4 ms·

Android Spyware Can Record Almost Anything on Infected Devices

35 points by hackwarenews 8y ago

dopamean 8y ago
The phones we carry around freak me out a lot when I think about what they can do. In many ways they really are a worst case scenario when it comes to privacy. I once heard someone use the term "Little Brother" to describe our smartphones and their respective corporate owners. So yeah, this malware can record almost anything. That's sort of a feature of these devices. They're built to record almost anything. edit: I fixed a typo
- prolikewh0a 8y ago
  Why is there no open source alternative to Android or iOS?
  - amaccuish 8y ago
    There is, it's called AOSP
  - Grazester 8y ago
    Android is open source?? You can compile it however you want and dont even have to use Google services.
    - Avamander 8y ago
      By that logic so is ChromeOS. Point being, Android without any closed-source/google components is rather useless.
      - Grazester 8y ago
        Android is perfectly usable without the Google services. It may not be as polished and of course apps that depend on Google services may not play nice with the drop in replacement but its not like your smart phone suddenly becomes a dumb phone.
        foepys 8y ago
        While that's true, you are losing one of the most critical components of Android. Not the Play Store but Firebase Cloud Messaging. It's not part of AOSP and so deeply integrated into Android that removing it cripples a lot of apps. Replicating FCM's functionality inside apps leads to a significant increase in battery drain.
        amaccuish 8y ago
        Take a look at microg. I use it, it supports FCM. Ok so I'm still using Google to some extent, but the amount of information they get out me is vastly reduced and similar to Apple.
        Boulth 8y ago
        > Replicating FCM's functionality inside apps leads to a significant increase in battery drain. Are there any tests that can be referenced on this subject? I've heard a completely different story from people that run Conversations (XMPP client) without FCM. They claim the battery drain is minimal. (it may depend on the messanger usage)
magnetic 8y ago
The scary thing about this is that, while you may have a good "security hygiene" around your devices, you have no control over others who you socialize with. It's a bit like ending on Facebook even though you have no account: someone posted a picture of you, you got tagged, and now you exist in FB. All it takes is one person with an infected phone to show up around a table of a private event/conversation and, through no fault of your own, you get recorded. The moral of the story (that I've been trying to follow for a few years now, quite unsuccessfully I must add), is that if you want a private conversation with someone (or a group of people), you need to keep all devices away. On the bright side, it has taught me to be very diplomatic in my discussions with others. My default behavior (when I don't slip) is to assume that whatever I say could become public somehow.
- hackwarenews 8y ago
  Interesting view! I was actually experimenting for almost 3 weeks in a row to try a strict "diet" where my smartphone would mostly rely on sms/call and all other social apps(including whatsapp) removed and wifi off 90% of the time. Many of my friends sms-ed me after the cutoff day ( i did gave 2 weeks notice on all social media to my friends) asking if I am ok, what happened? Withdrawal syndrome? Well I failed miserably to stick to my goal ( 12 months of phone diet) so after 21 days aaand.. i was back. When running my whatsapp backup ... here it is 100k messages restored. At first I was thinking it should be a whatsapp bug... how i could have 100k msgs haha As they say " Anything you say may be used against you in a court of law. You have the right to consult an attorney , but we already got your whatsapp backup " Anyone tried the low wifi diet?
srcmap 8y ago
On Windows, I can use ProcessExploror + TotalVirus to check every single running app's exe, dll Signatures against 60+ virus scanner's databases. https://www.youtube.com/watch?v=RnPtuTbqzd4 https://www.youtube.com/watch?v=RnPtuTbqzd4 It is not perfect but give me a lot of comfort about all the running app, .dll files in my system. It helped me easily detect my kid's game machines of some internet drive by download issues before and work very well to remove those apps/files. I really wish Google can create something similar for Android. Love to see something similar for iOS, OSX also.
- wpietri 8y ago
  Is it odd to others that after decades of Windows security nightmares we seem to have basically replicated the issue on an entirely new platform? I get that it's a fundamentally hard problem. But I can't shake this feeling that we maybe missed an opportunity to do better with the fresh start that mobile OSes represent.

