9 ms·

The mother of all Android malware has arrived

279 points by anon1385 16y ago

JacobAldridge 16y ago
"I demand a walled garden, and I will gladly pay 30% to ensure all apps are reviewed, approved, and subject to the whims of the closed-shop store providing them." This is obviously a serious issue - as the OP notes, the double-edged sword of openness. Still, the speedy response of Google makes me feel warmer than the (not-so-common now) decidely un-speedy application process Apple put many developers through. Edit: As jevans points out in response, and others have noted in this discussion, Google's 5 minute response time might be better characterised as '1 week of sitting on their hands when the developers complained, and 1 rapid response when it went public in a loud way'. I'm feeling less warm now, and looking fondly at the non-smartphone Nokia I own which is so clearly targeted at the 11-year-old-girl's-first-phone market that it came inside a pink cardboard handbag. But has no malware.
- S_A_P 16y ago
  Would be nice to find some middle ground here for sure. Seems to me that this is only starting to become a serious issue. This also seems to be a much easier route than finding 0 day Flaws on a PC, and while most folks would think twice about installing software from the back alleys of the internet, they may not feel that way about android.(yet)
  - corin_ 16y ago
    Most HN readers might think twice on a PC, but anti-virus creators have got rich off the majority who don't think twice.
- nicpottier 16y ago
  This is probably where third party 'app stores' come in. EG, Amazon's app store or someone else's who manually picks what apps go in may become the 'trusted' source for apps. It is pretty difficult given Android's structure to have any chance of keeping the automated shipping of apps while also retaining security. Yes, you can keep adding more warnings about what apps do, but in general I don't think people read them, and you can ask for an awful lot of privileges. The great thing about Android is just how much power you have to do stuff as an app maker, but that is of course one of the main problems as well.
- jevans 16y ago
  I'm not sure I would qualify Google's response as "speedy." On the Reddit thread, the developer of the real Guitar Solo Lite claims to have been attempting to contact Google about this issue through various channels for a week with no response. http://www.reddit.com/r/Android/comments/fvepu/someone_just_ripped_off_21_popular_free_apps_from/ http://www.reddit.com/r/Android/comments/fvepu/someone_just_...
  - deleted 16y ago
    [deleted]
- sid0 16y ago
  The Apple walled garden is way more dangerous, because it's almost as easy to slip malware into your code (remember, Apple doesn't do full source code audits), and the false sense of security makes users even more complacent. It really is a perfect example of security theatre.
  - nhangen 16y ago
    I would like to see you qualify that comment with fact. Apple does not examine full source code, but they do watch network traffic and examine API calls. At least they do something.
    - sid0 16y ago
      You can slip the malware in as a timebomb. It's not exactly as easy as it is with Android or an open platform, but it is almost as easy.
      - ceejayoz 16y ago
        Why aren't we seeing it happen, then?
        joebananas 16y ago
        It's much easier to spread FUD on the internet than to actually do it.
        moe 16y ago
        How do you know it isn't already happening? Do you monitor the outgoing traffic from your cellphone?
        ceejayoz 16y ago
        > How do you know it isn't already happening? There is no evidence that it is happening, with plenty of security researchers and interested amateurs keeping their eyes open for it. There's nothing special about iOS that prevents you from discovering this sort of app behaviour that isn't present on Android.
- zmmmmm 16y ago
  > Google's 5 minute response time might be better characterised as '1 week of sitting on their hands when the developers complained, and 1 rapid response when it went public in a loud way'. To be fair, the first complaint was of copyright infringement, the second was of malware. You can hardly expect the same response time to both kinds of issues.
nailer 16y ago
This was inevitable - Google takes a laissez-faire attitude towards copyright violation on Android market, which is full of ripped-off IP - games with names and artwork belonging to other companies, rip offs of Rolex logos for clocks, etc - that I've personally reported and that have always been ignored by Google. If they don't care about the small stuff - and it seems they don't - something nastier was always going to come along. Hell if they'd bothered to notice one of the submitted apps was 'Spider Man' perhaps this would already have been averted.
- babblefrog 16y ago
  The way it is supposed to be done is with a DMCA complaint, and I don't think you can do that unless you own the IP in question. Or are you saying that they are ignoring DMCA complaints? That is a much more serious accusation.
  - nailer 16y ago
    Android Market has a 'flag' button that lets you specify, eg, that 'Wolverine' isn't anything to do with Marvel but uses Marvel characters and artwork. They ignore this and similar copyright infringement flags. You have to own the content to file a DMCA complaint.
iuguy 16y ago
