3 ms·

And yet, Google seems to have absolutely no problem allowing malware on the Play Store, in fact if I Google search "Play Store malware" the first four results a

And yet, Google seems to have absolutely no problem allowing malware on the Play Store, in fact if I Google search "Play Store malware" the first four results are four separate articles, in four different months, from this year alone. If people are hardly batting an eye at that, and if Google continues to do little more than remove the offending apps, it's clear their reputation over the Play Store and app ecosystem is solidified and will not change, short of catastrophe. I just don't buy your answer. In fact, I don't even buy that most people know what Android actually is or that it's owned by Google in the first place; I know a frightening number number of people who still refer to their OnePlus or Pixel as a "Samsung." If the OEMs want to make that choice, they should absolutely be allowed to, and if one of the pre-installed apps becomes an attack vector it's more than easy enough for Google to say "we don't have control over that, take it up with [OEM] or [app dev]"

Aunche 6y ago
IIRC, malware on Android apps generally fakes clicks to get free ad revenue and perform other operations technically allowed by the Android APIs. They don't compromise the security of the device because the apps are sandboxed. If the deal between Fortnite and Oneplus wouldn't cost Google any money, there's a good chance Google would let it slide, but that doesn't change that their concerns are legitimate. If a grassroots effort stopped this deal, we would all be cheering.
- nodamage 6y ago
  It's not uncommon for Android malware to exploit system vulnerabilities to break out of the sandbox. - Agent Smith abused an installation vulnerability in order to inject malicious code into other installed APKs on the device. (https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/ https://research.checkpoint.com/2019/agent-smith-a-new-speci...) - HummingBad used multiple root exploits to auto-root 10 million devices. (https://arstechnica.com/information-technology/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/ https://arstechnica.com/information-technology/2016/07/virul...) - xHelper similarly buried itself deep in the system partition in order to survive device resets, and went so far as rewriting libc.so to prevent you from mounting the system partition to remove it. (https://arstechnica.com/information-technology/2020/04/solved-how-android-backdoor-called-xhelper-survives-factory-resets/ https://arstechnica.com/information-technology/2020/04/solve...) You are also underestimating the amount of damage malware can cause even within the sandbox. - The CryCryptor ransomware abuses file access APIs to encrypt photos and videos on external storage and hold them hostage. (https://threatpost.com/emerging-ransomware-photos-videos-android/156893/ https://threatpost.com/emerging-ransomware-photos-videos-and...) - The DEFENSOR ID banking trojan abuses accessibility APIs to steal login credentials, text messages, and 2FA codes. (https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/0/ https://www.welivesecurity.com/2020/05/22/insidious-android-...) Even the majority of the adware you describe abuses system APIs to hide their own icons and draw their own ads on top of other apps. (Why Android even has an API that allows this, I have no idea...) (https://news.sophos.com/en-us/2019/10/08/icon-hiding-android-adware-returns-to-the-play-market/ https://news.sophos.com/en-us/2019/10/08/icon-hiding-android...) When it comes to malware, sandboxing is far from the panacea that some people seem to believe.

Aunche 6y ago

IIRC, malware on Android apps generally fakes clicks to get free ad revenue and perform other operations technically allowed by the Android APIs. They don't compromise the security of the device because the apps are sandboxed. If the deal between Fortnite and Oneplus wouldn't cost Google any money, there's a good chance Google would let it slide, but that doesn't change that their concerns are legitimate. If a grassroots effort stopped this deal, we would all be cheering.

nodamage 6y ago
It's not uncommon for Android malware to exploit system vulnerabilities to break out of the sandbox. - Agent Smith abused an installation vulnerability in order to inject malicious code into other installed APKs on the device. (https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/ https://research.checkpoint.com/2019/agent-smith-a-new-speci...) - HummingBad used multiple root exploits to auto-root 10 million devices. (https://arstechnica.com/information-technology/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/ https://arstechnica.com/information-technology/2016/07/virul...) - xHelper similarly buried itself deep in the system partition in order to survive device resets, and went so far as rewriting libc.so to prevent you from mounting the system partition to remove it. (https://arstechnica.com/information-technology/2020/04/solved-how-android-backdoor-called-xhelper-survives-factory-resets/ https://arstechnica.com/information-technology/2020/04/solve...) You are also underestimating the amount of damage malware can cause even within the sandbox. - The CryCryptor ransomware abuses file access APIs to encrypt photos and videos on external storage and hold them hostage. (https://threatpost.com/emerging-ransomware-photos-videos-android/156893/ https://threatpost.com/emerging-ransomware-photos-videos-and...) - The DEFENSOR ID banking trojan abuses accessibility APIs to steal login credentials, text messages, and 2FA codes. (https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/0/ https://www.welivesecurity.com/2020/05/22/insidious-android-...) Even the majority of the adware you describe abuses system APIs to hide their own icons and draw their own ads on top of other apps. (Why Android even has an API that allows this, I have no idea...) (https://news.sophos.com/en-us/2019/10/08/icon-hiding-android-adware-returns-to-the-play-market/ https://news.sophos.com/en-us/2019/10/08/icon-hiding-android...) When it comes to malware, sandboxing is far from the panacea that some people seem to believe.