely pointing out the dissatisfaction that devs express regarding the Apple app store review process. It seems like it comes down to an engineering trade-off. At some point you have to choose between developer experience and end user security.

hawski 9y ago

Google. A search giant. A machine learning leader. They can save me from a typo in the web search, but can't in the Play store. That's another reason to switch to F-Droid.

27182818284 9y ago
>they can save me from a typo in the web search, but can't in the Play store. Besides machine intervention, this seems like a company the size of Google could easily help (if not solve) while creating a lot of good will by hiring a few at-home workers to better flag or check in on certain applications. Off the top of my head, this wouldn't require a ton of training and you could even provide burner-like phones for folks to download the apps to and play a bit on.
- notatoad 9y ago
  It could easily be hooked it into their existing opinion rewards program. Every time a new app is published on the play store or the name of an existing app is changed, just ask a half-dozen real verified humans if it matches the name of an app they've heard of before. I'd be happy to do it once a week or so for ten cents of play store credit.
eli 9y ago
What keeps someone from doing the same thing to f-droid?
- thriftwy 9y ago
  Maybe they have package vetting process with an actual human inside?
  - avodonosov 9y ago
    They have software dev process with actual human, inside.
  - nolok 9y ago

paulryanrogers 9y ago

Why don't they have a normalized slug to ensure name uniqueness? Or if so why would it consider whitespace differences unique?

dfc 9y ago
What is a "normalized slug"?
- nerdponx 9y ago
  All names get reduced using Unicode normalization.
  - rspeer 9y ago
    Recently, thousands of users were duped into installing "АdВIосk РIuѕ" in Chrome. Every one of those letters is Unicode normalized. (Hint: it's not just the I's masquerading as l's.)
    - nerdponx 9y ago
      Fair enough. I'm a little surprised that those hold up under NFK normalization. А sure as heck seems compatible with A.
- Arnt 9y ago
  The kind of excerpt-like thing you see on the end of many many modern URLs. "rare-white-moose-captured-on-film-in-sweden" in this one: www.bbc.com/news/av/world-europe-40918494/rare-white-moose-captured-on-film-in-sweden It's machine-produced and surprisingly good at revealing accidental/unintentional/evil duplicates, considering how cheap it is.
- 27182818284 9y ago
  slug is a term leftover from newspapers. You most commonly see slugs today where a title might be "Did you know this mushroom is off the hook?" and the URL is turned in to a "slug" like example.com/mushroom-off-the-hook/ Here is an example of the Django framework's "slugify" https://github.com/django/django/blob/master/django/utils/text.py#L403 https://github.com/django/django/blob/master/django/utils/te...

apeacox 9y ago

But gmail doesn’t make any differences between user.name and username.

nolok 9y ago
Why would this be relevant? What I do with one field in one of my product for one set of reasons has very little to do with what I do with another field entirely, in another product entirely, for a whole other set of reasons...
ovao 9y ago
By design. It isn’t accidental.

deleted 9y ago

[deleted]

pasbesoin 9y ago

Recently, I went to install the Amazon Kindle app onto my new phone. From the Google Play store. It all looked good, except for the strangeness of an individual's name listed as the name for the street address and contact information for the app. That was something I did not recall from previous visits to the app in the Google app store. So, the Kindle app's not on my new phone. Because the validation portion of curation is, ultimately, left up to the individual. And I didn't have time to go chasing around the Web making sure I was hitting the correct/official app store page. I probably was. But I've been well-trained to "pause and check" on such details. P.S. I now recall, causing further hesitation, the "other apps" sections of the search results and/or Kindle app page, included an Amazon Video app. And that app had the same name listed in its details. Now, the last I recall, Amazon Video was specifically NOT available in the Google app store. Forcing people on non-Amazon devices who wanted to use it, to have to add the Amazon app store and adjust permissions to allow installing apps from it. At least, temporarily; once you had that or whatever app you wanted from Amazon, you could then adjust your devices settings back to their defaults. Unless/until you wanted to pull an update to such an app -- then, rinse and repeat. So... I see a weird bit of contact information. And I see it also for an app that prior experience taught me was not available in the Google app store... And, with repeated stories like the OP, I can't trust the Google app store to be well-curated. What else can I say? Meh...

kuschku 9y ago
That’s interesting. All of them have "Suhail Mirza, 500 9th Avenue N, Seattle, WA 98109" listed as author. But they are the real apps: https://play.google.com/store/apps/developer?id=Amazon+Mobile+LLC https://play.google.com/store/apps/developer?id=Amazon+Mobil... That person’s LinkedIn profile claims "I own Engineering for Amazon's Mobile Shopping iOS, Android and Windows Mobile Teams. I am looking for developers globally. Reach out if you are interested."
hesarenu 9y ago
Amazon prime video is available on play store.
- 9y ago

jwilk 9y ago

"Unicode whitespace" apparently means non-breaking space (U+00A0).