Bear in mind that this is just something casting a wide net by using the android marketplace. There's enough bugs and 0day floating around in webkit as well as unpatched exploit code to take on Safari, the Android browser and Chrome at the moment. From a mail over the weekend about a pentesting exploit kit we subscribe to: This release introduces two new exploits for the webkit CSS rule deletion vulnerability. Use safari_parentstylesheet to exploit all those pesky OSX machines (fully up to date and patched) and android_parentstylesheet for anything running android 2.2 and below. Moreover, using android_hotplug you can further escalate your privileges to root. Being offsensive has never been so good! ==New Modules== o safari_parentstylesheet (Safari <= 5.0.3 64bit webkit css rule deletion vulnerability) o android_parentstylesheet (Android <= 2.2 webkit css rule deletion vulnerability) o android_hotplug (Android privilege escalation vulnerability) That's just one pentesting tool we use and that's a legitimate toolkit. Malware targeting webkit in general is on the increase, with various payloads for safari, chrome, osx, ios and android. It's still the minority by far, but it is growing. Heck, even Metasploit's getting in on the game (http://blog.metasploit.com/2011/01/mobile-device-security-and-android-file.html http://blog.metasploit.com/2011/01/mobile-device-security-an...). Incidentally if you want to see a video of the safari bug in action, you can download one from http://partners.immunityinc.com/movies/Lightning_Demo_Safari01.zip http://partners.immunityinc.com/movies/Lightning_Demo_Safari... There's also one on owning android at http://partners.immunityinc.com/movies/Lightning_Demo_Android.zip http://partners.immunityinc.com/movies/Lightning_Demo_Androi...
- mrcharles 16y ago
  I'm not sure after your paranoia inducing post anyone is going to download zip files from links you provide. Are these videos somewhere on the web in viewable form?
  - iuguy 16y ago
    If you watch the android video you'll see that a link will do the trick, not even a download. So it makes no difference really - either you trust the link or you don't. Scary, huh? I'm not aware of these vids being anywhere else but they are from the guys who make the aforementioned framework.
ssdghjyt 16y ago
Click on our website: ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ Website wholesale various fashion shoes, such as Nike, Jordan, prada, also includes the jeans, shirt, bags, hats and decoration. Personality manufacturing execution systems (Mes) clothing, Grab an eye bag coat + tide bag Air jordan(1-24)shoes $30 Handbags(Coach l v f e n d i d&g) $35 Tshirts (Polo ,ed hardy,lacoste) $15 Jean(True Religion,ed hardy,coogi) $30 Sunglasses(Oakey,coach,gucci,A r m a i n i) $15 New era cap $12 Bikini (Ed hardy,polo) $20 accept paypal and free shipping ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯
jasongullickson 16y ago
"as well as remotely removing them from user’s devices" ...well that is an interesting feature!
- daten 16y ago
  This worries me more than the malware. I don't own an e-book reader because books that I purchased could be deleted without my consent.
- dean 16y ago
  This is surprising. Does anyone know if Google can actually do this? Maybe provide a reference.
  - megablast 16y ago
    They said they could and would do it, just as Apple and Microsoft have said they could do it.
    - blub 16y ago
      Nokia can't do it, but the people don't like their Symbian UI. Those are the priorities I guess.
unwind 16y ago
I found this: "Update: holy cheeseballs, they've been pulled already! Took less than 5 minutes from first contact to pull!" utterly amazing. That goes against ... well, pretty much everything I've ever heard about Google's speed and ability to respond to humans saying something. Too bad it was over a security incident, but at least it proves that Google can react.
- trezor 16y ago
  Actually, reading the thread on the Android subreddit one of the affected developers said he filed complaints over a week ago with no reponse nor action taken. That is until it reached the (Android sub?)reddit-frontpage. Google doesn't really do as much customer-service as it does PR-management, and that seems to be the way Google usually handles these things. Very few problems are addressed before they turn into high-profile cases of bad publicity. And really: That is pretty bad. Let's not let Google-fanboyism blind us from the facts: Google is one of the worst companies on the planet when it comes to customer-service.
  - jodrellblank 16y ago
    Very few problems are addressed before they turn into high-profile cases. Really? How would you tell if that wasn't true?
    - trezor 16y ago
      Good question. If I should answer it 100% honestly, I would say I've reached that conclusion trough very unscientific means: personal experience and a possible "postive" conformational bias. Examples of this would be me having issues with Google services or applications, Googling for answers and then finding forum-posts on the Google forums discussing the problem. These posts would mainly consist of 3 things: 1. Original poster asking for advice on a problem he has. 2. Other people experiencing the same problem, stating so and in some cases offering workarounds of various quality and reliability. 3. A complete lack of response from Google's end. No confirmation that it is a known bug with or without workarounds or a confirmation that this is a bug and that it is being investigated. Nothing. These threads, when I find them, tends to be at least a year old if not more, with a staggering amount of people experiencing the same problem and all this with the issue at hand remaining unfixed. To quote a comment I read in one of those threads: "It's pretty obvious that Google doesn't listen and Google doesn't care". Moving back to your question: "How would you tell if that wasn't true?". I guess in these cases I actually wouldn't, so it is indeed a good question. But I know that for all the issues I've had, I still have them and they are still entirely unadressed by Google. Reporting problems to Google feels like showeling data into a write-only device and I can't think of any company I've dealt with which has had such a complete absence from its customers when it comes the products and services it offers. None. Things like reliable customer service is why companies likes to send their money towards Microsoft: With Microsoft you may have Microsoft-costs, Microsoft-problems and Microsoft-quirks, but there is a huge support-apparatus ready 24/7/365 to help you get your problems solved. To put it bluntly: Customer support is not a "I'm feeling lucky"-button.
ekidd 16y ago
