5 ms·

Once I have bought a no-name tablet made in China that had malware installed in an unremovable 'browser' app. It was displaying ads on top of other apps, and wa

Once I have bought a no-name tablet made in China that had malware installed in an unremovable 'browser' app. It was displaying ads on top of other apps, and was installing new apps onto tablet, and also restoring deleted apps, and also installing false copies of well known apps. It was rather ok because i bought it with the intention of tearing it apart, but still, the lesson for me was, NEVER enter sensitive personal data in devices of unknown origins.

userbinator 5y ago
Keep in mind that the devices from manufacturers which people usually "trust" more also have a similar, although less-blatantly-malicious, degree of disobeying you by default (silent automatic updates, unremovable system apps, etc.) You could root it, and that would actually give you full control to delete/install/modify whatever you want. I think the real lesson here is that if you do not have full control over a device, it is not truly yours and may disobey you.
- throw_nbvc1234 5y ago
  They're not the same though; these problems need to be looked at through a combination of ability (to exploit) and motivation. Apple/Google isn't going to try and steal your identity, bank account info, or numerous other "small" things that some unknown and unaccountable company selling malware infected hardware could do. It's like when people state that online voting should be safe because online banking is safe. I'm pretty sure if a nation state really wanted to steal a few grand from your (individual) bank account, they'd be able to do it. But it'd probably cost them more money/power in doing so then it's worth it.
  - drran 5y ago
    > Apple/Google isn't going to try and steal your identity, bank account info, or numerous other "small" things You can believe in that, and trust them, but you cannot prove that, unless you have access to the source of everything installed by Google/Apple, and source of third party apps, favored by Google/Apple. But, even if you're working for a government agency and have access to sources, it's still a monumental task to do, because of the volume of the sources. It's why we, Linux owners, were crying when trivial initd and trivial shell scripts, which are easy to read and understand in about an hour or two, were replaced by Systemd, which may take days just to read source.
    - google234123 5y ago
      > Linux owners, were crying when trivial initd and trivial shell scripts, which are easy to read and understand in about an hour or two, were replaced by Systemd Nah, most Linux owners didn't care and the fact that the most distribution voted with their feet to switch should say enough. Also, full init script were not trivial.
      - MereInterest 5y ago
        Most people don't care about plumbing until it breaks and spews sewage water all across the apartment, after which they'll start having some pretty strong opinions about types of pipes. I didn't care about systemd until its default configuration deliberately broke emacs daemon and tmux, after which I had some pretty strong opinions about systemd. At this point, every distribution disables that setting, but it shows that systemd's developers cannot be trusted to make reasonable defaults, and must be double-checked to avoid blatant foolishness.
        SilverRed 5y ago
        Been using systemd for a very long time now and have had no issues. Had a very pleasant time setting up services to start on boot and such. And you can't just pull out "Yeah but it might break sometime in the future" because it never has broken for me, and that same argument can be used against literally every thing in existence. The vast majority of linux users have very positive experiences with systemd and it's cli tools are very good.
        MereInterest 5y ago
        In this case, the only reason that it didn't break more widely is because the adults in the room overrode the default KillUserProcesses=yes at the distribution level. This isn't an argument about whether something "might break in the future", as you so kindly put words into my mouth. This is an argument that I do not trust the systemd developers to make reasonable choices, as they have shown a willingness to break long-standing standards for benefits that are marginal at best. Discussion at the time: https://news.ycombinator.com/item?id=11797075 https://news.ycombinator.com/item?id=11797075 Continued defense of the decision as January 2019: https://news.ycombinator.com/item?id=19023232 https://news.ycombinator.com/item?id=19023232
  - guerrilla 5y ago
    You're moving the goalpost from what Andrew and the person responding said though. The Chinese phone is acting just like a Samsung phone, only a tad bit worse. The Russian phone and the ones you mention are of course another story like you say but that's not what you were responding to, which is a valid point.
  - pessimizer 5y ago
    > Apple/Google isn't going to try and steal your identity, bank account info, or numerous other "small" things that some unknown and unaccountable company selling malware infected hardware could do. They all could do it, but are you aware of any manufacturer-installed malware or rootkits on a device that have? They don't steal your bank account info or impersonate you ever as far as I know, they make money off you in the same way every other company does. If we can't show any instances, then it becomes difficult to find this materially worse than what other tech companies do. It becomes more like embarrassment from being owned by a obscure foreign company rather than a famous American one.
