6 ms·

This is an epic screwup by Google and the mobile carriers, but it's also a useful warning to Google's competitors. 1) This problem was reported to Google a wee

by ekidd 16y ago

This is an epic screwup by Google and the mobile carriers, but it's also a useful warning to Google's competitors. 1) This problem was reported to Google a week ago, through multiple channels, by one of the app vendors who got ripped off: http://www.reddit.com/r/Android/comments/fvepu/someone_just_ripped_off_21_popular_free_apps_from/ http://www.reddit.com/r/Android/comments/fvepu/someone_just_... Apparently, Google has an unofficial policy of ignoring copyright and trademark complaints, allowing lots of skeevy software to linger on the market. 2) The phone carriers are apparently very slow to patch root exploits. 3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees. But a word of warning to iOS, WebOS, and Blackberry users: 4) Although the lax behavior of Google and the carriers made this exploit easier, we'll eventually see problems like this on most mobile platforms. Apple has allowed (benign) root exploits to slip through their approval process in the past. If your phone is vulnerable enough to be rooted, it's vulnerable enough to be owned by a malicious app.

TillE 16y ago
> Apparently, Google has an unofficial policy of ignoring copyright and trademark complaints I have no personal experience with this, but Google makes it very clear that a DMCA notice is the appropriate action in this situation: http://www.google.com/support/bin/request.py?contact_type=lr_dmca&product=androidmarket http://www.google.com/support/bin/request.py?contact_type=lr... I've read a bunch of sob stories lately from iOS and Android app developers, and they never say they've sent a DMCA takedown notice that's gone unanswered. Under US law, this is the way to respond to copyright violations. Sending a generic complaint means very little.
- veeti 16y ago
  He said in his comment that he sent a DMCA notice.
  - Natsu 16y ago
    Just to be clear, the guy on Reddit also said that Google responded to the DMCA notice, which counters the claim the GP was responding to, specifically the the claim that Google ignores copyright complaints. That said, it's true that they won't respond to anything except a valid DMCA notice. Anyone who sends anything else is provided with instructions on how to file a valid DMCA notice last I knew.
illumin8 16y ago
> Apple has allowed (benign) root exploits to slip through their approval process in the past. Citation please. To my knowledge, Apple has never allowed code through the official app store that would jailbreak or root an iOS device. There have been, however, web based exploits that were quickly patched, but you can't really blame this on Apple's approval process. The most notable one of these was the PDF viewer exploit used by jailbreakme.com. This incident seems to prove to me that a curated app store is the best way to keep a large monoculture safe from malware.
- ekidd 16y ago
  Citation please. [I would like to edit my original remarks, but it appears that I no longer can. So I've upvoted your comment instead.] When I wrote that, I had been thinking of the Handy Light exploit which slipped through the App Store's approval process: http://appshopper.com/blog/2010/07/20/handy-light-tethering-app-camouflaged-as-flashlight/ http://appshopper.com/blog/2010/07/20/handy-light-tethering-... But upon further investigation, I can't find any evidence that Handy Light used an actual root exploit. It may have just been an easter egg which violated Apple's policies using standard APIs. Even if it's not a root exploit, though, there's no cause for celebration. Handy Light shows that the App Store process can sneak major, prohibited functionality onto users' devices in the guise of a clearly useless and trivial app. Apple's biggest advantage may be checking for pirated apps. If Google hadn't allowed obviously pirated apps into the Market, then any attack would have required writing useful, popular applications from scratch, which would raise the bar considerably.
  - illumin8 16y ago
    > When I wrote that, I had been thinking of the Handy Light exploit which slipped through the App Store's approval process: Yes, I can see how you would make that simple mistake. The Handy Light application did allow tethering, which on an Android device might have meant rooting it. Other people mentioned in this thread that Apple run each binary through a scanner that looks for undocumented API calls. The Handy Light application must have been using all publicly available API calls, so it passed through their approval process. I think Google could improve dramatically by keeping their store open, but running each binary through an automated scanner that looks for known exploit signatures. I'm not intimately familiar with the Android sandbox, but I am familiar with native assembly. Assuming that there is a public API or list of "approved/sanctioned machine instructions", it would be somewhat trivial to decompile the bytecode and check each instruction against the list and kick the application back to the developer with a list of instructions or API calls that were not allowed.
YooLi 16y ago
"3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees." Isn't the appeal of Google's app store that it isn't curated? Anyone can sign up and submit anything. And Apple has never let a "(benign) root exploit" through approval.
- ekidd 16y ago
  Isn't the appeal of Google's app store that it isn't curated? Yes and no. As a developer, I certainly love the relative ease and freedom of Google's Market. But as user, I don't want to fear clicking "Download" or "Buy". Apple succeeds, in part, because their App Store provides a certain measure of trust, and users are willing to open their wallets. At a minimum, Google needs to respond quickly to malware reports, and to enforce anti-piracy rules vigorously. Allowing attackers to pirate and republish apps allows them to attack many more users than they could reach by developing malicious-but-popular applications from scratch. And Apple has never let a "(benign) root exploit" through approval. Yeah, I think that was an incorrect statement on my part. Apple has passed major, hidden functionality that violates their policies, but I was mistaken in thinking a root exploit was involved. For a mea culpa, see the thread at http://news.ycombinator.com/item?id=2279823 http://news.ycombinator.com/item?id=2279823
- alex_c 16y ago
  >Isn't the appeal of Google's app store that it isn't curated? Anyone can sign up and submit anything. Android allows installing apps from sources other than the Market, so this isn't that big a deal. A free-for-all app store does have disadvantages, like app spam, rampant copyright infringement, and apparently malware.
- jad 16y ago
  Isn't the appeal of Google's app store that it isn't curated? That's the appeal for some developers, but probably not for most users.
- originalgeek 16y ago
  > Isn't the appeal of Google's app store that it isn't curated? Anyone can sign up and submit anything. If you're a "I like to let anyone install anything in my phone" kind of person, I suppose so.
brown9-2 16y ago
3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees. Wait a second - does Google curate the Android market or charge 30% fees?
- mdonahoe 16y ago
  I don't know about the curation, but the fees are real, according to this: http://market.android.com/support/bin/answer.py?answer=112622 http://market.android.com/support/bin/answer.py?answer=11262...
  - Zaak 16y ago
    Does Google take that fee, or does it go to the mobile carrier?
nl 16y ago
The root exploit appears almost incidental here - without it the application could do everything it was doing merely by requesting those permissions at install time. The vast majority of people would install it without checking. Here's some examples of iOS apps doing similar things without requiring a root exploit: The threat is not theoretical. Several iPhone apps have been pulled from the App Store after being found to be harvesting user data, intentionally or unintentionally. A game called Aurora Feint was uploading all the user contacts to the developer's server, and salespeople from Swiss road traffic information app MogoRoad were calling customers who downloaded the app. Game app Storm8 was sued last fall for allegedly harvesting customer phone numbers without permission, but it later stopped that practice. And users also complained that Pinch Media, an analytics framework used by developers, was collecting data about customer phones. http://news.cnet.com/8301-27080_3-10446402-245.html http://news.cnet.com/8301-27080_3-10446402-245.html
ryanisinallofus 16y ago
" 3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees." Exactly. Google is trying to clone the Mac App store without doing the legwork to justify their cut. • Curation should include safety • Curation should include some sort of fair promotion I'm skeptical of the benefits of these "curated" app stores and their high fees but at least Apple does the work to back up taking their cut.
- fleitz 16y ago
  And they've jacked up their cut of the take by 6% over Apple. Apple's 30% is quite enough but an increase of 6% added on top of 30% is just ridiculous.
  - ryanisinallofus 16y ago
    A higher percentage for far less value.