This is an epic screwup by Google and the mobile carriers, but it's also a useful warning to Google's competitors. 1) This problem was reported to Google a week ago, through multiple channels, by one of the app vendors who got ripped off: http://www.reddit.com/r/Android/comments/fvepu/someone_just_ripped_off_21_popular_free_apps_from/ http://www.reddit.com/r/Android/comments/fvepu/someone_just_... Apparently, Google has an unofficial policy of ignoring copyright and trademark complaints, allowing lots of skeevy software to linger on the market. 2) The phone carriers are apparently very slow to patch root exploits. 3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees. But a word of warning to iOS, WebOS, and Blackberry users: 4) Although the lax behavior of Google and the carriers made this exploit easier, we'll eventually see problems like this on most mobile platforms. Apple has allowed (benign) root exploits to slip through their approval process in the past. If your phone is vulnerable enough to be rooted, it's vulnerable enough to be owned by a malicious app.
- TillE 16y ago
  > Apparently, Google has an unofficial policy of ignoring copyright and trademark complaints I have no personal experience with this, but Google makes it very clear that a DMCA notice is the appropriate action in this situation: http://www.google.com/support/bin/request.py?contact_type=lr_dmca&product=androidmarket http://www.google.com/support/bin/request.py?contact_type=lr... I've read a bunch of sob stories lately from iOS and Android app developers, and they never say they've sent a DMCA takedown notice that's gone unanswered. Under US law, this is the way to respond to copyright violations. Sending a generic complaint means very little.
  - veeti 16y ago
    He said in his comment that he sent a DMCA notice.
    - Natsu 16y ago
      Just to be clear, the guy on Reddit also said that Google responded to the DMCA notice, which counters the claim the GP was responding to, specifically the the claim that Google ignores copyright complaints. That said, it's true that they won't respond to anything except a valid DMCA notice. Anyone who sends anything else is provided with instructions on how to file a valid DMCA notice last I knew.
sigzero 16y ago
As far as I know, I was at a security conference in January, there is no code signing and no sandbox on Android. That is not a good scenario for "security".
- limmeau 16y ago
  What good is code signing if you don't know whether "Myournet" is a trustworthy source of "Hot Screaming Japanese Girls"?
- rst 16y ago
  Wrong and wrong. Sandbox overview here: http://programming4.us/mobile/1290.aspx http://programming4.us/mobile/1290.aspx Code signing is involved, to verify that particular apps have the same source, and that updates have the same source as the original app. (That's about all it's good for.) Briefly: each signing key gets its own UID on the phone. Unix file permissions are used to restrict access to files, devices, and other facilities. In some cases, kernel hacks are required to make this possible; the Android kernel only lets you open a TCP socket if you're a member of a particular group. If there's a local root exploit, you can still bypass all of this --- but the same is true on iOS.
- metageek 16y ago
  You are absolutely wrong. All apps in the Market are signed, and apps are sandboxed by running them with separate Unix userids.
  - sigzero 16y ago
    Okay I am wrong.
mariuskempe 16y ago
If someone who knows a lot about these things has a few moments to spare, I'd love if you could answer http://www.quora.com/iOS-vs-Android/What-are-the-relative-merits-of-iOSs-and-Androids-application-sandboxing-models http://www.quora.com/iOS-vs-Android/What-are-the-relative-me... on Quora.
jimrandomh 16y ago
Completely missing from both the article and the comments: the list of permissions these malicious apps requested. I'd really like to know whether they found a way around the permissions model, or if this is a case of users clicking 'OK' to a prompt that says "do you want to let this app root you?"
- limmeau 16y ago
  Apparently, the modified binaries use a local root exploit, so they probably only required enough permissions for the local root exploit to work.
- antrix 16y ago
  The apps included root exploits. The thread on the Android subreddit has lots of details.
IgorPartola 16y ago
I am for openness of the Android platform. I don't believe that a review process, like Apple's, would be beneficial. However, the Android market is not like the web. On the web, if you are selling a downloadable piece of software, and I come along and buy a copy, break your DRM and start selling it myself, you have a surefire way to get me to stop. What you can do is talk to my payment processor and tell them I am committing fraud. They don't like that, and will shut things down. While the law is fuzzy and I am innocent until you can prove I am ripping you off, the payment processor has a contract with me that says that I will not do anything illegal, and they will enforce it. Now, on the Android Market, there is effectively, only one payment processor: Google. And they have a conflict of interest, since they also own the platform. They can either police all the apps (a la Apple) or they can ignore all fraud reports. The in-between gets them into a lot of grey territory about what constitutes fraud, etc.
JonnieCache 16y ago
The fact that they're collecting IMEIs is interesting. One of the little discussed facts about smartphones is that they make it trivially easy to change the IMEI. On the Galaxy S you can simply mount the NVRAM where it is stored as r/w and change it, and any other data you want. For those who don't know the IMEI number is what physically identifies an actual handset, like a MAC address, except that the networks/authorities view it as being more of a watertight way to identify someone, as up until recently changing them has required a soldering iron. This malware's behaviour implies what I have suspected for some time, that there is a black market for IMEIs, likely being used for organised criminals to remain anonymous, or to enable the resale of stolen handsets. Anyone fancy taking a guess at what an IMEI is worth on IRC these days? CC#s are meant to be about $0.10 each aren't they?
- shareme 16y ago
