6 ms·

Malicious app on Google Play drops banking malware on users’ devices

104 points by caaqil 5y ago

deleted 5y ago
[deleted]
chetangoti 5y ago
It was discussed yesterday at https://news.ycombinator.com/item?id=30115132 https://news.ycombinator.com/item?id=30115132 which has 57 comments.
- eMGm4D0zgUAVXc7 5y ago
  The thread does not seem to answer the most interesting question: Is it really possible for app developers to leave out permissions in the list of requested permissions on Google Play and then get them nevertheless when the app is actually installed? See my other reply for a more lengthy description: https://news.ycombinator.com/item?id=30126488 https://news.ycombinator.com/item?id=30126488
  - phh 5y ago
    No it's not possible. Google Play hides some permissions on its own, but very basic one (like the one allowing access to internet). That's it. The dangerous permissions mentioned in the article need to be manually enabled by the user, after installing the application.
  - lnxg33k1 5y ago
    Another question would be: If google gives me an app from their official playstore, on their OS, should they be considered responsible for any loss that it causes to bank accounts, or we have given up accountability for big corps, hope regulators are sleeping well
    - izacus 5y ago
      Your thinking is kinda bizarre - why do you demand accountability from the store, not the author/creator of the malware app? For other products the accountability is always on the manufacturer/creator of the product - why, in software, do you all demand that big tech censors and polices what you're allowed to consume instead of actually punishing the wrongdoers who created malicious and dangerous software? Why can they just get away with zero accountability and you don't even spare a millisecond of thought?
      - lnxg33k1 5y ago
        Well, for one thing it's because I am forced to keep the play store on my phone without being able to uninstall it, along with Google play services, and also they are vetting all apps that gets to the google play store, and also the fact that they contiously bust balls justifying the existence of their ecosystem to safety and security of devices, are they allowed to have it both ways? So we need to keep them because of safety but like not really safety? More like safety of income stream for their shareholders?
      - petre 5y ago
        They charge 15-30% of the revenue so they should also be responsible. If they had offered a free service then no.
        etchalon 5y ago
        All stores charge a markup.
        lnxg33k1 5y ago
        there are no more half-seasons
        withinboredom 5y ago
        No they don’t. Physical stores pay volume rates to the manufacturers. They own the inventory and resell it at a markup or a loss. The app stores do something totally different. They allow “manufacturers” to list the item directly to the consumer and charge 30% in money transmission (legal term) fees. They are basically offering the same service (and licenses) as Western Union (or stripe connect), just on a larger scale and more integrated. Whether they are actually legally set up that way (or not) I don’t know. I did go down this rabbit hole 10-15 years ago to do something similar with a lawyer. What could be interesting is if some states/countries have limits on the fees a money transmitter can charge and an app company sued for them operating illegally.
    - phh 5y ago
      I'm not aware of Microsoft ever being sued about the loss of malwares on Windows.
      - lnxg33k1 5y ago
        Windows is not vetting all apps, and is not forcing you to bribe them 30% of your sales to be on a store fully controlled by them But yeah, I think making corps accountable would be of great benefit to IT, if we start hitting them in the wallet I guess that's the only way to make security escape conferences and make it to software companies HQs I get to pay a corp to get a shitty product that makes me subject all sort of security issue, without being able to blame it on anyone, and in the end I have also to pay with my time because manager X didn't think that it was important to deliver a safe product. So yeah, I want to be paid for the time I have to spend to fix corps shits
        phh 5y ago
        > Windows is not vetting all apps Actually, I'm pretty sure there has been some stuff that Microsoft signed, for which MS is paid (not 30% sure), that were malwares. But I'm too lazy to find it
      - dylan604 5y ago
        *loss from malwares on Windows. Then again, taking the thought experiment of your comment as written, can a malware dev sue M$ for Windows Defender blocking and/or removing their software? Also, "being sued" isn't a very strong litmus test on its own. Anyone can be sued for anything at anytime.
    - ineedasername 5y ago
      I'm not sure why Google should be any more or less accountable than Microsoft when malware lands on a Windows PC. Both provide some minimal level of malware protection but make no guarantees and rely on users to scrutinize app sources. Apple makes somewhat stronger claims of protection so there may be an argument for a higher level of responsibility on iOS and MacOS: >...users can access these apps on their Apple devices without undue fear of viruses, malware, or unauthorized attacks.... >...all apps are sandboxed—to provide the tightest controls... >...helps to ensure that these apps are free of known malware... >...macOS includes state-of-the-art antivirus protection to block—and if necessary remove—malware. [0] I'm still not sure that a claim of legal liability would hold up in court though. [0] https://support.apple.com/guide/security/app-security-overview-sec35dd877d0/web https://support.apple.com/guide/security/app-security-overvi...
      - rightbyte 5y ago