by ekidd 16y ago

TillE 16y ago

> Apparently, Google has an unofficial policy of ignoring copyright and trademark complaints I have no personal experience with this, but Google makes it very clear that a DMCA notice is the appropriate action in this situation: http://www.google.com/support/bin/request.py?contact_type=lr_dmca&product=androidmarket http://www.google.com/support/bin/request.py?contact_type=lr... I've read a bunch of sob stories lately from iOS and Android app developers, and they never say they've sent a DMCA takedown notice that's gone unanswered. Under US law, this is the way to respond to copyright violations. Sending a generic complaint means very little.

veeti 16y ago
He said in his comment that he sent a DMCA notice.
- Natsu 16y ago
  Just to be clear, the guy on Reddit also said that Google responded to the DMCA notice, which counters the claim the GP was responding to, specifically the the claim that Google ignores copyright complaints. That said, it's true that they won't respond to anything except a valid DMCA notice. Anyone who sends anything else is provided with instructions on how to file a valid DMCA notice last I knew.

illumin8 16y ago

> Apple has allowed (benign) root exploits to slip through their approval process in the past. Citation please. To my knowledge, Apple has never allowed code through the official app store that would jailbreak or root an iOS device. There have been, however, web based exploits that were quickly patched, but you can't really blame this on Apple's approval process. The most notable one of these was the PDF viewer exploit used by jailbreakme.com. This incident seems to prove to me that a curated app store is the best way to keep a large monoculture safe from malware.