35 points by hackwarenews 8y ago

The phones we carry around freak me out a lot when I think about what they can do. In many ways they really are a worst case scenario when it comes to privacy. I once heard someone use the term "Little Brother" to describe our smartphones and their respective corporate owners. So yeah, this malware can record almost anything. That's sort of a feature of these devices. They're built to record almost anything. edit: I fixed a typo

prolikewh0a 8y ago
Why is there no open source alternative to Android or iOS?
- amaccuish 8y ago
  There is, it's called AOSP
- Grazester 8y ago
  Android is open source?? You can compile it however you want and dont even have to use Google services.
  - Avamander 8y ago
    By that logic so is ChromeOS. Point being, Android without any closed-source/google components is rather useless.
    - Grazester 8y ago
      Android is perfectly usable without the Google services. It may not be as polished and of course apps that depend on Google services may not play nice with the drop in replacement but its not like your smart phone suddenly becomes a dumb phone.
      - foepys 8y ago
        While that's true, you are losing one of the most critical components of Android. Not the Play Store but Firebase Cloud Messaging. It's not part of AOSP and so deeply integrated into Android that removing it cripples a lot of apps. Replicating FCM's functionality inside apps leads to a significant increase in battery drain.
        amaccuish 8y ago
        Take a look at microg. I use it, it supports FCM. Ok so I'm still using Google to some extent, but the amount of information they get out me is vastly reduced and similar to Apple.
        Boulth 8y ago
        > Replicating FCM's functionality inside apps leads to a significant increase in battery drain. Are there any tests that can be referenced on this subject? I've heard a completely different story from people that run Conversations (XMPP client) without FCM. They claim the battery drain is minimal. (it may depend on the messanger usage)

magnetic 8y ago

The scary thing about this is that, while you may have a good "security hygiene" around your devices, you have no control over others who you socialize with. It's a bit like ending on Facebook even though you have no account: someone posted a picture of you, you got tagged, and now you exist in FB. All it takes is one person with an infected phone to show up around a table of a private event/conversation and, through no fault of your own, you get recorded. The moral of the story (that I've been trying to follow for a few years now, quite unsuccessfully I must add), is that if you want a private conversation with someone (or a group of people), you need to keep all devices away. On the bright side, it has taught me to be very diplomatic in my discussions with others. My default behavior (when I don't slip) is to assume that whatever I say could become public somehow.

hackwarenews 8y ago
Interesting view! I was actually experimenting for almost 3 weeks in a row to try a strict "diet" where my smartphone would mostly rely on sms/call and all other social apps(including whatsapp) removed and wifi off 90% of the time. Many of my friends sms-ed me after the cutoff day ( i did gave 2 weeks notice on all social media to my friends) asking if I am ok, what happened? Withdrawal syndrome? Well I failed miserably to stick to my goal ( 12 months of phone diet) so after 21 days aaand.. i was back. When running my whatsapp backup ... here it is 100k messages restored. At first I was thinking it should be a whatsapp bug... how i could have 100k msgs haha As they say " Anything you say may be used against you in a court of law. You have the right to consult an attorney , but we already got your whatsapp backup " Anyone tried the low wifi diet?

srcmap 8y ago

On Windows, I can use ProcessExploror + TotalVirus to check every single running app's exe, dll Signatures against 60+ virus scanner's databases. https://www.youtube.com/watch?v=RnPtuTbqzd4 https://www.youtube.com/watch?v=RnPtuTbqzd4 It is not perfect but give me a lot of comfort about all the running app, .dll files in my system. It helped me easily detect my kid's game machines of some internet drive by download issues before and work very well to remove those apps/files. I really wish Google can create something similar for Android. Love to see something similar for iOS, OSX also.

wpietri 8y ago
Is it odd to others that after decades of Windows security nightmares we seem to have basically replicated the issue on an entirely new platform? I get that it's a fundamentally hard problem. But I can't shake this feeling that we maybe missed an opportunity to do better with the fresh start that mobile OSes represent.