  always was a blackmarket for IMEIs.. Just now its easier to make up an IMEI..but how soon before the network infrastructure rejects that new IMEI? As that would be the key if the new IMEI had blackmarket value or not..obviously you cannot have two of the IMEIs be the same on the MO network..there are also several other issues...
- peterwwillis 16y ago
  Haha, I don't know, it's always been easy to get a new IMEI. Go to one of those "cell phone support forums", advertise an unlocking service, ask for IMEI, receive in your email. With a little more work you could monetize it but botnets for CC#s are probably a lot easier, and 419's provide even more pay for the effort involved. But then again i'm not a kid in some 3rd world country looking for a quick buck so who knows, Android apps could be a really interesting proposition.
- ArtemR 16y ago
  Or it could just be that they're collecting them because they can? It's a nice unique identifier they could use.
sp332 16y ago
I saw that there was a rootkit for Android botnet C&C presented at Shmoocon. Is this a similar attack, or something different? http://www.grmn00bs.com/2011/01/30/smartphone-code-release-for-shmoocon http://www.grmn00bs.com/2011/01/30/smartphone-code-release-f... PDF: http://www.grmn00bs.com/Shmoocon2011_SmartphoneBotnets_GeorgiaW.pdf http://www.grmn00bs.com/Shmoocon2011_SmartphoneBotnets_Georg... Video: http://vimeo.com/19372118 http://vimeo.com/19372118
kilowatt 16y ago
Coincidentally, this is exactly the kind of thing Google's recent Zynamics acquisition is meant to find automatically through binary code analysis.
- zmmmmm 16y ago
  If I was google I'd have a giant server room full of VM's running android hosting every app in the app store with monitors of their state. Then you can monitor not just what the code is predicted to do but what it actually does.
Derbasti 16y ago
Never mind walled gardens, but Google could at least run some basic virus scanner before posting stuff on the market.
- dpcan 16y ago
  Smartest post on this entire thread. They clearly analyze the APK before uploading and look at the Manifest, etc, so why not do a rootkit scan of some kind.
jgroome 16y ago
I know it's probably off-topic, but would it have killed them to link to the original reddit thread? They were more than happy to copy the whole story and quote verbatim from the thread. Strikes me that a direct link would have been the polite thing to do.
ordinaryman 16y ago
For developers who need to provide mobile access to their hosted apps, this event makes it easy to decide on a path with regard to "Native apps / Web apps ?" question.
- JonnieCache 16y ago
  Except that as discussed, there are plenty of code execution flaws in mobile builds of webkit that will do just as well as any flaw in the native app API. One XSS or SQL injection vuln in your webapp and your users could be just as rooted as the victims of this malware. Exactly like in the desktop browser world.
chibea 16y ago
Actually, that the malware contained a root exploit is fixable sooner or later. The next insight will be, that even if the sandbox had worked, this type of attack still is possible by using the user's trust in the brand of a well-known app to use the permissions granted to it for malicious intents. There's no easy way to avoid that up front automatically.
jsz0 16y ago
Google needs to do something. They absolutely do not need to mimic Apple's policies or impose any radical new limitations but the current situation is starting to spiral out of control. Once this starts hitting 'normal people' it could have massive repercussions. They need to stop this before the average person fears installing software onto their device or the entire third party ecosystem is going to be stunted. When you think about the depth of personal information, location awareness, microphone, camera, etc the ramifications of this are huge. The first virus that leaks SMS messages, owns Facebook accounts, or turns on cameras to spy on people could basically end Android as a viable consumer product. Of course we've seen this all before on PCs but I think the stakes are higher these days especially with devices that are so personal and highly connected.
Estragon 16y ago
So, was there any app-scanning software capable of detecting this before the warning? I have Lookout installed on my droid, but I have always wondered at its effectiveness. It has a "there are no crocodiles, so it must be a great crocodile repellant" feel to it...
ReadyNSet 16y ago
There is one thing everyone is missing, Apple does have a process of verifying the identity of the author even if there was a malware that was slipped in it is easy to identify the author and report to authorities that in itself is a good deterrent against trying. remember malware writers want low hanging fruit first and and Android extremely ripe for it.
sedev 16y ago
I think that this illustrates a point that's worth making about the difference between Android devices and iOS devices. There is no 'better' - there is a tradeoff. This is the same tradeoff that Linux elsewhere offers, really. This is the tradeoff: "if you are willing to invest your time, mental energy, and vigilance into bending your device to your will, avoiding traps such as mention in the article, and doing upkeep, a Linux-based device will give you enormous and awesome capabilities, leveraging the full power of having a general-purpose computer in your pocket." I am glad that that's available, because for some people, that's a great tradeoff! But it's important that there be another tradeoff available, which iOS is currently the flagship of: "if you are willing to accept more limited capabilities, you can have those capabilities in a form that Just Works and does not require your vigilance, time, and mental energy." I propose that the market share of Android and iOS roughly reflect the number of people for whom each of these tradeoffs, is the one they want. Of course we may want different things at different times - but when we buy these devices, we are voting with our dollars as to which tradeoff, overall, serves us best. I hope that both retain vigorous market share, because different people are best served by different tradeoffs.