    - deleted 5y ago
      [deleted]
    - Razengan 5y ago
      > They all could do it That account name is apt. Everybody -could- do it. Even your spouse, your best friend, your parents. They could all steal your shit. But for sanity’s sake a balance has to be struck between trust and paranoia.
      - krono 5y ago
        The main difference, of course, being that your best friend is someone you could actually make having to face the legal consequences (and/or punch in the face). These oversized American corporations are practically untouchable to the majority of people. They'll pay their laughable fines, pinky promises to better self-regulate for real this time, and move on. Leaving you in the dirt.
  - labster 5y ago
    Online banking is safe because it is auditable and traceable. Voting has anonymity and chain-of-custody requirements that make doing it online extremely difficult.
- pessimizer 5y ago
  I agree, this is basically how all tech companies work now. The only thing that holds it back is the outrage cycle, which a) only turns its spotlight on companies above a certain size/visibility, b) can be defeated with a large enough marketing/lobbying spend, and c) can be waited out by companies with other lines of business that bring in profits, and d) can be combated with cycles of withdrawing, quietly reintroducing, then withdrawing again, and reintroducing again until d1.) media outlets get bored with it, or d2.) all other companies in the same line start to do the same thing, a traditional way of price-fixing. Once this happens, the only way you'll be stopped is with legislation, because e.g. every TV has banner ad pop-ups from the manufacturer now.
  - jmrm 5y ago
    > every TV has banner ad pop-ups from the manufacturer now. AFAIK, Samsung and cheap Chinese brands (Vizio, TCL, and similar) do this. Months ago I was between buying a LG or a Sony because they don't have bad reputation around this, and the LG I finally bought haven't any ad. Also, cookies, extra internet stuff, and the Alexa service can be deactivated separately without affecting apps like Netflix
    - beebeepka 5y ago
      Vizio, a US company, is the worst offender. These days it's hard to tell what is jingoism, or propaganda, and what is an honest mistake because a product is cheap
- Andrew_nenakhov 5y ago
  Of a well-known manufacturers, I noticed Xiaomi to do some real shit: it had an app preinstalled that displayed ads above other apps. But at least when I identified the culprit, it was possible to remove it completely and the problem went away.
  - kofejnik 5y ago
    I had pretty much same experience with my Xiaomi phone (in my case, push ads were coming from a hidden non-removable xiaomi service)
  - boondaburrah 5y ago
    I first ran into Xiaomi when I used a build of their MIUI rom on my Sony Ericsson X10 back in the day. It was amazingly better than default android (2.3/gingerbread era), so I wanted to keep using it. Got a new phone at some point and tried it again, and they were on some real shit by then. All the default built-in programs for like, /music playing/ would force you through a Xiaomi Cloud sign up process just to play music /already on your phone/. Granted, Google is now on the same shit; I found with my latest android they've removed all the basic apps for file browsing, music playing, and the like. Now only "Google Play" versions remain, that of course require a Google account. I feel like the camera and calculator are the only non-play-required default apps left, but I won't be surprised if I find one day that the camera is somehow integrated into Google Photos, which will of course not open until you sign in.
- tsjq 5y ago
  yes. there are apps in Samsung phones that have disabled buttons to force-quit, disable, & stop notifcations. and these are not even essential apps.
ronsor 5y ago
Hey, it technically was a browser app. It just lets the shady developers browse the contents of your tablet.
Engineering-MD 5y ago
It is the potential of hardware compromise that concerns me. Software can be wiped, but if the hardware itself contains backdoors, software can then be install at any time. Furthermore, given the global supply system, its so hard to confirm that any hardware is not compromised.
orbital-decay 5y ago
Before a certain Android version it was pretty common for Aliexpress sellers to plant unremovable ads, third-party stores, and god knows what else into the otherwise clean firmware, to be able to sell the phone with a discount. They usually didn't deny it, or even genuinely wondered - what's wrong with it? You bought it for a cheaper price after all, you should be happy, the seller is happy, everyone is, have a nice day sir. (a real conversation I had years ago)
Cthulhu_ 5y ago
And always keep in mind that "you get what you paid for", and "if it's too good to be true, it probably is". That makes it doubly shit that even premium products - TV's, laptops, etc - that aren't cheap or budget can come with ads, tracking and shitware pre-installed. I'm thankful that my TV showed me separate licenses for things like advertising, tracking and voice control and wasn't difficult or annoying when I did not accept them.

