3 ms·

I don't get why this isn't blocked. If you're updating executable code, you should have to do it via Google Play. If it's just resources, sure, go ahead, but co

I don't get why this isn't blocked. If you're updating executable code, you should have to do it via Google Play. If it's just resources, sure, go ahead, but code?

jessaustin 8y ago
If the app is structured as an interpreter running scripts, it seems easy to deliver another script. On other platforms (not sure about Android) similar tricks can be played with compiled libs.
- cornholio 8y ago
  Clearly, a remote controlled interpreter should not pass the Google Play verification, but I understand how detecting it can be a hard problem.
  - atr2 8y ago
    I'm sure LOTS of applications have remote controlled interpreters.
  - KMag 8y ago
    Well, enumerating all program states is a superset of the halting problem. False positives, false negatives, and sometimes taking an infinite amount of time to get an answer: choose at least one. (Technically only true if the phone had an infinite amount of memory, but gigabytes of memory are enough to craft an input that would take well beyond the heat death of the universe to get an answer.) In other words, even if you had some algorithm could somehow look at a program state and with 100% accuracy determine if that state was the start of an interpreter main loop, there would be at least one program where you couldn't be certain that you'd run your algorithm on every program state.
    - cornholio 8y ago
      I stopped myself from typing "Halting problem" because essentially, antivirus software should not exist for the same reasons. Yet antiviruses clearly work - it's the entire premise of the article that Android is more vulnerable to droppers than classic computers running antiviruses. So the same techniques used by antiviruses, be it heuristics, signatures of known interpreters and droppers, simulated execution could be used by app stores to drastically reduce bad actors. The fundamental weakness will always be there for advanced, unique malware.
      - jessaustin 8y ago
        AV itself is much less effective than many people believe. That's true in general, and this case is no exception. The conclusion of TFA: "Interestingly enough, we have also observed that most AV's also failed in detecting the dropper campaigns (sometimes for years), meaning that some awareness needs to be raised on the topic,"
gnomewascool 8y ago
I think that iOS does block this.[0] Unfortunately, preventing loading executable code on Android would break many useful apps (e.g. Termux[1]). Also, arguably, it would mean that third-party browsers couldn't exist, since javascript is code, after all (iOS doesn't have this problem, as no third-party browser engines are permitted — all browsers are just skins over Safari). OTOH, perhaps there could be a "permission-like"[2] flag on Android where an app would have to declare that it loads external executable code. Apps that did not use this flag, but were detected as updating executable code (even if not malicious), would be banned from Google Play. Diligent users could then check whether an app used this flag, if it seemed as if it shouldn't need it and be careful. [0] https://developer.apple.com/app-store/review/guidelines/#software-requirements https://developer.apple.com/app-store/review/guidelines/#sof... (§2.5.2) [1] https://termux.com/ https://termux.com/ [2] it wouldn't be an actual OS permission, just informational

I don't get why this isn't blocked. If you're updating executable code, you should have to do it via Google Play. If it's just resources, sure, go ahead, but code?

jessaustin 8y ago

If the app is structured as an interpreter running scripts, it seems easy to deliver another script. On other platforms (not sure about Android) similar tricks can be played with compiled libs.

cornholio 8y ago
Clearly, a remote controlled interpreter should not pass the Google Play verification, but I understand how detecting it can be a hard problem.
- atr2 8y ago
  I'm sure LOTS of applications have remote controlled interpreters.
- KMag 8y ago
  Well, enumerating all program states is a superset of the halting problem. False positives, false negatives, and sometimes taking an infinite amount of time to get an answer: choose at least one. (Technically only true if the phone had an infinite amount of memory, but gigabytes of memory are enough to craft an input that would take well beyond the heat death of the universe to get an answer.) In other words, even if you had some algorithm could somehow look at a program state and with 100% accuracy determine if that state was the start of an interpreter main loop, there would be at least one program where you couldn't be certain that you'd run your algorithm on every program state.
  - cornholio 8y ago
    I stopped myself from typing "Halting problem" because essentially, antivirus software should not exist for the same reasons. Yet antiviruses clearly work - it's the entire premise of the article that Android is more vulnerable to droppers than classic computers running antiviruses. So the same techniques used by antiviruses, be it heuristics, signatures of known interpreters and droppers, simulated execution could be used by app stores to drastically reduce bad actors. The fundamental weakness will always be there for advanced, unique malware.
    - jessaustin 8y ago
      AV itself is much less effective than many people believe. That's true in general, and this case is no exception. The conclusion of TFA: "Interestingly enough, we have also observed that most AV's also failed in detecting the dropper campaigns (sometimes for years), meaning that some awareness needs to be raised on the topic,"

gnomewascool 8y ago

I think that iOS does block this.[0] Unfortunately, preventing loading executable code on Android would break many useful apps (e.g. Termux[1]). Also, arguably, it would mean that third-party browsers couldn't exist, since javascript is code, after all (iOS doesn't have this problem, as no third-party browser engines are permitted — all browsers are just skins over Safari). OTOH, perhaps there could be a "permission-like"[2] flag on Android where an app would have to declare that it loads external executable code. Apps that did not use this flag, but were detected as updating executable code (even if not malicious), would be banned from Google Play. Diligent users could then check whether an app used this flag, if it seemed as if it shouldn't need it and be careful. [0] https://developer.apple.com/app-store/review/guidelines/#software-requirements https://developer.apple.com/app-store/review/guidelines/#sof... (§2.5.2) [1] https://termux.com/ https://termux.com/ [2] it wouldn't be an actual OS permission, just informational