6 ms·

So what exactly did this malware do most of the time? In the original kaspersky report it says "For example, an app with this malicious code may show intrusive

So what exactly did this malware do most of the time? In the original kaspersky report it says "For example, an app with this malicious code may show intrusive ads and sign users up for paid subscriptions.". So how/did it sign up users for paid subscriptions without user interaction? Does android allow something like that? Aren't all apps sandboxed? In general how is the android sandboxing and permission system nowadays? I'm considering switching back to it from iOS, but reports like this are kinda discouraging.

panpanna 7y ago
I don't know this particular case, but "malware" seems to be used to describe "adware" these days by some blogs to generate more clicks. Android is just as secure/unsecure as iOS. Some recent "malware" campaigns targeted both platforms but in general Apple silently removes them while Android gets scrutinized to death. Edit: to answer your questions, these apps still operate within the limits of the sandbox. Which is maybe a reason the term "malware" should not be used.
- scarface74 7y ago
  This is clearly not the case. Not only is Android’s permission system more permissive, most Android phones don’t get updates as frequently and definitely not as far long as iOS.
  - lern_too_spel 7y ago
    > most Android phones don’t get updates as frequently and definitely not as far long as iOS. This is irrelevant. Most phones period don't get updates frequently. Does that mean you shouldn't buy any phone? No, you should buy a phone that does get updated, and there are plenty of Android options.
    - scarface74 7y ago
      IOS 12 supports devices back to 2013. How many Android devices get support that far back? Apple also released an OS update in July of this year for iPhones back to the iPhone 4S from 2011. https://iphone.appleinsider.com/articles/19/07/22/apple-issues-ios-936-and-ios-1034-updates-for-older-iphone-and-ipad-models https://iphone.appleinsider.com/articles/19/07/22/apple-issu...
      - lern_too_spel 7y ago
        > How many Android devices get support that far back? Also irrelevant. Most people don't use phones that old. If they upgrade devices on a normal schedule, there are plenty of Android devices that will get updated during that time. Even better, their system apps will also get updated at an even higher frequency during that time transparently, while iOS users have to wait for an OS update and reboot their devices. This is an issue with highly vulnerable apps like iMessage and Safari.
        scarface74 7y ago
        Also irrelevant. Most people don't use phones that old. There is a vibrant official second hand market for iPhones where people sell their phones and the hand me down market. It really helps when you can still use an older device with the newest operating system. Anecdotally, my son is still using my circa 2015 iPhone 6s with the latest OS. According to many benchmarks, it was faster than high end Android phones up until 2018 and is still faster than mid tier Android phones. Also the length of time that people are keeping their phones is almost three years (https://www.vice.com/en_us/article/43ejej/study-smartphone-iphone-trade-in-age-apple-event-2018 https://www.vice.com/en_us/article/43ejej/study-smartphone-i...). That’s longer than you can get support for most Android phones. Even better, their system apps will also get updated at an even higher frequency during that time transparently, while iOS users have to wait for an OS update and reboot their devices. This is an issue with highly vulnerable apps like iMessage and Safari. Well fortunately we have statistics about how many iOS users are running the latest OS compared to Android users from the prospective companies. We know that your conjecture is probably false.
  - panpanna 7y ago
    In modern Android phones, the core system is updated one a month [if needed - which is often the case during the first year]. Android applications (including things like mail and browser) and a large part of the OS is updated immediately via the store. The permission system is being updated and apps are being rejected for bad user of permissions (check Reddit for the SMS permission stories)
    - scarface74 7y ago
      And as far as the parts of the OS that don’t get updates?
yonilevy 7y ago
This. As an iOS user / developer who isn't too familiar with Android, I also don't get it. Either these reports are lacking, and there is in fact a vulnerability being exploited down the line, or Android is completely broken. I find it odd that this important detail is being ignored in the reports/discussion.
ignoramous 7y ago
> So how/did it sign up users for paid subscriptions without user interaction? Does android allow something like that? Aren't all apps sandboxed? This sandbox isn't a VM per-se in that the apps can view and interact with other apps via various api-interfaces, sometimes with devastating consequence (like apps with storage permission scraping location information from EXIF, or apps with SMS permission scraping inbox for your financial transactions). > In general how is the android sandboxing and permission system nowadays? There's lot of confusion and most users simply grant all access. Ask-on-first-use doesn't really help with privacy, at all. iOS, I think, has it better: Grant permission only when app is in the foreground. That said, I am working on an app that'd help revoke and grant permissions automatically to apps depending on whether they're in the foreground or background; firewall apps from internet; block trackers. This isn't something you can't not do on Android today. And if you choose to root your device, there are apps like AF+ Wall, Privacy Guard (on LineageOS), XPrivacyLua (with XposedMod), NoRoot Firewall, NetGuard that are excellent offerings but sometimes feel like they're built for the power-user.