279 points by anon1385 16y ago

"I demand a walled garden, and I will gladly pay 30% to ensure all apps are reviewed, approved, and subject to the whims of the closed-shop store providing them." This is obviously a serious issue - as the OP notes, the double-edged sword of openness. Still, the speedy response of Google makes me feel warmer than the (not-so-common now) decidely un-speedy application process Apple put many developers through. Edit: As jevans points out in response, and others have noted in this discussion, Google's 5 minute response time might be better characterised as '1 week of sitting on their hands when the developers complained, and 1 rapid response when it went public in a loud way'. I'm feeling less warm now, and looking fondly at the non-smartphone Nokia I own which is so clearly targeted at the 11-year-old-girl's-first-phone market that it came inside a pink cardboard handbag. But has no malware.

S_A_P 16y ago
Would be nice to find some middle ground here for sure. Seems to me that this is only starting to become a serious issue. This also seems to be a much easier route than finding 0 day Flaws on a PC, and while most folks would think twice about installing software from the back alleys of the internet, they may not feel that way about android.(yet)
- corin_ 16y ago
  Most HN readers might think twice on a PC, but anti-virus creators have got rich off the majority who don't think twice.
nicpottier 16y ago
This is probably where third party 'app stores' come in. EG, Amazon's app store or someone else's who manually picks what apps go in may become the 'trusted' source for apps. It is pretty difficult given Android's structure to have any chance of keeping the automated shipping of apps while also retaining security. Yes, you can keep adding more warnings about what apps do, but in general I don't think people read them, and you can ask for an awful lot of privileges. The great thing about Android is just how much power you have to do stuff as an app maker, but that is of course one of the main problems as well.
jevans 16y ago
I'm not sure I would qualify Google's response as "speedy." On the Reddit thread, the developer of the real Guitar Solo Lite claims to have been attempting to contact Google about this issue through various channels for a week with no response. http://www.reddit.com/r/Android/comments/fvepu/someone_just_ripped_off_21_popular_free_apps_from/ http://www.reddit.com/r/Android/comments/fvepu/someone_just_...
- deleted 16y ago
  [deleted]
sid0 16y ago
The Apple walled garden is way more dangerous, because it's almost as easy to slip malware into your code (remember, Apple doesn't do full source code audits), and the false sense of security makes users even more complacent. It really is a perfect example of security theatre.
- nhangen 16y ago
  I would like to see you qualify that comment with fact. Apple does not examine full source code, but they do watch network traffic and examine API calls. At least they do something.
  - sid0 16y ago
    You can slip the malware in as a timebomb. It's not exactly as easy as it is with Android or an open platform, but it is almost as easy.
    - ceejayoz 16y ago
      Why aren't we seeing it happen, then?
      - joebananas 16y ago
        It's much easier to spread FUD on the internet than to actually do it.
      - moe 16y ago
        How do you know it isn't already happening? Do you monitor the outgoing traffic from your cellphone?
        ceejayoz 16y ago
        > How do you know it isn't already happening? There is no evidence that it is happening, with plenty of security researchers and interested amateurs keeping their eyes open for it. There's nothing special about iOS that prevents you from discovering this sort of app behaviour that isn't present on Android.
zmmmmm 16y ago
> Google's 5 minute response time might be better characterised as '1 week of sitting on their hands when the developers complained, and 1 rapid response when it went public in a loud way'. To be fair, the first complaint was of copyright infringement, the second was of malware. You can hardly expect the same response time to both kinds of issues.

nailer 16y ago

This was inevitable - Google takes a laissez-faire attitude towards copyright violation on Android market, which is full of ripped-off IP - games with names and artwork belonging to other companies, rip offs of Rolex logos for clocks, etc - that I've personally reported and that have always been ignored by Google. If they don't care about the small stuff - and it seems they don't - something nastier was always going to come along. Hell if they'd bothered to notice one of the submitted apps was 'Spider Man' perhaps this would already have been averted.

babblefrog 16y ago
The way it is supposed to be done is with a DMCA complaint, and I don't think you can do that unless you own the IP in question. Or are you saying that they are ignoring DMCA complaints? That is a much more serious accusation.
- nailer 16y ago
  Android Market has a 'flag' button that lets you specify, eg, that 'Wolverine' isn't anything to do with Marvel but uses Marvel characters and artwork. They ignore this and similar copyright infringement flags. You have to own the content to file a DMCA complaint.