userbinator 5y ago

Keep in mind that the devices from manufacturers which people usually "trust" more also have a similar, although less-blatantly-malicious, degree of disobeying you by default (silent automatic updates, unremovable system apps, etc.) You could root it, and that would actually give you full control to delete/install/modify whatever you want. I think the real lesson here is that if you do not have full control over a device, it is not truly yours and may disobey you.

throw_nbvc1234 5y ago
They're not the same though; these problems need to be looked at through a combination of ability (to exploit) and motivation. Apple/Google isn't going to try and steal your identity, bank account info, or numerous other "small" things that some unknown and unaccountable company selling malware infected hardware could do. It's like when people state that online voting should be safe because online banking is safe. I'm pretty sure if a nation state really wanted to steal a few grand from your (individual) bank account, they'd be able to do it. But it'd probably cost them more money/power in doing so then it's worth it.
- drran 5y ago
  > Apple/Google isn't going to try and steal your identity, bank account info, or numerous other "small" things You can believe in that, and trust them, but you cannot prove that, unless you have access to the source of everything installed by Google/Apple, and source of third party apps, favored by Google/Apple. But, even if you're working for a government agency and have access to sources, it's still a monumental task to do, because of the volume of the sources. It's why we, Linux owners, were crying when trivial initd and trivial shell scripts, which are easy to read and understand in about an hour or two, were replaced by Systemd, which may take days just to read source.
  - google234123 5y ago
    > Linux owners, were crying when trivial initd and trivial shell scripts, which are easy to read and understand in about an hour or two, were replaced by Systemd Nah, most Linux owners didn't care and the fact that the most distribution voted with their feet to switch should say enough. Also, full init script were not trivial.
    - MereInterest 5y ago
      Most people don't care about plumbing until it breaks and spews sewage water all across the apartment, after which they'll start having some pretty strong opinions about types of pipes. I didn't care about systemd until its default configuration deliberately broke emacs daemon and tmux, after which I had some pretty strong opinions about systemd. At this point, every distribution disables that setting, but it shows that systemd's developers cannot be trusted to make reasonable defaults, and must be double-checked to avoid blatant foolishness.
      - SilverRed 5y ago
        Been using systemd for a very long time now and have had no issues. Had a very pleasant time setting up services to start on boot and such. And you can't just pull out "Yeah but it might break sometime in the future" because it never has broken for me, and that same argument can be used against literally every thing in existence. The vast majority of linux users have very positive experiences with systemd and it's cli tools are very good.
        MereInterest 5y ago
        In this case, the only reason that it didn't break more widely is because the adults in the room overrode the default KillUserProcesses=yes at the distribution level. This isn't an argument about whether something "might break in the future", as you so kindly put words into my mouth. This is an argument that I do not trust the systemd developers to make reasonable choices, as they have shown a willingness to break long-standing standards for benefits that are marginal at best. Discussion at the time: https://news.ycombinator.com/item?id=11797075 https://news.ycombinator.com/item?id=11797075 Continued defense of the decision as January 2019: https://news.ycombinator.com/item?id=19023232 https://news.ycombinator.com/item?id=19023232
- guerrilla 5y ago
  You're moving the goalpost from what Andrew and the person responding said though. The Chinese phone is acting just like a Samsung phone, only a tad bit worse. The Russian phone and the ones you mention are of course another story like you say but that's not what you were responding to, which is a valid point.
- pessimizer 5y ago
  > Apple/Google isn't going to try and steal your identity, bank account info, or numerous other "small" things that some unknown and unaccountable company selling malware infected hardware could do. They all could do it, but are you aware of any manufacturer-installed malware or rootkits on a device that have? They don't steal your bank account info or impersonate you ever as far as I know, they make money off you in the same way every other company does. If we can't show any instances, then it becomes difficult to find this materially worse than what other tech companies do. It becomes more like embarrassment from being owned by a obscure foreign company rather than a famous American one.
  - deleted 5y ago
    [deleted]
  - Razengan 5y ago