colanderman 9y ago
To which the term "Unicode whitespace" applies as equally well as it does to plain old U+0020 :)

nebulous1 9y ago

I assume the downloads were fake, thus giving Google an easy excuse to get rid of it (it's gone now). Although probably all they needed was the obvious impersonation. Unicode has a boat load of security issues. http://unicode.org/reports/tr36/ http://unicode.org/reports/tr36/

jordache 9y ago

F-ing Google

nvr219 9y ago

I seriously don't understand how people let their aging parents or young children or friends use Android phones.

colejohnson66 9y ago
Android enthusiasts who think they’re elite because "Apple sucks! Android’s has that feature for 5 years!" But not to be naïve; iOS has problems with fake apps too, just not nearly as bad as Android.
- saagarjha 9y ago
  Yes, it might, but: 1. There are fewer of these apps. 2. There's less that they can do–on Android apps can do anything and everything once installed.
  - tonyztan 9y ago
    > "on Android apps can do anything and everything once installed." Not necessarily. Modern Android devices have granular permissions, just like the iPhone. https://developer.android.com/training/permissions/requesting.html https://developer.android.com/training/permissions/requestin...
    - ClassyJacket 9y ago
      Unless this has been changed, this only occurs if the app agrees to it, making it entirely pointless. A malicious app needs only to target Android 5 and gets free reign over the phone.
      - dep_b 9y ago
        I think that means not using a newer SDK than 5, in which case the feature doesn't exist yet.
    - saagarjha 9y ago

e9 9y ago

I hope there are no fake banking apps like that...

microcolonel 9y ago

This is why even some of ASCII is a mistake, maybe we shouldn't even bother with case. Every time something like this comes about I just get more cynical about the complexity of multilingual systems, or systems with interesting typesetting routines.

jstimpfle 9y ago
ASCII is very well defined. Control characters were needed at the time (and still are today, if you're using a terminal emulator). It's easy to handle, just disallow < 32 and > 127, which are invalid or non-printable chars (but think about tab/cr/lf). Basically every font you can find can display all of the ASCII printable range without room for confusion.
colejohnson66 9y ago
What ASCII characters are a mistake? If we required all apps to only use characters in the ASCII charset (the 127 codepoint one, not the Windows-1291 "ASCII" garbage), these tricks wouldn’t work.
- irl_zebra 9y ago
  The poster said some ascii is a mistake. I’m assuming those chars that don’t translate to much/anything.
  - colejohnson66 9y ago
    Like basically anything in the 0x1 to 0x1F range?

enord 9y ago

Trust is hard. It cannot be automated, it's inherently social and demands vigilance. This is as true IRL as it is online and on "curated" federations (of software, news, contacts etc). The "killer app" for trust is one that extends our natural skepticism and social awareness, and this will _never_ be easier online than in meatspace. This is obvious when we raise our perspective from the purely technological (the "means") to the fundamentally social (the "ends"). All the automated or manual safeguards that Google could enact would never prevent people from pulling a fast one, the old switcheroo, a kansas shuffle on each other because it's just something that we do. And we will use whichever means (technology) available, in whatever way feasible. This particular example looks egregious (or ingenious, depending) for cosmetic reasons, but it's fundamentally an interaction between people however fraudulent. Google is in the business of interactions between people.

djrogers 9y ago
> All the automated or manual safeguards that Google could enact would never prevent people from pulling a fast one We don’t expect perfection, but they’ve at least gotta make it harder than the copy and paste bs that litters the Play Store. ‘It’s hard’ is the worst possible reason to do nothing.
smsm42 9y ago
Solving trust 100% is hard. Having people review apps that have names which are within a short Levenshtein distance (accounting for Unicode tricks etc.) of a popular apps' names and banning those apps, the accounts that created them and their suppliers of fake votes is not that hard, especially for a company like Google. And look at those apps' descriptions, they are complete baloney, and any two-bit text classifier which a capable intern can mock up together in a weekend from off-the-shelf components can recognize that. These guys aren't even trying, and still aren't getting caught. Yes, it may require some monetary investment, but we're talking about $700bn company. They could afford it if they wanted to. If they are not doing it, that means they do not want to.
- enord 9y ago
  Of course, in hindsight you "only" have to calculate the Levehnstein distance between any product name and _all other_ product names on the store. That scales well. In order to close one single avenue for fraudulent advertisement. Maybe it's a big one, and maybe the cost is recouped through improved customer relations. Maybe. And maybe they implement this, and calculate hundreds of millions (billions?) of Levehnstein distances every day, but the next day someone publishes the same app but with a germanized name ("Was ist App Update") and fools a couple'o hundred thousand germans. Now the solution is obvious, run the names through Google Translate for ALL languages and calculate the respective levehnstein distances! I'ts foolproof! Shame on you google for not doing it already! Simply irresponsible.

