13 ms·
Google Play has been spreading advanced Android malware for years
- WrtCdEvrydy 6y agoOh yeah, they can spread malware for months, but I submit one fucking app that allows you create signs for your business for COVID-19 and all of a sudden I get a 'Sensitive Events Violation Suspension' and get a ding on my Google Play account. Google has become Apple except worse because at least Apple is reachable.
- realusername 6y agoApple is pretty much the same, I've been trying to create a developer account for three entire weeks and it still shows as "pending" without info. I saw on the forums that for some people it can take months. It looks like some bureaucratic government body from the 90s. I now advise my friends to switch to Android if they want to see the app, there's a limit on what I can put with. These companies should just be broken up in pieces.
- armitron 6y agoAt least Apple doesn’t serve you malware or harvest your personal data for profit.
- realusername 6y agoI think that's the only positive thing I can say about them yes.
- lern_too_spel 6y agoOn the contrary, Apple has served malware to far more users than Google despite having far fewer total users. https://blog.lookout.com/xcodeghost-apps https://blog.lookout.com/xcodeghost-apps Apple also uses your GPS data to update its location service (for profit), and unlike Android offers no way to opt out — if you want to get your location on an iDevice, Apple will get it, too. If you want to do something crazy like write apps for your own device without having to reinstall weekly, you have to deanonymize yourself with payment.
- realusername 6y agoThat's interesting to know, I was originally convinced by their marketing claiming the walled garden was at least helping a bit for security purpose but even that seems false.
- scarface74 6y agoIt happened because developers in China were using a hacked version of XCode. The apps never escaped the sandbox. I have no idea how Apple makes money by collecting location data.
- realusername 6y agoI separate their concept of the sandbox (app permissions) from the walled garden (the App Store & the lockdown of user install). You can totally have a sandbox without a walled garden. It seems that in this case, the walled garden did not help in any ways.
- scarface74 6y agoThis is all the apps could do. The malware removes information off the device like the device’s name, country, and unique identifiers. This part is complete conjecture. According to Palo Alto Networks, it may also have the ability to push dialogue boxes to your iPhone or iPad’s screen. Theoretically, a bad guy could use one of these dialogues to steal your username and password or other personal information. The malware may also be able to open websites in your mobile browser, which could be used for a variety of malicious purposes again including phishing and installing other potentially malicious software.
- deleted 6y ago[deleted]
- ship_it 6y ago> developers in China were using a hacked version of XCode Can you give us more details on this? Interested.
- sneak 6y agoApps in the iOS App Store are allowed to embed silent spying that you can't disable (also known as spyware) that upload your location and activity data to third parties without your consent. You're deemed to have agreed to this as a user based on the App Store Terms of Service. Don't buy Apple's lies about privacy. It's just marketing.
- tinus_hn 6y agoThe user decides if an app has access to his location.
- sneak 6y agoYes, but the permission is per-app. Let’s say I approve location for the app because the app’s function requires it: the third party spying SDKs embedded in the app send that location data off to third parties without notifying me or permitting me to stop it. Apple permits this behavior in the App Store. Furthermore, IP address is coarse location even if you don’t grant the app permission, via GeoIP databases. Long story short, Apple allows apps in the store to embed silent, nonconsensual spyware that you can’t disable.
- matchbok 6y agoThat's not how it works. If you install the app you are giving permission to the app to use your location however they want. It is pretty explicit. From a legal perspective they are supposed to indicate as such in their terms and conditions, which you are supposed to read.
- anhner 6y agoIf an app's function requires location, how is it Apple's fault that the user decides it's better to enable that app to spy on him? If I use Waze do I expect privacy from it when it's essential that it knows my location? Furthermore, on iPhone you get a warning when an app abuses the location permission, unlike Android. At least on iPhones you have per app control, on Android it's either "location on" or "location off"
- techslave 6y agoi learned that you call them and it gets done immediately. submit, wait 24h, call. easy
- Karishma1234 6y agoMy app got suspended because my self publish ebook reader could be used to search for books one of which had a kid with a nerf gun on its cover.
- jimmaswell 6y agoSad times we live in.
- samoa42 6y agowhy would anyone need an app to print a text stating their business is closed? probably someone was just looking for any reason to get rid of this.
- WrtCdEvrydy 6y agoNot closed... it's an app to generate signs from your phone about social distancing and other measures that are the law in some states.
- mclightning 6y agoThey're not picking on you. You're just easier to identify. Don't take it so personally. That's a very biased view.
- cageface 6y agoApp stores are a trap. As developers we should be doing everything we can to keep the web alive. Every power you cede to a third party gets abused sooner or later.
- innagadadavida 6y agoDoes google know which apps were infected and does it plan on letting folks installed know? It’s unfortunate their own project zero didn’t catch this.
- notRobot 6y agoThe article lists the package names of the infected apps.
- izacus 6y agoThe wording of the title is interesting - how it puts all the responsibility onto Play store and none of it onto the people actually developing the software. We truly live in an age where the mass media demands that corporations censor and police everything we see and use. I wonder when they'll start targeting Linux and Windows for allowing you to download and run malicious programs without any corporation approving them.
