6 ms·

You would think if googles malware scanning was doing anything useful it would have flagged this purely because of the wide permissions it requests.

by Saris 5y ago

paulpauper 5y ago
"malware scanning" it is trivially easy to evade scanning -obfuscation -renaming -a long web of external obfuscated files -a blank or unregistered domain which is activated and calls a script as soon as it goes live (this is the most effective way)
- UncleMeat 5y ago
  Cloaking is real but is itself a fun signal. Most apps (outside of the chinese market) don't use cloaking so observing behavior that seems like cloaking can be strong signal that an app is malicious even if you cannot determine what the behavior actually is.
  - deleted 5y ago
    [deleted]
gruez 5y ago
Half of the "extraordinary number and breadth of system permissions it required" listed in the article seem benign * android.permission.INTERNET * android.permission.FOREGROUND_SERVICE * android.permission.RECEIVE_BOOT_COMPLETED * android.permission.WAKE_LOCK The rest are fishy, but not really anything that facilitates a virus. * android.permission.QUERY_ALL_PACKAGES - allows you to enumerate what apps are installed * android.permission.SYSTEM_ALERT_WINDOW - google says it's used for overlays. for a TOTP app this seems plausible for stuff like showing the code while you're entering it into the app that's requesting it * android.permission.REQUEST_INSTALL_PACKAGES - I'm not even sure what this permission does. You can install an apk from chrome/firefox, which doesn't have this permission. * android.permission.DISABLE_KEYGUARD - disables lockscreen. unless the attacker also has physical access, this is pointless.
- ffpip 5y ago
  > You can install an apk from chrome/firefox, which doesn't have this permission. I thought they just ask the OS to open the file, and when it happens to be a .apk file, Android brings up the package installer. Is that not how they do it?
  - leppr 5y ago
    You have to give app installation permissions to the app you open the .apk file from.
sschueller 5y ago
That malware scanner seems to care more about words in your title and description. Also if there is any way to access even the slightest NSFW content and the app is not Chrome then forget about getting it listed.
UncleMeat 5y ago
If "requests a lot of permissions" was sufficient to get apps taken off the Play store then we'd see way more "Help, Google took down my app and I'm mad" posts on HN, even if you did is based on comparisons to other same-category apps. The permission model is messy but made much worse by the volume of SDK code that is actually in most apps today. SDKs ship as big blobs with their own manifests and if you build in the SDK then you are collecting their permissions even if you aren't using the code that needs it. And given that virtually zero consumers choose apps based on permissions, there is little incentive to pare down the list to the minimum needed. android.permission.RECEIVE_BOOT_COMPLETED is really the only thing suspicious in that list since this is used for a few more old school malicious behaviors. Complaining about android.permission.INTERNET is frankly hilarious since that permission no longer does anything (every app has access to the internet).
- alexbakker 5y ago
  > android.permission.INTERNET is frankly hilarious since that permission no longer does anything (every app has access to the internet). This is incorrect. If an app doesn't specify this permission in its manifest, it cannot access the internet.
  - UncleMeat 5y ago
    Is that true? I was under the impression that this changed years ago since virtually every app requested it anyway. Apps could always send content over the internet by sending an intent to a browser with relevant GET parameters to whatever server is consuming the data.
    - mdp2021 5y ago
      Investigating, but the Android Developers page at https://developer.android.com/training/basics/network-ops/connecting https://developer.android.com/training/basics/network-ops/co... still states that «To perform network operations in your application, your manifest must include the following permissions: ... .INTERNET and ... .ACCESS_NETWORK_STATE» Though yes, applications (with particular regard to those that did not open network sockets internally) could use intents to have other applications perform network operations.
devwastaken 5y ago
Anti-virus is a scam. Same as anti cheat and DRM. It's a bandaid that only works for already known and databased attacks. You can simply modify how the virus is packaged and have it no longer detected. The true solution really is app review in the case of mobile apps. Google has the power and money, they just don't care.
- hericium 5y ago
  > Anti-virus is a scam. Most of the commercial industry is, but don't forget about ClamAV[1] and other open-source projects. [1] https://www.clamav.net/ https://www.clamav.net/
  - Avamander 5y ago
    ClamAV has one of the worst detection rates, even for ancient shit. Other vendors' Yara rules tend to be better.
    - hericium 5y ago
      It's an engine pluggable with 3rd party signatures if one doesn't like default ones. I wasn't attempting to discuss its quality but oppose slapping "scam" label on every AV there is.

