6 ms·

Droppers Is How Android Malware Keeps Sneaking into the Play Store

41 points by 0xbxd 8y ago

davidhyde 8y ago
I don't have an Android phone so excuse my nativity but does Android allow an app to request more permissions AFTER it has already been installed and requested the original perms? If so, why? Additionally, if users cannot deny individual perms then they will have to make an all-or-nothing-decision about an app. Why not just allow them to disable specific perms on install and provide stubbed generic data to the app if it uses those perms?
- azthec 8y ago
  On the newer versions it generally does not ask for permissions on install but rather when they are needed, you can choose to decline, some applications might then misbehave. On older version like kitkat you are forced to accept all of the requested (and often very intrusive) permissions or not install the application at all.
  - carlmr 8y ago
    I think request upon needing the permission makes a lot of sense. After all when you do an action and it requests a permission you at least have a chance to understand why it's needed. Wouldn't it make sense to have temporary permissions? In Linux and Windows you have to sudo/admin also for one single action or a set of actions. You don't give a program access rights for eternity. Maybe I want to use some app's location service only very rarely and I fear that it has some surveillance features integrated. If I'm ok sharing my location right now, I might not be ok sharing it always. It would be good to have the ability to give it the permission once, until a system restart, or for a limited timeframe.
    - caf 8y ago
      It's not automatic, but you can revoke previously-granted permissions manually by going into Settings -> Apps & Notifications -> {App} -> Permissions.
      - carlmr 8y ago
        I know it's possible, but it completely ignores the reality how humans aren't perfect robots that don't forget or become lazy.
- annabellish 8y ago
  There have been (third party) permissions systems which do provide generic data if the permission is denied, but the modern android permission system is more just based around developers having to acknowledge that those permissions might be denied and that they should still do their best. Currently, _all_ permissions are requested in a two stage system - the app publishes which permissions it _can_ request, and any changes to that list cause updates to pause pending user acceptance, but does not actually get to use those permissions until requested in code, which flags up a specific yes/no request prompt to the user. The systems which provided generic data worked very well a lot of the time, but also some of the time would just subtly break things in a way which was not obvious for a non-technical user.
  - cornholio 8y ago
    > The systems which provided generic data worked very well a lot of the time, but also some of the time would just subtly break things in a way which was not obvious for a non-technical user. Is this available via a non-root API? There are those blackmailing applications that refuse to do their core functionality when a certain unrelated permission is denied (the hell you need my location, music streaming app!). If Android fed them generic data, they would quickly learn to detect it - but not if data is controlled by other Apps or the user himself.
    - annabellish 8y ago
      I don't believe so, integrating such a thing is a pretty big change, though I believe there are (or at least were, last I checked) systems which didn't require a full custom OS to work with.
- IChrisI 8y ago
  Requesting permissions for everything your app can possibly do at install time makes apps look scary. Here's an example. Imaging a messaging app. It needs permission to read and write to your text messages - not so bad. Maybe there's a feature where you can quick-reply from the message notification. Now it needs permission to draw over other apps. Maybe it's smart enough to not DING! during a phone call. Now it needs permission to "make and manage phone calls". Maybe there's a feature where it suggests a "here's my location" response when somebody texts you "where are you?". Now it needs permission to access your location. Contact integration? Camera integration? Access storage? These are all things that a messaging app might reasonably want to do. But seeing a big list of permissions, including things like "draw over other apps" and "make and manage phone calls" is scary to an end user. Especially for an app that's only supposed to be handling SMS.
  - amelius 8y ago
    I really hate it when I need to send a single file or photo, an app suddenly "needs access to my filesystem" and I have to grant that access. OSes should allow me to create a sandbox for an app, so I can grant them access (and the app will not "break"), while still being secure.
    - felix_nagaand 8y ago
      Your solution is too simple and intuitive.
    - duiker101 8y ago
      And then you need to app to the sandbox? Seems even more complex
      - mobilio 8y ago
        Actually isn't. And this was already implemented in iOS and Windows Mobile.
    - HappyRobot 8y ago
