4 ms·

'I Want to Expose Google's Mistakes': Hacker Blamed for Big Android Fraud

36 points by known 8y ago

ebg13 8y ago
> "I wanted to show the vulnerability of the Android and thought that Google would take care of security.” ... Maza-In said he didn’t contact Google. There should be criminal liability for willful negligence that clearly increases risk to others. That kind of "I never thought" mindset is so...I don't even know what word to use...antisocial? Careless?
- elliotec 8y ago
  I'd go as far as calling it malicious...
  - ribosometronome 8y ago
    Is it much different than youtubers showing how to break into locks (ex. lockpickinglawyer)?
- Jonnax 8y ago
  Seems like a lie to me. That forum he posts in seems to be a den of criminals. You don't sell crowbars to a bunch of thieves and be surprised when they use it for burglary.
- raverbashing 8y ago
  Yeah > Unlike security pros who disclose bugs in return for credit or monetary reward, Maza-In said he didn't contact Google. This guy does not have my sympathy
  - ktjfi 8y ago
    Responsible disclosure is a scam.
- BlackFly 8y ago
  Freedom of expression. We humans have created all kinds of things that get misused. The Nobel prizes were set up exactly because people were blaming Nobel for the violent use of dynamite. Let us not further hobble the spreading of ideas with political concerns about which ideas are dangerous. Blame the (mis)user, not the manufacturer and certainly not the discoverer.
  - hjk05 8y ago
    Distributing software that is intended to steal money from people is not freedom of speech.
    - BlackFly 8y ago
      Of course it is freedom of speech. The only thing that was distributed was text: an encoding of an idea. The act of using that idea to build something to defraud someone is the criminal act. Jurisdictions censor all kinds of speech, and maybe you think this kind of speech should be censored, but at least in the USA you would have to argue incitement which is a stretch. The historical example was the publishing of the PGP source code in book form to distribute it. You might consider the software to be "military grade arms" but describing to someone how to build it is just an idea. Certainly the US government might want to reign in this interpretation and might love to create a new exception, but there is no intrinsic reason for a rational individual to insist upon that interpretation.
sschueller 8y ago
"The biggest problem is that the device can install any application, get full access to the device and can be substituted for fake banking applications [that can] intercept SMS [and] manage the device. In general, everything is possible." PCs can do this too at the moment. I do not want my freedom taken away to install what I want and end up in a walled garden like ios. Next thing you can only install government approved apps... Some security risks will always exist.
- echlebek 8y ago
  But you don't interact with your bank through apps on a PC. You interact with your bank through a web browser. And if you're like most people, that's the only secure application you have installed. Android and iOS devices focus much more on bespoke applications over general browsers. The OS security models are also very different.
  - raxxorrax 8y ago
    I specifically not use my phone for bank access, since that would undermine two factor authentication in case of a compromised system. I would recommend everyone to do the same. It is one of the first things I explain to new users.
- spiderfarmer 8y ago
  I am a big proponent of "freedom to tinker", but I simultaneously believe that iOS' walled garden is the best thing about Apple's mobile devices. All not-so-savy PC and Android users I know have trouble with misleading apps and devices that slow down to a crawl because so many apps are running in the background. It's frustrating because they absolutely have nothing to gain by said freedom.
  - realusername 8y ago
    I get it but for developers, it's just a nightmare, I would like a root feature on my phone by default since I own that phone. It does not have to be a simple access, it could be to type manually 10 command lines in a prompt on the phone to get rid of the people who don't know what they are doing but it really needs to be there. > devices that slow down to a crawl because so many apps are running in the background Most of those are not even installed by the user but by the manufacturer or Google and the users are unable to get rid of them.
cosmotron 8y ago
Mods should tag this as being from 2017.
xiphias2 8y ago
Although as many people wrote he shouldn't have done this without first contacting Google, I agree that Android allows the developers too much without asking user permission. Google had many years to fix this issue, but it doesn't take it seriously.

36 points by known 8y ago

> "I wanted to show the vulnerability of the Android and thought that Google would take care of security.” ... Maza-In said he didn’t contact Google. There should be criminal liability for willful negligence that clearly increases risk to others. That kind of "I never thought" mindset is so...I don't even know what word to use...antisocial? Careless?

elliotec 8y ago
I'd go as far as calling it malicious...
- ribosometronome 8y ago
  Is it much different than youtubers showing how to break into locks (ex. lockpickinglawyer)?
Jonnax 8y ago
Seems like a lie to me. That forum he posts in seems to be a den of criminals. You don't sell crowbars to a bunch of thieves and be surprised when they use it for burglary.
raverbashing 8y ago
Yeah > Unlike security pros who disclose bugs in return for credit or monetary reward, Maza-In said he didn't contact Google. This guy does not have my sympathy
- ktjfi 8y ago
  Responsible disclosure is a scam.
BlackFly 8y ago
Freedom of expression. We humans have created all kinds of things that get misused. The Nobel prizes were set up exactly because people were blaming Nobel for the violent use of dynamite. Let us not further hobble the spreading of ideas with political concerns about which ideas are dangerous. Blame the (mis)user, not the manufacturer and certainly not the discoverer.
- hjk05 8y ago
  Distributing software that is intended to steal money from people is not freedom of speech.
  - BlackFly 8y ago
    Of course it is freedom of speech. The only thing that was distributed was text: an encoding of an idea. The act of using that idea to build something to defraud someone is the criminal act. Jurisdictions censor all kinds of speech, and maybe you think this kind of speech should be censored, but at least in the USA you would have to argue incitement which is a stretch. The historical example was the publishing of the PGP source code in book form to distribute it. You might consider the software to be "military grade arms" but describing to someone how to build it is just an idea. Certainly the US government might want to reign in this interpretation and might love to create a new exception, but there is no intrinsic reason for a rational individual to insist upon that interpretation.

sschueller 8y ago

"The biggest problem is that the device can install any application, get full access to the device and can be substituted for fake banking applications [that can] intercept SMS [and] manage the device. In general, everything is possible." PCs can do this too at the moment. I do not want my freedom taken away to install what I want and end up in a walled garden like ios. Next thing you can only install government approved apps... Some security risks will always exist.

echlebek 8y ago
But you don't interact with your bank through apps on a PC. You interact with your bank through a web browser. And if you're like most people, that's the only secure application you have installed. Android and iOS devices focus much more on bespoke applications over general browsers. The OS security models are also very different.
- raxxorrax 8y ago
  I specifically not use my phone for bank access, since that would undermine two factor authentication in case of a compromised system. I would recommend everyone to do the same. It is one of the first things I explain to new users.
spiderfarmer 8y ago
I am a big proponent of "freedom to tinker", but I simultaneously believe that iOS' walled garden is the best thing about Apple's mobile devices. All not-so-savy PC and Android users I know have trouble with misleading apps and devices that slow down to a crawl because so many apps are running in the background. It's frustrating because they absolutely have nothing to gain by said freedom.
- realusername 8y ago
  I get it but for developers, it's just a nightmare, I would like a root feature on my phone by default since I own that phone. It does not have to be a simple access, it could be to type manually 10 command lines in a prompt on the phone to get rid of the people who don't know what they are doing but it really needs to be there. > devices that slow down to a crawl because so many apps are running in the background Most of those are not even installed by the user but by the manufacturer or Google and the users are unable to get rid of them.

cosmotron 8y ago

Mods should tag this as being from 2017.

xiphias2 8y ago

Although as many people wrote he shouldn't have done this without first contacting Google, I agree that Android allows the developers too much without asking user permission. Google had many years to fix this issue, but it doesn't take it seriously.