You would think if googles malware scanning was doing anything useful it would have flagged this purely because of the wide permissions it requests.

by Saris 5y ago

You would think if googles malware scanning was doing anything useful it would have flagged this purely because of the wide permissions it requests.

paulpauper 5y ago

"malware scanning" it is trivially easy to evade scanning -obfuscation -renaming -a long web of external obfuscated files -a blank or unregistered domain which is activated and calls a script as soon as it goes live (this is the most effective way)

UncleMeat 5y ago
Cloaking is real but is itself a fun signal. Most apps (outside of the chinese market) don't use cloaking so observing behavior that seems like cloaking can be strong signal that an app is malicious even if you cannot determine what the behavior actually is.
- deleted 5y ago
  [deleted]

gruez 5y ago

Half of the "extraordinary number and breadth of system permissions it required" listed in the article seem benign * android.permission.INTERNET * android.permission.FOREGROUND_SERVICE * android.permission.RECEIVE_BOOT_COMPLETED * android.permission.WAKE_LOCK The rest are fishy, but not really anything that facilitates a virus. * android.permission.QUERY_ALL_PACKAGES - allows you to enumerate what apps are installed * android.permission.SYSTEM_ALERT_WINDOW - google says it's used for overlays. for a TOTP app this seems plausible for stuff like showing the code while you're entering it into the app that's requesting it * android.permission.REQUEST_INSTALL_PACKAGES - I'm not even sure what this permission does. You can install an apk from chrome/firefox, which doesn't have this permission. * android.permission.DISABLE_KEYGUARD - disables lockscreen. unless the attacker also has physical access, this is pointless.

ffpip 5y ago
> You can install an apk from chrome/firefox, which doesn't have this permission. I thought they just ask the OS to open the file, and when it happens to be a .apk file, Android brings up the package installer. Is that not how they do it?
- leppr 5y ago
  You have to give app installation permissions to the app you open the .apk file from.

sschueller 5y ago

That malware scanner seems to care more about words in your title and description. Also if there is any way to access even the slightest NSFW content and the app is not Chrome then forget about getting it listed.

UncleMeat 5y ago

If "requests a lot of permissions" was sufficient to get apps taken off the Play store then we'd see way more "Help, Google took down my app and I'm mad" posts on HN, even if you did is based on comparisons to other same-category apps. The permission model is messy but made much worse by the volume of SDK code that is actually in most apps today. SDKs ship as big blobs with their own manifests and if you build in the SDK then you are collecting their permissions even if you aren't using the code that needs it. And given that virtually zero consumers choose apps based on permissions, there is little incentive to pare down the list to the minimum needed. android.permission.RECEIVE_BOOT_COMPLETED is really the only thing suspicious in that list since this is used for a few more old school malicious behaviors. Complaining about android.permission.INTERNET is frankly hilarious since that permission no longer does anything (every app has access to the internet).

alexbakker 5y ago
> android.permission.INTERNET is frankly hilarious since that permission no longer does anything (every app has access to the internet). This is incorrect. If an app doesn't specify this permission in its manifest, it cannot access the internet.
- UncleMeat 5y ago
  Is that true? I was under the impression that this changed years ago since virtually every app requested it anyway. Apps could always send content over the internet by sending an intent to a browser with relevant GET parameters to whatever server is consuming the data.
  - mdp2021 5y ago
    Investigating, but the Android Developers page at https://developer.android.com/training/basics/network-ops/connecting https://developer.android.com/training/basics/network-ops/co... still states that «To perform network operations in your application, your manifest must include the following permissions: ... .INTERNET and ... .ACCESS_NETWORK_STATE» Though yes, applications (with particular regard to those that did not open network sockets internally) could use intents to have other applications perform network operations.

devwastaken 5y ago

Anti-virus is a scam. Same as anti cheat and DRM. It's a bandaid that only works for already known and databased attacks. You can simply modify how the virus is packaged and have it no longer detected. The true solution really is app review in the case of mobile apps. Google has the power and money, they just don't care.

hericium 5y ago
> Anti-virus is a scam. Most of the commercial industry is, but don't forget about ClamAV[1] and other open-source projects. [1] https://www.clamav.net/ https://www.clamav.net/
- Avamander 5y ago
  ClamAV has one of the worst detection rates, even for ancient shit. Other vendors' Yara rules tend to be better.
  - hericium 5y ago
    It's an engine pluggable with 3rd party signatures if one doesn't like default ones. I wasn't attempting to discuss its quality but oppose slapping "scam" label on every AV there is.