iuguy 16y ago

Bear in mind that this is just something casting a wide net by using the android marketplace. There's enough bugs and 0day floating around in webkit as well as unpatched exploit code to take on Safari, the Android browser and Chrome at the moment. From a mail over the weekend about a pentesting exploit kit we subscribe to: This release introduces two new exploits for the webkit CSS rule deletion vulnerability. Use safari_parentstylesheet to exploit all those pesky OSX machines (fully up to date and patched) and android_parentstylesheet for anything running android 2.2 and below. Moreover, using android_hotplug you can further escalate your privileges to root. Being offsensive has never been so good! ==New Modules== o safari_parentstylesheet (Safari <= 5.0.3 64bit webkit css rule deletion vulnerability) o android_parentstylesheet (Android <= 2.2 webkit css rule deletion vulnerability) o android_hotplug (Android privilege escalation vulnerability) That's just one pentesting tool we use and that's a legitimate toolkit. Malware targeting webkit in general is on the increase, with various payloads for safari, chrome, osx, ios and android. It's still the minority by far, but it is growing. Heck, even Metasploit's getting in on the game (http://blog.metasploit.com/2011/01/mobile-device-security-and-android-file.html http://blog.metasploit.com/2011/01/mobile-device-security-an...). Incidentally if you want to see a video of the safari bug in action, you can download one from http://partners.immunityinc.com/movies/Lightning_Demo_Safari01.zip http://partners.immunityinc.com/movies/Lightning_Demo_Safari... There's also one on owning android at http://partners.immunityinc.com/movies/Lightning_Demo_Android.zip http://partners.immunityinc.com/movies/Lightning_Demo_Androi...

mrcharles 16y ago
I'm not sure after your paranoia inducing post anyone is going to download zip files from links you provide. Are these videos somewhere on the web in viewable form?
- iuguy 16y ago
  If you watch the android video you'll see that a link will do the trick, not even a download. So it makes no difference really - either you trust the link or you don't. Scary, huh? I'm not aware of these vids being anywhere else but they are from the guys who make the aforementioned framework.

ssdghjyt 16y ago

Click on our website: ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ Website wholesale various fashion shoes, such as Nike, Jordan, prada, also includes the jeans, shirt, bags, hats and decoration. Personality manufacturing execution systems (Mes) clothing, Grab an eye bag coat + tide bag Air jordan(1-24)shoes $30 Handbags(Coach l v f e n d i d&g) $35 Tshirts (Polo ,ed hardy,lacoste) $15 Jean(True Religion,ed hardy,coogi) $30 Sunglasses(Oakey,coach,gucci,A r m a i n i) $15 New era cap $12 Bikini (Ed hardy,polo) $20 accept paypal and free shipping ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯ ╭══════════════╮ http://simurl.com/voblec http://simurl.com/voblec ╰══════════════╯

jasongullickson 16y ago

"as well as remotely removing them from user’s devices" ...well that is an interesting feature!

daten 16y ago
This worries me more than the malware. I don't own an e-book reader because books that I purchased could be deleted without my consent.
dean 16y ago
This is surprising. Does anyone know if Google can actually do this? Maybe provide a reference.
- megablast 16y ago
  They said they could and would do it, just as Apple and Microsoft have said they could do it.
  - blub 16y ago
    Nokia can't do it, but the people don't like their Symbian UI. Those are the priorities I guess.

unwind 16y ago

I found this: "Update: holy cheeseballs, they've been pulled already! Took less than 5 minutes from first contact to pull!" utterly amazing. That goes against ... well, pretty much everything I've ever heard about Google's speed and ability to respond to humans saying something. Too bad it was over a security incident, but at least it proves that Google can react.

trezor 16y ago
Actually, reading the thread on the Android subreddit one of the affected developers said he filed complaints over a week ago with no reponse nor action taken. That is until it reached the (Android sub?)reddit-frontpage. Google doesn't really do as much customer-service as it does PR-management, and that seems to be the way Google usually handles these things. Very few problems are addressed before they turn into high-profile cases of bad publicity. And really: That is pretty bad. Let's not let Google-fanboyism blind us from the facts: Google is one of the worst companies on the planet when it comes to customer-service.
- jodrellblank 16y ago
  Very few problems are addressed before they turn into high-profile cases. Really? How would you tell if that wasn't true?
  - trezor 16y ago
    Good question. If I should answer it 100% honestly, I would say I've reached that conclusion trough very unscientific means: personal experience and a possible "postive" conformational bias. Examples of this would be me having issues with Google services or applications, Googling for answers and then finding forum-posts on the Google forums discussing the problem. These posts would mainly consist of 3 things: 1. Original poster asking for advice on a problem he has. 2. Other people experiencing the same problem, stating so and in some cases offering workarounds of various quality and reliability. 3. A complete lack of response from Google's end. No confirmation that it is a known bug with or without workarounds or a confirmation that this is a bug and that it is being investigated. Nothing. These threads, when I find them, tends to be at least a year old if not more, with a staggering amount of people experiencing the same problem and all this with the issue at hand remaining unfixed. To quote a comment I read in one of those threads: "It's pretty obvious that Google doesn't listen and Google doesn't care". Moving back to your question: "How would you tell if that wasn't true?". I guess in these cases I actually wouldn't, so it is indeed a good question. But I know that for all the issues I've had, I still have them and they are still entirely unadressed by Google. Reporting problems to Google feels like showeling data into a write-only device and I can't think of any company I've dealt with which has had such a complete absence from its customers when it comes the products and services it offers. None. Things like reliable customer service is why companies likes to send their money towards Microsoft: With Microsoft you may have Microsoft-costs, Microsoft-problems and Microsoft-quirks, but there is a huge support-apparatus ready 24/7/365 to help you get your problems solved. To put it bluntly: Customer support is not a "I'm feeling lucky"-button.