shpx 9y ago

Here are three fake uBlock Origins that have over 4 million users between them https://chrome.google.com/webstore/detail/ublock-plus/kjagjnchnnlgiafjjlahaedeagnmhefi?hl=en-US https://chrome.google.com/webstore/detail/ublock-plus/kjagjn... https://chrome.google.com/webstore/detail/ublock-adblock-plus/fdecnmmdccnkogcidionikojplkjfgie?hl=en-US https://chrome.google.com/webstore/detail/ublock-adblock-plu... https://chrome.google.com/webstore/detail/ublock-adblocker-plus/pnhflmgomffaphmnbcogleagmloijbkd?hl=en-US https://chrome.google.com/webstore/detail/ublock-adblocker-p... The last two are exploiting the fact that uBlock Origin doesn't come up when you search "adblock". There's tons more, just look through the search results for "adblock" https://chrome.google.com/webstore/search/adblock?hl=en-US&_category=extensions https://chrome.google.com/webstore/search/adblock?hl=en-US&_... and results for "ublock" https://chrome.google.com/webstore/search/ublock?hl=en-US&_category=extensions https://chrome.google.com/webstore/search/ublock?hl=en-US&_c... Note that firefox doesn't have this problem (tons of adblockers, maybe some are fake, but none pretending to be uBlock Origin) https://addons.mozilla.org/en-US/firefox/search/?platform=mac&q=ublock https://addons.mozilla.org/en-US/firefox/search/?platform=ma... maybe has something to do with the fact that they show usage numbers on the results page.

md67 9y ago
I just use the host file to block stuff. There are enough crowd sourced github lists out there that relying on a thirdparty browser extension that is doing god knows what, controlled by god knows who just doesn't make sense. The rest of the family has been trained to update their files. Update it every two months
- orf 9y ago
  That's great until you need to selectively disable it for a single (poorly coded) site.
  - dredmorbius 9y ago
    There are many other problems with the concept, though of this one: High-level blocks (domains, TLDs) can be bypassed using, say, dnsmasq, by providing specific pass-throughs. As for sites that use widely-blocked services: the message is to feed back to them and tell them not to do that. The fact of countermeasures does not mean that there will be no collateral damage. In fact, that's kind of precisely the situation that got us into this mess in the first place: putatively legitimate advertising that isn't.

fiatjaf 9y ago

Apparently a-z0-9 usernames work better than these full business names. It would be much harder to fake a github.com/whatsapp account than it is to fake "WhatsApp Inc.". Besides the invisible codepoints, one would easily do "WhatsApp Inc", "WhatsApp Messenger Inc.", "WhatsApp IM" and so on.

Waterluvian 9y ago

Take the top apps and automatically raise a list of apps with similar names each week. Pay someone to investigate and flag if necessary. I feel like there's a general unwillingness in some realms to do anything at all if the solution is "manual labor until a better tool is available."

nitely 9y ago
Or don't allow apps with similar name than a popular one in the first place.
TylerE 9y ago
There might be legal concerns as well. I know under the DCMA safe harbor provisions that basically as soon as you start doing manual moderation you are now liable for anything that gets through.
- pvillano 9y ago
  Could you expand on that?
  - hidenotslide 9y ago
    Not an expert, but the only part I see like this is section 512(a) here: https://en.wikipedia.org/wiki/Online_Copyright_Infringement_Liability_Limitation_Act https://en.wikipedia.org/wiki/Online_Copyright_Infringement_... This seems to apply to network traffic, whereas I'd guess what to host on the Play Store would be covered by 512(c) instead. If so, the "red flags" test would seem to require at least some automated content checking. But all the above refers to copyright, rather than the trademark violation and fraud in the WhatsApp clones.
- seanhunter 9y ago
  I don't think that's true. A safe harbor can't make you liable for something, it can carve out a specific case where you are not liable. So the DCMA safe harbor could say that they are not liable if they never moderate. That would mean that by moderating they would give up their ability to claim safe harbor. It would not make them liable. Their liability would then be judged based on what they did (ie was their moderation negligent in some way).