- panny 6y agoNo worries Google fan. arstechnica is a paid Google "news" outlet. In the article, they downplay the damage and reach of the attack. If they titled it "Move along, nothing to see here" their ruse would be too obvious.
- izacus 6y agoIf I'd be a Google fan, I wouldn't have problems with them deciding what I'm allowed to download to my phone :(
- leppr 6y agoIt's not the media, that's the stance Google themselves adopt with Google Play by acting as non-neutral gatekeepers. Few people lack the intuitive understanding of the difference between free platforms and controlled ones. People don't blame Google Search for linking to Stormfront, but they would blame Facebook for hosting it. People don't blame Linux and Windows for allowing you to install malicious apps, because these allow you to install any apps.
- dTal 6y ago>People don't blame Linux and Windows for allowing you to install malicious apps, because these allow you to install any apps. Ah you've really put your finger on something there. The entire concept of an app store, gatekept through a series of hoops to jump through and from which the company takes n% of profit where n is some shockingly large percentage, is a highly costly departure from the traditional model of "obtain software from third party, install". The justification for this mafia-like intercession between vendor and customer has always been "for your protection". If they don't provide any protection, why do we tolerate this racket at all?
- AnthonyMouse 6y agoLet this be another nail in the coffin of the "walled garden" farce. We learn this lesson again and again. People want someone to trust, but a bureaucracy isn't trustworthy. It has its own agenda and values inconsistent with yours. They take 30% from everybody whether they approve malware or not, and whether they reject legitimate apps or not. Trust doesn't come from size. If you want someone to vet your apps, it has to be someone whose interests are actually aligned with yours, not just whoever is big enough to force everybody through the tollgate into their store.
- Razengan 6y agoI would still prefer to have to trust just one authority for my platform than a multitude of random developers. > Let this be another nail in the coffin of the "walled garden" farce. There is no coffin, the walled gardens are not dying, and have long since become the norm, which happened because the people found them to be better than the alternative: getting apps (and manually updating them) from many different sources of varying quality and convenience.
- papermachete 6y agoThat's why you have package managers to work with thousands of repos for you.
- bryanrasmussen 6y agoyes, my granny loves working with her package manager with thousands of repos when she wants to install a funny kitty photos app.
- papermachete 6y agoFdroid, ubuntu store, Discover, etc are all graphical interfaces to these. There is no reason to have one authority over packages.
- realusername 6y ago
- KingOfCoders 6y agoTin foil hat on. We had these iOS zero days and now conveniently we get something about Android security.
- wccrawford 6y agoThere's no tinfoil hat needed. It's pretty common for people who get their feelings hurt to lash out against "the enemy" with whatever they have. It doesn't matter how old the news is when they can just post it again and people will upvote it like it's new. And it doesn't even necessarily have anything to do with Apple themselves. They don't need to spearhead this movement because fanatics will defend them like this anyhow. The same goes for Google fanatics, and every other kind out there.
- freehunter 6y agoIf you think this is the only news article that has ever talked negatively about Android security, I'd recommend reading the news more often.
- xorfish 6y agoWhy haven't antitrust lawsuits made it mandatory that you can chose your app store after first use like it happened with browsers?
- Leherenn 6y agoThere's no monopoly in the phone market like there was with Microsoft.
- jedimastert 6y agoI currently have F-Droid installed on my stock phone and Google did nothing to stop me other than a single "unknown app" warning. Also, that's not how it works with browsers. You have one browser installed. I don't think I've ever seen windows or mac (or any linux distro I've tried) ask which browser should be installed. There's just the default one and the choice to install anything else.
- Mindwipe 6y agoThey likely will eventually, but the browser verdict took a long time. It's also unhelpful that many politicians have realised in retrospect that they quite like having single choke points that can be used to enact legislative control over the public.
- javajosh 6y agoIt's emotionally difficult to find out about flaws in something you trust. I think humans really like black and white thinking, and crave association with people and institutions with blemish-free reputations. But the truth is that nothing and no-one is blemish free, especially if you zoom in on them enough. If you let it, then this truth can make you feel like you can't trust anything or anyone. But its not true. You can trust. Although blemishes are universal, the scale of the blemishes are not. The key to trusting again in a world of flaws and faults is perspective. Is the flaw large or small? Does the agent accept it and want to fix it, or do they deny it exists (a much worse problem!)? Everything has flaws, everyone makes mistakes, often people behave badly. That is never going to change. The thing we have to judge is whether the self-corrective systems in place are doing their jobs to acknowledge and repair the damage. IOW, making a mistake shouldn't determine trust, but failing to address the mistake should. One might call it "second-order trust". If you accept that, then the missing piece of this story is Google's response -- although they removed the offending malware from the Play Store, the journalist didn't apparently contact Google for anything else, like what steps they are taking (if any) to prevent this sort of thing from happening again. Ars didn't say anything about contacting Google, so I'd say that is an indication of lazy journalism, itself a sad but endemic problem in a world where we all have another false belief, that useful screens should be free (as in beer).