ekidd 16y ago

This is an epic screwup by Google and the mobile carriers, but it's also a useful warning to Google's competitors. 1) This problem was reported to Google a week ago, through multiple channels, by one of the app vendors who got ripped off: http://www.reddit.com/r/Android/comments/fvepu/someone_just_ripped_off_21_popular_free_apps_from/ http://www.reddit.com/r/Android/comments/fvepu/someone_just_... Apparently, Google has an unofficial policy of ignoring copyright and trademark complaints, allowing lots of skeevy software to linger on the market. 2) The phone carriers are apparently very slow to patch root exploits. 3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees. But a word of warning to iOS, WebOS, and Blackberry users: 4) Although the lax behavior of Google and the carriers made this exploit easier, we'll eventually see problems like this on most mobile platforms. Apple has allowed (benign) root exploits to slip through their approval process in the past. If your phone is vulnerable enough to be rooted, it's vulnerable enough to be owned by a malicious app.

TillE 16y ago
> Apparently, Google has an unofficial policy of ignoring copyright and trademark complaints I have no personal experience with this, but Google makes it very clear that a DMCA notice is the appropriate action in this situation: http://www.google.com/support/bin/request.py?contact_type=lr_dmca&product=androidmarket http://www.google.com/support/bin/request.py?contact_type=lr... I've read a bunch of sob stories lately from iOS and Android app developers, and they never say they've sent a DMCA takedown notice that's gone unanswered. Under US law, this is the way to respond to copyright violations. Sending a generic complaint means very little.
- veeti 16y ago
  He said in his comment that he sent a DMCA notice.
  - Natsu 16y ago
    Just to be clear, the guy on Reddit also said that Google responded to the DMCA notice, which counters the claim the GP was responding to, specifically the the claim that Google ignores copyright complaints. That said, it's true that they won't respond to anything except a valid DMCA notice. Anyone who sends anything else is provided with instructions on how to file a valid DMCA notice last I knew.

sigzero 16y ago

As far as I know, I was at a security conference in January, there is no code signing and no sandbox on Android. That is not a good scenario for "security".

limmeau 16y ago
What good is code signing if you don't know whether "Myournet" is a trustworthy source of "Hot Screaming Japanese Girls"?
rst 16y ago
Wrong and wrong. Sandbox overview here: http://programming4.us/mobile/1290.aspx http://programming4.us/mobile/1290.aspx Code signing is involved, to verify that particular apps have the same source, and that updates have the same source as the original app. (That's about all it's good for.) Briefly: each signing key gets its own UID on the phone. Unix file permissions are used to restrict access to files, devices, and other facilities. In some cases, kernel hacks are required to make this possible; the Android kernel only lets you open a TCP socket if you're a member of a particular group. If there's a local root exploit, you can still bypass all of this --- but the same is true on iOS.
metageek 16y ago
You are absolutely wrong. All apps in the Market are signed, and apps are sandboxed by running them with separate Unix userids.
- sigzero 16y ago
  Okay I am wrong.

mariuskempe 16y ago

If someone who knows a lot about these things has a few moments to spare, I'd love if you could answer http://www.quora.com/iOS-vs-Android/What-are-the-relative-merits-of-iOSs-and-Androids-application-sandboxing-models http://www.quora.com/iOS-vs-Android/What-are-the-relative-me... on Quora.

jimrandomh 16y ago

Completely missing from both the article and the comments: the list of permissions these malicious apps requested. I'd really like to know whether they found a way around the permissions model, or if this is a case of users clicking 'OK' to a prompt that says "do you want to let this app root you?"

limmeau 16y ago
Apparently, the modified binaries use a local root exploit, so they probably only required enough permissions for the local root exploit to work.
antrix 16y ago
The apps included root exploits. The thread on the Android subreddit has lots of details.

IgorPartola 16y ago

I am for openness of the Android platform. I don't believe that a review process, like Apple's, would be beneficial. However, the Android market is not like the web. On the web, if you are selling a downloadable piece of software, and I come along and buy a copy, break your DRM and start selling it myself, you have a surefire way to get me to stop. What you can do is talk to my payment processor and tell them I am committing fraud. They don't like that, and will shut things down. While the law is fuzzy and I am innocent until you can prove I am ripping you off, the payment processor has a contract with me that says that I will not do anything illegal, and they will enforce it. Now, on the Android Market, there is effectively, only one payment processor: Google. And they have a conflict of interest, since they also own the platform. They can either police all the apps (a la Apple) or they can ignore all fraud reports. The in-between gets them into a lot of grey territory about what constitutes fraud, etc.