      I thought Android apps were sandboxed [1]. The "needs access to my file system" is the way for data to transfer into that sandbox. Android should add the option for temporary data access. I would prefer turning on the access temporarily to send 1 photo, then turning it off a few minutes later. https://developer.android.com/training/articles/security-tips https://developer.android.com/training/articles/security-tip...
- mrec 8y ago
  I picked up a cheap Android a couple of years ago to see if mobiles had become worth the hassle yet. Permissions handling was one of the big things that convinced me they hadn't. The most memorable example was trying to take a picture and the camera app telling me it needed permission to make phone calls. I still can't think of a single valid reason why a camera would need to make phone calls, so I refused, and blam, no pictures for me.
  - fengb 8y ago
    There’s an OS reason: the only way to detect if there’s an incoming or ongoing phone cal is by having full phone permissions.
  - trash_panda 8y ago
    You may find this project interesting: https://simplemobiletools.github.io/ https://simplemobiletools.github.io/
amaccuish 8y ago
I don't get why this isn't blocked. If you're updating executable code, you should have to do it via Google Play. If it's just resources, sure, go ahead, but code?
- jessaustin 8y ago
  If the app is structured as an interpreter running scripts, it seems easy to deliver another script. On other platforms (not sure about Android) similar tricks can be played with compiled libs.
  - cornholio 8y ago
    Clearly, a remote controlled interpreter should not pass the Google Play verification, but I understand how detecting it can be a hard problem.
    - atr2 8y ago
      I'm sure LOTS of applications have remote controlled interpreters.
    - KMag 8y ago
      Well, enumerating all program states is a superset of the halting problem. False positives, false negatives, and sometimes taking an infinite amount of time to get an answer: choose at least one. (Technically only true if the phone had an infinite amount of memory, but gigabytes of memory are enough to craft an input that would take well beyond the heat death of the universe to get an answer.) In other words, even if you had some algorithm could somehow look at a program state and with 100% accuracy determine if that state was the start of an interpreter main loop, there would be at least one program where you couldn't be certain that you'd run your algorithm on every program state.
      - cornholio 8y ago
        I stopped myself from typing "Halting problem" because essentially, antivirus software should not exist for the same reasons. Yet antiviruses clearly work - it's the entire premise of the article that Android is more vulnerable to droppers than classic computers running antiviruses. So the same techniques used by antiviruses, be it heuristics, signatures of known interpreters and droppers, simulated execution could be used by app stores to drastically reduce bad actors. The fundamental weakness will always be there for advanced, unique malware.
isolli 8y ago
Naive question: why is Apple iOS not affected by this?
- ocdtrekkie 8y ago
  Humans review iOS apps and their permitted functionality is fairly stringently limited, Android apps are approved and scanned by automated processes which are fairly easy to fool. (Play Protect does not rank well as an antivirus scanner according to AV-TEST.) That being said, malware does make it into the iOS store, it just requires a fair bit more effort since an actual person is going to sit there and fiddle with the app before it can be listed.
  - highesttide 8y ago
    There was a straight up jailbreak app that got through the process with a single button and all it did was apply the exploit to your phone. So I guess I wouldn't put too much faith in their reviews.
    - ocdtrekkie 8y ago
      A one-off error is certainly not shocking in the scale of what an app store processes and the fact that humans make mistakes. I would argue that on average, Apple's review process is far superior to weeding out malicious apps than Google's.
- gnomewascool 8y ago
  iOS bans loading external executable code. > 2.5.2 Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps. Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. Such apps must make the source code provided by the Application completely viewable and editable by the user. https://developer.apple.com/app-store/review/guidelines/#software-requirements https://developer.apple.com/app-store/review/guidelines/#sof... (Edit: obviously the ban is via reviewing apps in the store, not on the software level.)
sharcerer 8y ago
Can somebody tell whether this happens on iOS/macOS ? Though, I am an Android user but I would like to know.
- ccnafr 8y ago
  Rarely, and malware devs must go through various loops to load a third-party-hosted app/code on a device
  - sharcerer 8y ago
    Though, the report of apps which dupe users have been there for iOS too,much less, probably due to various factors like: low % marketshare, better vetting process as you said. How is the app-uploading mechanism different for iOS, Android? Is it too do with the fact that Android has a more open system.
a_c 8y ago
I imagine the malware distribution situation is much more prevalent in markets where google's existence is nil. Would love to know how, if any, app is reviewed in such markets (e.g china?)
theweb1 8y ago
Seems Apple ios is still the best for now, Android is seriously fued up with less security, gosh!