    > They all could do it That account name is apt. Everybody -could- do it. Even your spouse, your best friend, your parents. They could all steal your shit. But for sanity’s sake a balance has to be struck between trust and paranoia.
    - krono 5y ago
      The main difference, of course, being that your best friend is someone you could actually make having to face the legal consequences (and/or punch in the face). These oversized American corporations are practically untouchable to the majority of people. They'll pay their laughable fines, pinky promises to better self-regulate for real this time, and move on. Leaving you in the dirt.
- labster 5y ago
  Online banking is safe because it is auditable and traceable. Voting has anonymity and chain-of-custody requirements that make doing it online extremely difficult.
pessimizer 5y ago
I agree, this is basically how all tech companies work now. The only thing that holds it back is the outrage cycle, which a) only turns its spotlight on companies above a certain size/visibility, b) can be defeated with a large enough marketing/lobbying spend, and c) can be waited out by companies with other lines of business that bring in profits, and d) can be combated with cycles of withdrawing, quietly reintroducing, then withdrawing again, and reintroducing again until d1.) media outlets get bored with it, or d2.) all other companies in the same line start to do the same thing, a traditional way of price-fixing. Once this happens, the only way you'll be stopped is with legislation, because e.g. every TV has banner ad pop-ups from the manufacturer now.
- jmrm 5y ago
  > every TV has banner ad pop-ups from the manufacturer now. AFAIK, Samsung and cheap Chinese brands (Vizio, TCL, and similar) do this. Months ago I was between buying a LG or a Sony because they don't have bad reputation around this, and the LG I finally bought haven't any ad. Also, cookies, extra internet stuff, and the Alexa service can be deactivated separately without affecting apps like Netflix
  - beebeepka 5y ago
    Vizio, a US company, is the worst offender. These days it's hard to tell what is jingoism, or propaganda, and what is an honest mistake because a product is cheap
Andrew_nenakhov 5y ago
Of a well-known manufacturers, I noticed Xiaomi to do some real shit: it had an app preinstalled that displayed ads above other apps. But at least when I identified the culprit, it was possible to remove it completely and the problem went away.
- kofejnik 5y ago
  I had pretty much same experience with my Xiaomi phone (in my case, push ads were coming from a hidden non-removable xiaomi service)
- boondaburrah 5y ago
  I first ran into Xiaomi when I used a build of their MIUI rom on my Sony Ericsson X10 back in the day. It was amazingly better than default android (2.3/gingerbread era), so I wanted to keep using it. Got a new phone at some point and tried it again, and they were on some real shit by then. All the default built-in programs for like, /music playing/ would force you through a Xiaomi Cloud sign up process just to play music /already on your phone/. Granted, Google is now on the same shit; I found with my latest android they've removed all the basic apps for file browsing, music playing, and the like. Now only "Google Play" versions remain, that of course require a Google account. I feel like the camera and calculator are the only non-play-required default apps left, but I won't be surprised if I find one day that the camera is somehow integrated into Google Photos, which will of course not open until you sign in.
tsjq 5y ago
yes. there are apps in Samsung phones that have disabled buttons to force-quit, disable, & stop notifcations. and these are not even essential apps.

ronsor 5y ago

Hey, it technically was a browser app. It just lets the shady developers browse the contents of your tablet.

Engineering-MD 5y ago

It is the potential of hardware compromise that concerns me. Software can be wiped, but if the hardware itself contains backdoors, software can then be install at any time. Furthermore, given the global supply system, its so hard to confirm that any hardware is not compromised.

orbital-decay 5y ago

Before a certain Android version it was pretty common for Aliexpress sellers to plant unremovable ads, third-party stores, and god knows what else into the otherwise clean firmware, to be able to sell the phone with a discount. They usually didn't deny it, or even genuinely wondered - what's wrong with it? You bought it for a cheaper price after all, you should be happy, the seller is happy, everyone is, have a nice day sir. (a real conversation I had years ago)

Cthulhu_ 5y ago

And always keep in mind that "you get what you paid for", and "if it's too good to be true, it probably is". That makes it doubly shit that even premium products - TV's, laptops, etc - that aren't cheap or budget can come with ads, tracking and shitware pre-installed. I'm thankful that my TV showed me separate licenses for things like advertising, tracking and voice control and wasn't difficult or annoying when I did not accept them.