JonnieCache 16y ago

The fact that they're collecting IMEIs is interesting. One of the little discussed facts about smartphones is that they make it trivially easy to change the IMEI. On the Galaxy S you can simply mount the NVRAM where it is stored as r/w and change it, and any other data you want. For those who don't know the IMEI number is what physically identifies an actual handset, like a MAC address, except that the networks/authorities view it as being more of a watertight way to identify someone, as up until recently changing them has required a soldering iron. This malware's behaviour implies what I have suspected for some time, that there is a black market for IMEIs, likely being used for organised criminals to remain anonymous, or to enable the resale of stolen handsets. Anyone fancy taking a guess at what an IMEI is worth on IRC these days? CC#s are meant to be about $0.10 each aren't they?

shareme 16y ago
always was a blackmarket for IMEIs.. Just now its easier to make up an IMEI..but how soon before the network infrastructure rejects that new IMEI? As that would be the key if the new IMEI had blackmarket value or not..obviously you cannot have two of the IMEIs be the same on the MO network..there are also several other issues...
peterwwillis 16y ago
Haha, I don't know, it's always been easy to get a new IMEI. Go to one of those "cell phone support forums", advertise an unlocking service, ask for IMEI, receive in your email. With a little more work you could monetize it but botnets for CC#s are probably a lot easier, and 419's provide even more pay for the effort involved. But then again i'm not a kid in some 3rd world country looking for a quick buck so who knows, Android apps could be a really interesting proposition.
ArtemR 16y ago
Or it could just be that they're collecting them because they can? It's a nice unique identifier they could use.

sp332 16y ago

I saw that there was a rootkit for Android botnet C&C presented at Shmoocon. Is this a similar attack, or something different? http://www.grmn00bs.com/2011/01/30/smartphone-code-release-for-shmoocon http://www.grmn00bs.com/2011/01/30/smartphone-code-release-f... PDF: http://www.grmn00bs.com/Shmoocon2011_SmartphoneBotnets_GeorgiaW.pdf http://www.grmn00bs.com/Shmoocon2011_SmartphoneBotnets_Georg... Video: http://vimeo.com/19372118 http://vimeo.com/19372118

kilowatt 16y ago

Coincidentally, this is exactly the kind of thing Google's recent Zynamics acquisition is meant to find automatically through binary code analysis.

zmmmmm 16y ago
If I was google I'd have a giant server room full of VM's running android hosting every app in the app store with monitors of their state. Then you can monitor not just what the code is predicted to do but what it actually does.

Derbasti 16y ago

Never mind walled gardens, but Google could at least run some basic virus scanner before posting stuff on the market.

dpcan 16y ago
Smartest post on this entire thread. They clearly analyze the APK before uploading and look at the Manifest, etc, so why not do a rootkit scan of some kind.

jgroome 16y ago

I know it's probably off-topic, but would it have killed them to link to the original reddit thread? They were more than happy to copy the whole story and quote verbatim from the thread. Strikes me that a direct link would have been the polite thing to do.

ordinaryman 16y ago

For developers who need to provide mobile access to their hosted apps, this event makes it easy to decide on a path with regard to "Native apps / Web apps ?" question.

JonnieCache 16y ago
Except that as discussed, there are plenty of code execution flaws in mobile builds of webkit that will do just as well as any flaw in the native app API. One XSS or SQL injection vuln in your webapp and your users could be just as rooted as the victims of this malware. Exactly like in the desktop browser world.

chibea 16y ago

Actually, that the malware contained a root exploit is fixable sooner or later. The next insight will be, that even if the sandbox had worked, this type of attack still is possible by using the user's trust in the brand of a well-known app to use the permissions granted to it for malicious intents. There's no easy way to avoid that up front automatically.

jsz0 16y ago

Google needs to do something. They absolutely do not need to mimic Apple's policies or impose any radical new limitations but the current situation is starting to spiral out of control. Once this starts hitting 'normal people' it could have massive repercussions. They need to stop this before the average person fears installing software onto their device or the entire third party ecosystem is going to be stunted. When you think about the depth of personal information, location awareness, microphone, camera, etc the ramifications of this are huge. The first virus that leaks SMS messages, owns Facebook accounts, or turns on cameras to spy on people could basically end Android as a viable consumer product. Of course we've seen this all before on PCs but I think the stakes are higher these days especially with devices that are so personal and highly connected.

Estragon 16y ago

So, was there any app-scanning software capable of detecting this before the warning? I have Lookout installed on my droid, but I have always wondered at its effectiveness. It has a "there are no crocodiles, so it must be a great crocodile repellant" feel to it...

ReadyNSet 16y ago

There is one thing everyone is missing, Apple does have a process of verifying the identity of the author even if there was a malware that was slipped in it is easy to identify the author and report to authorities that in itself is a good deterrent against trying. remember malware writers want low hanging fruit first and and Android extremely ripe for it.

sedev 16y ago

I think that this illustrates a point that's worth making about the difference between Android devices and iOS devices. There is no 'better' - there is a tradeoff. This is the same tradeoff that Linux elsewhere offers, really. This is the tradeoff: "if you are willing to invest your time, mental energy, and vigilance into bending your device to your will, avoiding traps such as mention in the article, and doing upkeep, a Linux-based device will give you enormous and awesome capabilities, leveraging the full power of having a general-purpose computer in your pocket." I am glad that that's available, because for some people, that's a great tradeoff! But it's important that there be another tradeoff available, which iOS is currently the flagship of: "if you are willing to accept more limited capabilities, you can have those capabilities in a form that Just Works and does not require your vigilance, time, and mental energy." I propose that the market share of Android and iOS roughly reflect the number of people for whom each of these tradeoffs, is the one they want. Of course we may want different things at different times - but when we buy these devices, we are voting with our dollars as to which tradeoff, overall, serves us best. I hope that both retain vigorous market share, because different people are best served by different tradeoffs.