deleted 9y ago

[deleted]

repiret 9y ago

Several years ago I read [1] a proposal for internationalized domain names from DJ Bernstein from before puny-code took hold. The key observation was that there's nothing stopping you from just using UTF-8 in the existing DNS protocols, but it included a discussion of how to treat visually indistinguishable unicode characters to prevent fraud, which is why I bring it up now: The proposal was that the TLD administrators should whitelist in non-ASCII characters and generally require that domains are either entirely ASCII or entirely in a subset of Unicode that made sense for their native languages - .ru could allow all-ASCII or all-Cyrillic, .gr could require all-ASCII or all-Greek, .de could allow ASCII plus eszett and the umlauts, and could further require normalized encoding (ü must be FC and not CC 88 75) and consider ö.de and oe.de to be collisions [2], and so on. Weird varieties of spaces, dashes, non-printing characters, accents that are only needed to type Klingon, and so on would never get whitelisted in. I've always thought that was a great idea, and its a general principal App stores could use too. (Although I realize that app stores don't have as strong a concept of a native language as most TLDs do, which makes it a bit harder) [1]: Its possible it was https://cr.yp.to/djbdns/idn.html https://cr.yp.to/djbdns/idn.html, but I'm not convinced. Maybe it was an earlier revision. [2]: In German, you spell "ö" as "oe" if you don't have an ö key. German speakers wouldn't necessarily need "ö" and "o" to be collisions.

fermienrico 9y ago
This is a horrendous idea. What's to say, 0 and o can be mixed up and ban that too? How would you handle gray areas? Determining what's fishy and what's not is not a matter of black and white. What if you have a German name and want to set up a site in India with ö.in? This idea creates more problems than it solves. Policing/banning is never a good idea. Internet freedom is way more important than phishing attemps. Let's ban everything because anything can be phished if you're smart enough.
- ta8374477 9y ago
  It is certainly not a horrendous idea; it is commonly used for serial numbers in engineering. For example a part number would have a serial number that is a subset of A-Z, skipping the easily ambiguous O,I and similar.

kornish 9y ago

For anyone curious, the name for this type of deception (using Unicode to pretend to be a known domain) is called a homoglyph attack: https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/200146-Homoglyph-Advanced-Phishing-Attacks.pdf https://www.cisco.com/c/en/us/support/docs/security/email-se...

jeisc 9y ago

How is any end user to know what is the original whatsapp?

gear54rus 9y ago

Bullshit. Just like punycode TLDs. And I say this as a guy from a cyrillic country. We invented a footgun and then promptly shot themselves with it. Instead of making everyone use safe ascii charset for IDs (domains, names like the one in the article, etc.), we go for stupid fuckton of language charsets that cause such problems. All in the name of accessiblity or whatever. And all this does it let people continue living in their language-specific bubble instead of just learning the main international language: english and living happily ever after. And now people suggest some crutches like restricting the data to some subset of unicode. Never learn.

kome 9y ago
I am happy about unicode, the benefits are well worth the few problems. Scammer will always be scammer. We have to outsmart them, that's all.
Jaxan 9y ago
I don't think it's fair to force English upon people. It's not even the most spoken language on the planet. (There is more people speaking Chinese. And also more people speaking Spanish than English.)
- gear54rus 9y ago
  Of course it's fair. Tech dominates the world, it's not about numbers, it's about being able to understand everyone using modern communication methods. Regarding china, they chose isolationist politics (just like russia lol), it's everyone else's duty to pull the blanket over to the 'everyone' side from 'china' side.

CM30 9y ago

Hang on, don't Google supposedly review apps before accepting them into the store? I mean, they apparently have both an automated system checking for rule violations and actual human staff checking every now and then: https://www.recode.net/2015/3/17/11560334/google-is-adding-manual-review-to-android-app-submission-process https://www.recode.net/2015/3/17/11560334/google-is-adding-m... So how is this stuff just waltzing past their quality control setup? That one unicode character can't really be messing up the whole system, right? If this stuff is supposedly moderated, who's actually doing the moderation here?

pfarnsworth 9y ago

I have personally and purposefully caused a lot of confusion on some sites by using Cyrillic letters that look exactly like English letters to impersonate other people. This was mainly for fun and for harmless trolling, but it's very easy to see that this could be used on any site that uses Unicode for usernames, etc. Phishing is extremely easy with this and something needs to be done otherwise no one will trust the Internet ever again, especially if someone can just "steal" Whatsapp so easily.

dep_b 9y ago

At least now it's easier to explain to customers why they have to get a DUNS to have apps under their company name in the App Store while the Play Store just allows it.

gaius 9y ago

I wish for security and simplicity there was a way to disable everything but 7-bit ASCII. Like, who actually thought that having identical characters for different things made any sense ??