41 points by 0xbxd 8y ago

I don't have an Android phone so excuse my nativity but does Android allow an app to request more permissions AFTER it has already been installed and requested the original perms? If so, why? Additionally, if users cannot deny individual perms then they will have to make an all-or-nothing-decision about an app. Why not just allow them to disable specific perms on install and provide stubbed generic data to the app if it uses those perms?

azthec 8y ago
On the newer versions it generally does not ask for permissions on install but rather when they are needed, you can choose to decline, some applications might then misbehave. On older version like kitkat you are forced to accept all of the requested (and often very intrusive) permissions or not install the application at all.
- carlmr 8y ago
  I think request upon needing the permission makes a lot of sense. After all when you do an action and it requests a permission you at least have a chance to understand why it's needed. Wouldn't it make sense to have temporary permissions? In Linux and Windows you have to sudo/admin also for one single action or a set of actions. You don't give a program access rights for eternity. Maybe I want to use some app's location service only very rarely and I fear that it has some surveillance features integrated. If I'm ok sharing my location right now, I might not be ok sharing it always. It would be good to have the ability to give it the permission once, until a system restart, or for a limited timeframe.
  - caf 8y ago
    It's not automatic, but you can revoke previously-granted permissions manually by going into Settings -> Apps & Notifications -> {App} -> Permissions.
    - carlmr 8y ago
      I know it's possible, but it completely ignores the reality how humans aren't perfect robots that don't forget or become lazy.
annabellish 8y ago
There have been (third party) permissions systems which do provide generic data if the permission is denied, but the modern android permission system is more just based around developers having to acknowledge that those permissions might be denied and that they should still do their best. Currently, _all_ permissions are requested in a two stage system - the app publishes which permissions it _can_ request, and any changes to that list cause updates to pause pending user acceptance, but does not actually get to use those permissions until requested in code, which flags up a specific yes/no request prompt to the user. The systems which provided generic data worked very well a lot of the time, but also some of the time would just subtly break things in a way which was not obvious for a non-technical user.
- cornholio 8y ago
  > The systems which provided generic data worked very well a lot of the time, but also some of the time would just subtly break things in a way which was not obvious for a non-technical user. Is this available via a non-root API? There are those blackmailing applications that refuse to do their core functionality when a certain unrelated permission is denied (the hell you need my location, music streaming app!). If Android fed them generic data, they would quickly learn to detect it - but not if data is controlled by other Apps or the user himself.
  - annabellish 8y ago
    I don't believe so, integrating such a thing is a pretty big change, though I believe there are (or at least were, last I checked) systems which didn't require a full custom OS to work with.
IChrisI 8y ago
Requesting permissions for everything your app can possibly do at install time makes apps look scary. Here's an example. Imaging a messaging app. It needs permission to read and write to your text messages - not so bad. Maybe there's a feature where you can quick-reply from the message notification. Now it needs permission to draw over other apps. Maybe it's smart enough to not DING! during a phone call. Now it needs permission to "make and manage phone calls". Maybe there's a feature where it suggests a "here's my location" response when somebody texts you "where are you?". Now it needs permission to access your location. Contact integration? Camera integration? Access storage? These are all things that a messaging app might reasonably want to do. But seeing a big list of permissions, including things like "draw over other apps" and "make and manage phone calls" is scary to an end user. Especially for an app that's only supposed to be handling SMS.
- amelius 8y ago
  I really hate it when I need to send a single file or photo, an app suddenly "needs access to my filesystem" and I have to grant that access. OSes should allow me to create a sandbox for an app, so I can grant them access (and the app will not "break"), while still being secure.
  - felix_nagaand 8y ago
    Your solution is too simple and intuitive.
  - duiker101 8y ago
    And then you need to app to the sandbox? Seems even more complex
    - mobilio 8y ago
      Actually isn't. And this was already implemented in iOS and Windows Mobile.
  - HappyRobot 8y ago
    I thought Android apps were sandboxed [1]. The "needs access to my file system" is the way for data to transfer into that sandbox. Android should add the option for temporary data access. I would prefer turning on the access temporarily to send 1 photo, then turning it off a few minutes later. https://developer.android.com/training/articles/security-tips https://developer.android.com/training/articles/security-tip...
mrec 8y ago
I picked up a cheap Android a couple of years ago to see if mobiles had become worth the hassle yet. Permissions handling was one of the big things that convinced me they hadn't. The most memorable example was trying to take a picture and the camera app telling me it needed permission to make phone calls. I still can't think of a single valid reason why a camera would need to make phone calls, so I refused, and blam, no pictures for me.
- fengb 8y ago
  There’s an OS reason: the only way to detect if there’s an incoming or ongoing phone cal is by having full phone permissions.
- trash_panda 8y ago
  You may find this project interesting: https://simplemobiletools.github.io/ https://simplemobiletools.github.io/