panpanna 7y ago

I don't know this particular case, but "malware" seems to be used to describe "adware" these days by some blogs to generate more clicks. Android is just as secure/unsecure as iOS. Some recent "malware" campaigns targeted both platforms but in general Apple silently removes them while Android gets scrutinized to death. Edit: to answer your questions, these apps still operate within the limits of the sandbox. Which is maybe a reason the term "malware" should not be used.

scarface74 7y ago
This is clearly not the case. Not only is Android’s permission system more permissive, most Android phones don’t get updates as frequently and definitely not as far long as iOS.
- lern_too_spel 7y ago
  > most Android phones don’t get updates as frequently and definitely not as far long as iOS. This is irrelevant. Most phones period don't get updates frequently. Does that mean you shouldn't buy any phone? No, you should buy a phone that does get updated, and there are plenty of Android options.
  - scarface74 7y ago
    IOS 12 supports devices back to 2013. How many Android devices get support that far back? Apple also released an OS update in July of this year for iPhones back to the iPhone 4S from 2011. https://iphone.appleinsider.com/articles/19/07/22/apple-issues-ios-936-and-ios-1034-updates-for-older-iphone-and-ipad-models https://iphone.appleinsider.com/articles/19/07/22/apple-issu...
    - lern_too_spel 7y ago
      > How many Android devices get support that far back? Also irrelevant. Most people don't use phones that old. If they upgrade devices on a normal schedule, there are plenty of Android devices that will get updated during that time. Even better, their system apps will also get updated at an even higher frequency during that time transparently, while iOS users have to wait for an OS update and reboot their devices. This is an issue with highly vulnerable apps like iMessage and Safari.
      - scarface74 7y ago
        Also irrelevant. Most people don't use phones that old. There is a vibrant official second hand market for iPhones where people sell their phones and the hand me down market. It really helps when you can still use an older device with the newest operating system. Anecdotally, my son is still using my circa 2015 iPhone 6s with the latest OS. According to many benchmarks, it was faster than high end Android phones up until 2018 and is still faster than mid tier Android phones. Also the length of time that people are keeping their phones is almost three years (https://www.vice.com/en_us/article/43ejej/study-smartphone-iphone-trade-in-age-apple-event-2018 https://www.vice.com/en_us/article/43ejej/study-smartphone-i...). That’s longer than you can get support for most Android phones. Even better, their system apps will also get updated at an even higher frequency during that time transparently, while iOS users have to wait for an OS update and reboot their devices. This is an issue with highly vulnerable apps like iMessage and Safari. Well fortunately we have statistics about how many iOS users are running the latest OS compared to Android users from the prospective companies. We know that your conjecture is probably false.
- panpanna 7y ago
  In modern Android phones, the core system is updated one a month [if needed - which is often the case during the first year]. Android applications (including things like mail and browser) and a large part of the OS is updated immediately via the store. The permission system is being updated and apps are being rejected for bad user of permissions (check Reddit for the SMS permission stories)
  - scarface74 7y ago
    And as far as the parts of the OS that don’t get updates?

yonilevy 7y ago

This. As an iOS user / developer who isn't too familiar with Android, I also don't get it. Either these reports are lacking, and there is in fact a vulnerability being exploited down the line, or Android is completely broken. I find it odd that this important detail is being ignored in the reports/discussion.

ignoramous 7y ago

> So how/did it sign up users for paid subscriptions without user interaction? Does android allow something like that? Aren't all apps sandboxed? This sandbox isn't a VM per-se in that the apps can view and interact with other apps via various api-interfaces, sometimes with devastating consequence (like apps with storage permission scraping location information from EXIF, or apps with SMS permission scraping inbox for your financial transactions). > In general how is the android sandboxing and permission system nowadays? There's lot of confusion and most users simply grant all access. Ask-on-first-use doesn't really help with privacy, at all. iOS, I think, has it better: Grant permission only when app is in the foreground. That said, I am working on an app that'd help revoke and grant permissions automatically to apps depending on whether they're in the foreground or background; firewall apps from internet; block trackers. This isn't something you can't not do on Android today. And if you choose to root your device, there are apps like AF+ Wall, Privacy Guard (on LineageOS), XPrivacyLua (with XposedMod), NoRoot Firewall, NetGuard that are excellent offerings but sometimes feel like they're built for the power-user.