8 ms·
Out of all the Android vulnerabilities so far, and out of all the devices that are not running an up-to-date versions of Android, what's your theory as to why w
by r3bl 9y ago
Out of all the Android vulnerabilities so far, and out of all the devices that are not running an up-to-date versions of Android, what's your theory as to why we have yet to discover a large Android botnet?
- r1ch 9y agoIronically this is the one thing that the Android ecosystem fragmentation has going for it. My guess is that no one can be bothered to make reliable exploits that have all the correct offsets and addresses for who knows how many different kernels and firmwares and such. You'd think the Broadcom wifi bug would be an extremely lucrative worm target, but in reality it takes a great deal of effort to make a reliable exploit targeting a single version of a single device. Until there's a more basic bug that doesn't involve kernel addresses and exact memory layouts etc it's far more profitable for bad actors to deliver their malware via malicious .APK files that users will happily install.
- discreditable 9y agoA few reasons (imho): * No one has really tried. * Google will remove malicious apps from devices via Play Store if they spread too wide. * A phone botnet would be pretty lame for ddos, which is what botnets seem to be all about these days. Their connections are unreliable, and utilizing the botnet for more than a few hours would kill it's batteries. Phone exploits seem to be more about harvesting personal data[1], ransomware[2], and/or adware[3]. 1. http://www.zdnet.com/article/this-bank-data-stealing-android-malware-is-back-and-its-now-even-sneakier/ http://www.zdnet.com/article/this-bank-data-stealing-android... 2. http://www.zdnet.com/article/this-nasty-new-android-ransomware-encrypts-your-phone-and-changes-your-pin/ http://www.zdnet.com/article/this-nasty-new-android-ransomwa... 3. http://www.bbc.com/news/technology-31129797 http://www.bbc.com/news/technology-31129797
- MuffinFlavored 9y agoWhat are some other things botnets could be used for?
- nine_k 9y agoStealing CPU cycles for mining, password cracking, captcha solving, etc?
- discreditable 9y agoDon't forget spam!
- philsnow 9y agowhat's the one thing phones have tons of that desktops don't? sensors. lots and lots of them, and many of them don't require an explicit permission to access. if you pay the developers of a few nigh-ubiquitous mobile app dev libraries to let you phone home sensor data while their apps are on, you can probably get some really interesting novel information, and you might be able to find somebody willing to buy a dataset constructed from sensors on 50% of all smartphones.
- ta_12313i9ut0 9y agoAd fraud. Mobile video gives high CPMs.
- chatmasta 9y agoMany phones are connected to reliable WiFi for a significant percentage of the day.
- nine_k 9y agoUsing a phone for ddosing when it's charging and connected to wifi could be feasible, though, given a large enough infection rate.
- discreditable 9y agoTrue, but a better use of the phone would be to exploit the consumer router hosting the wifi and/or other IoT on the subnet and ddos with that.
- rbanffy 9y agoIt's an interesting idea. Considering phones connect to multiple wifi networks (work, home, market, coffee shop) having a set of exploits to further infect vulnerable APs would be an interesting idea. Every day I pass by a couple dozen open wifi networks.
- ufmace 9y agoFor all of the publicity about vulnerabilities, I don't remember any that are really that useful for compromising large numbers of devices. Many, including this one, require something like installing a random app from the web, which most users likely have disabled. Some require being physically close to the device. Some, like Stagefright, are easily blocked at the carrier level. I can't remember any that were like some of the Windows vulnerabilities of the bad old days, of fully owning the device just from it being on the network. The OS is a lot more locked down too, no install of non-store apps by default, and heavy restrictions on app permissions. Probably also helps that since they're phones, anything doing the usual botnet activities would result in rapid battery death and the user getting their phone fixed or replaced.
- badrabbit 9y agoStagefright is one,so is the broadcom SoC exploits project zero published
- guelo 9y agoBecause Android is more secure then you've been led to believe. Google does a decent job of continually hardening the OS and ecosystem and of detecting and counteracting the spread of malware.
- s73ver_ 9y agoBut most people don't get access to that work, because their phones don't get updated.
- chickenbane 9y agoNo, most people get access to this work, despite their phones not getting updated. They get this via access to the Google Play Store. If an Android device has access to the store, Google can check and remove malware from the device. Incidentally, these checks are how Google has a pretty comprehensive view of active vulnerabilities and in devices as well as active exploits being used. The result is if a user does not enable unknown sources and only installs apps from the Play Store (the default and by far the most common configuration) they have a vanishingly small chance of being infected by malware.
- guelo 9y agoGoogle has done a ton on work extracting chunks of the OS and moving it into OTA updatable components. Google has also done tons of work on making the core OS easier for OEMs to update.
- s73ver_ 9y agoThey've done some work on some parts. There are still large chunks of the OS that can't do that. And the core OS was never that difficult to update, it's more that the OEMs had no incentive, and still have no incentive, to do so.
- pjmlp 9y agoIt has nothing to do with the OS being easier to update, rather Google not wanting to force OEMs to do so. Expect the same rate of updates with Treble certified devices.
- chickenbane 9y agoAlthough the Android ecosystem is probably the biggest OS deployment on devices right now, Google has done a pretty impressive job maintaining its overall safety. The primary mechanism they use is what they call GMS (Google Mobile Services), built on top of AOSP. GMS includes the Google Play Store, which they reported this year had 2B monthly active users. The most notable AOSP derivatives that do not run GMS are Amazon's Fire OS and whatever Chinese companies are doing. Whenever you see somebody trying to implement "Android without Google", they are (misguidedly) replacing GMS. Anyway, GMS on the device auto-updates and works with cloud services to detect and act on malware the user may have installed. This year Google branded this "Google Play Protect". Because GMS doesn't require firmware, kernel, or platform updates to work, Google is able to police the ecosystem effectively. Also, because all apps are signed by the developer and Google controls the Play Store, its also able to work with developer community to mitigate libraries / sdks that are harmful. The overall end result is harmful apps are only on 0.05% of devices that only install apps from the Play Store (the most common scenario, and the default).