amaccuish 8y ago

I don't get why this isn't blocked. If you're updating executable code, you should have to do it via Google Play. If it's just resources, sure, go ahead, but code?

jessaustin 8y ago
If the app is structured as an interpreter running scripts, it seems easy to deliver another script. On other platforms (not sure about Android) similar tricks can be played with compiled libs.
- cornholio 8y ago
  Clearly, a remote controlled interpreter should not pass the Google Play verification, but I understand how detecting it can be a hard problem.
  - atr2 8y ago
    I'm sure LOTS of applications have remote controlled interpreters.
  - KMag 8y ago
    Well, enumerating all program states is a superset of the halting problem. False positives, false negatives, and sometimes taking an infinite amount of time to get an answer: choose at least one. (Technically only true if the phone had an infinite amount of memory, but gigabytes of memory are enough to craft an input that would take well beyond the heat death of the universe to get an answer.) In other words, even if you had some algorithm could somehow look at a program state and with 100% accuracy determine if that state was the start of an interpreter main loop, there would be at least one program where you couldn't be certain that you'd run your algorithm on every program state.
    - cornholio 8y ago
      I stopped myself from typing "Halting problem" because essentially, antivirus software should not exist for the same reasons. Yet antiviruses clearly work - it's the entire premise of the article that Android is more vulnerable to droppers than classic computers running antiviruses. So the same techniques used by antiviruses, be it heuristics, signatures of known interpreters and droppers, simulated execution could be used by app stores to drastically reduce bad actors. The fundamental weakness will always be there for advanced, unique malware.

isolli 8y ago

Naive question: why is Apple iOS not affected by this?

ocdtrekkie 8y ago
Humans review iOS apps and their permitted functionality is fairly stringently limited, Android apps are approved and scanned by automated processes which are fairly easy to fool. (Play Protect does not rank well as an antivirus scanner according to AV-TEST.) That being said, malware does make it into the iOS store, it just requires a fair bit more effort since an actual person is going to sit there and fiddle with the app before it can be listed.
- highesttide 8y ago
  There was a straight up jailbreak app that got through the process with a single button and all it did was apply the exploit to your phone. So I guess I wouldn't put too much faith in their reviews.
  - ocdtrekkie 8y ago
    A one-off error is certainly not shocking in the scale of what an app store processes and the fact that humans make mistakes. I would argue that on average, Apple's review process is far superior to weeding out malicious apps than Google's.
gnomewascool 8y ago
iOS bans loading external executable code. > 2.5.2 Apps should be self-contained in their bundles, and may not read or write data outside the designated container area, nor may they download, install, or execute code which introduces or changes features or functionality of the app, including other apps. Educational apps designed to teach, develop, or allow students to test executable code may, in limited circumstances, download code provided that such code is not used for other purposes. Such apps must make the source code provided by the Application completely viewable and editable by the user. https://developer.apple.com/app-store/review/guidelines/#software-requirements https://developer.apple.com/app-store/review/guidelines/#sof... (Edit: obviously the ban is via reviewing apps in the store, not on the software level.)

sharcerer 8y ago

Can somebody tell whether this happens on iOS/macOS ? Though, I am an Android user but I would like to know.

ccnafr 8y ago
Rarely, and malware devs must go through various loops to load a third-party-hosted app/code on a device
- sharcerer 8y ago
  Though, the report of apps which dupe users have been there for iOS too,much less, probably due to various factors like: low % marketshare, better vetting process as you said. How is the app-uploading mechanism different for iOS, Android? Is it too do with the fact that Android has a more open system.

a_c 8y ago

I imagine the malware distribution situation is much more prevalent in markets where google's existence is nil. Would love to know how, if any, app is reviewed in such markets (e.g china?)

theweb1 8y ago

Seems Apple ios is still the best for now, Android is seriously fued up with less security, gosh!