ekidd 16y ago
Citation please. [I would like to edit my original remarks, but it appears that I no longer can. So I've upvoted your comment instead.] When I wrote that, I had been thinking of the Handy Light exploit which slipped through the App Store's approval process: http://appshopper.com/blog/2010/07/20/handy-light-tethering-app-camouflaged-as-flashlight/ http://appshopper.com/blog/2010/07/20/handy-light-tethering-... But upon further investigation, I can't find any evidence that Handy Light used an actual root exploit. It may have just been an easter egg which violated Apple's policies using standard APIs. Even if it's not a root exploit, though, there's no cause for celebration. Handy Light shows that the App Store process can sneak major, prohibited functionality onto users' devices in the guise of a clearly useless and trivial app. Apple's biggest advantage may be checking for pirated apps. If Google hadn't allowed obviously pirated apps into the Market, then any attack would have required writing useful, popular applications from scratch, which would raise the bar considerably.
- illumin8 16y ago
  > When I wrote that, I had been thinking of the Handy Light exploit which slipped through the App Store's approval process: Yes, I can see how you would make that simple mistake. The Handy Light application did allow tethering, which on an Android device might have meant rooting it. Other people mentioned in this thread that Apple run each binary through a scanner that looks for undocumented API calls. The Handy Light application must have been using all publicly available API calls, so it passed through their approval process. I think Google could improve dramatically by keeping their store open, but running each binary through an automated scanner that looks for known exploit signatures. I'm not intimately familiar with the Android sandbox, but I am familiar with native assembly. Assuming that there is a public API or list of "approved/sanctioned machine instructions", it would be somewhat trivial to decompile the bytecode and check each instruction against the list and kick the application back to the developer with a list of instructions or API calls that were not allowed.

YooLi 16y ago

"3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees." Isn't the appeal of Google's app store that it isn't curated? Anyone can sign up and submit anything. And Apple has never let a "(benign) root exploit" through approval.

ekidd 16y ago
Isn't the appeal of Google's app store that it isn't curated? Yes and no. As a developer, I certainly love the relative ease and freedom of Google's Market. But as user, I don't want to fear clicking "Download" or "Buy". Apple succeeds, in part, because their App Store provides a certain measure of trust, and users are willing to open their wallets. At a minimum, Google needs to respond quickly to malware reports, and to enforce anti-piracy rules vigorously. Allowing attackers to pirate and republish apps allows them to attack many more users than they could reach by developing malicious-but-popular applications from scratch. And Apple has never let a "(benign) root exploit" through approval. Yeah, I think that was an incorrect statement on my part. Apple has passed major, hidden functionality that violates their policies, but I was mistaken in thinking a root exploit was involved. For a mea culpa, see the thread at http://news.ycombinator.com/item?id=2279823 http://news.ycombinator.com/item?id=2279823
alex_c 16y ago
>Isn't the appeal of Google's app store that it isn't curated? Anyone can sign up and submit anything. Android allows installing apps from sources other than the Market, so this isn't that big a deal. A free-for-all app store does have disadvantages, like app spam, rampant copyright infringement, and apparently malware.
jad 16y ago
Isn't the appeal of Google's app store that it isn't curated? That's the appeal for some developers, but probably not for most users.
originalgeek 16y ago
> Isn't the appeal of Google's app store that it isn't curated? Anyone can sign up and submit anything. If you're a "I like to let anyone install anything in my phone" kind of person, I suppose so.

brown9-2 16y ago

3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees. Wait a second - does Google curate the Android market or charge 30% fees?

mdonahoe 16y ago
I don't know about the curation, but the fees are real, according to this: http://market.android.com/support/bin/answer.py?answer=112622 http://market.android.com/support/bin/answer.py?answer=11262...
- Zaak 16y ago
  Does Google take that fee, or does it go to the mobile carrier?

nl 16y ago

The root exploit appears almost incidental here - without it the application could do everything it was doing merely by requesting those permissions at install time. The vast majority of people would install it without checking. Here's some examples of iOS apps doing similar things without requiring a root exploit: The threat is not theoretical. Several iPhone apps have been pulled from the App Store after being found to be harvesting user data, intentionally or unintentionally. A game called Aurora Feint was uploading all the user contacts to the developer's server, and salespeople from Swiss road traffic information app MogoRoad were calling customers who downloaded the app. Game app Storm8 was sued last fall for allegedly harvesting customer phone numbers without permission, but it later stopped that practice. And users also complained that Pinch Media, an analytics framework used by developers, was collecting data about customer phones. http://news.cnet.com/8301-27080_3-10446402-245.html http://news.cnet.com/8301-27080_3-10446402-245.html

ryanisinallofus 16y ago

" 3) Users should be able to trust everything in a curated app store, or else there's not much point to those 30% fees." Exactly. Google is trying to clone the Mac App store without doing the legwork to justify their cut. • Curation should include safety • Curation should include some sort of fair promotion I'm skeptical of the benefits of these "curated" app stores and their high fees but at least Apple does the work to back up taking their cut.

fleitz 16y ago
And they've jacked up their cut of the take by 6% over Apple. Apple's 30% is quite enough but an increase of 6% added on top of 30% is just ridiculous.
- ryanisinallofus 16y ago
  A higher percentage for far less value.