        That is not a fair comparison. A better one would be versus Apple store or MS' one. And yes, I think MS should be responsible for apps they are selling. Aswell as Apple or Google. Hiding behind adds and pretending it is no a proper sale and that they are mediators or whatever is BS.
        ineedasername 5y ago
        We're talking about two different things. You're saying they should be responsible. Ethically? Legally? I'm not sure which you mean, but probably both. That's not the question I was answering though. That question didn't specify the flavor of responsibility, and I chose to answer it from a mostly legal perspective, which is that as things stand they are probably, mostly, not liable. Traditional retail liability is probably the best place to look in this case. A store can be liable for the products it sells, but if it makes reasonable efforts to determine product safety then those are difficult cases to win unless you can show that the retailer knew, or should have known, that the product was defective or unsafe. One black & white example of that liability would be selling alcohol to underage kids who did not present any ID, or gave a fake ID. I think "reasonable precautions" is probably the best rule from a practical standpoint. But I'm not otherwise going to address where the line should be drawn on "reasonable" precautions. That's a complex question, individual examples and product classes would vary, and there are plenty of expensive court cases that have not yet produced a universal "bright line" standard for defining "reasonable" precautions.
    - sloshnmosh 5y ago
      Google is complicit in this by their refusal to ban larger app developers that create malicious apps. Google may kick the malicious app off the play store for a couple weeks and make the developer remove the malware (or obfuscate it better) but then allows the app(s) back to the play store.
eMGm4D0zgUAVXc7 5y ago
I am *very* surprised that the list of requested permissions on Google Play does *not* have to match the actual permissions which the app gets when installed. I would have thought that the list on Google Play is computed from the binary so it cannot be fake. Is it really true that you can just leave out permissions in this list and then just get them once people install your app?
- spockz 5y ago
  I expected it to work that what is listed in the marketplace is the design and when signing the app it includes the permissions as mentioned in the marketplace. If the binary requests different permissions they are rejected by the OS without prompting the users.
- TrianguloY 5y ago
  As far as I know (and I have quite a few apps on google play) the list is compiled from the apk itself. On android you need to specify all permissions in the manifest (a file in the app that describes what the app requires). If you don't and try to use it, the device rejects it. The play store description is a "human version" of the list. Some permissions are grouped and other ignored. The app from the post had a list of permissions declared in the manifest, and on first look it seem to match what play store shows. In any case: no, you can't leave out permissions and use them later. If you don't declare them, you can't use them. (At least not by normal means, it is possible with adb and root, and also by installing extra apps).
  - eMGm4D0zgUAVXc7 5y ago
    Thanks, but why does the post show two screenshots juxtaposed: - one labeled as "2FA Authenticator permissions disclosed on Google Play" - and the other as "2FA Authenticator permissions requested" They even made "disclosed" and "requested" bold to stress that there'd be a difference, and in fact the former list of permissions is shorter than the latter? You said that some permissions are "ignored". Is that the explanation? Where is a list of all Android permissions which are "ignored", i.e. not told to the user when installing apps? From the screenshots it looks like the permission to install software is part of whats lacking to be disclosed. That has a rather big security impact, why does Google ignore it? I can't believe Android is that insecure :(
bigyellow 5y ago
You're telling me a for-profit, closed source, proprietary application store where anyone can submit software and call it anything they want has perverse incentives? I'm shocked. Shocked, I tell you.
superasn 5y ago
So many such issues could be easily mitigated if we just moved away from apps to PWAs/Web apps with better support from mobile vendors for the push api, camera, etc - but the powers that be (Apple, Google, Microsoft) and also the sites (Reddit, Amazon, etc) want to move in the opposite direction because who cares about security and users when apps bring in the moolah. As a matter of fact sometimes the websites are so much better too, like Amazon, which doesn't even have a "Find.." function in the app. I really wish we could done be with these apps and everything just ran in the browser, except maybe apps that need some low level api or something.
- mrtksn 5y ago
  Aren't PWA's vulnerable to browser extension attacks?
- antihero 5y ago
  In order to compete with native apps the APIs would have to grow and thus the attack surface would also grow
- secondcoming 5y ago
  Such issues could be mitigated if Android didn't let it happen. It was pretty much impossible for this to happen with Symbian so there's really no excuse (maybe that's part of the reason it died)
- seanw444 5y ago
  And then there are those of us that hate that everything is made with Electron these days, so I say thank God they're not doing this.
JadeNB 5y ago
I thought we edited clickbait-y headlines like this. The name of the malicious app is "2FA Authenticator".

104 points by caaqil 5y ago

deleted 5y ago

[deleted]

It was discussed yesterday at https://news.ycombinator.com/item?id=30115132 https://news.ycombinator.com/item?id=30115132 which has 57 comments.

eMGm4D0zgUAVXc7 5y ago
The thread does not seem to answer the most interesting question: Is it really possible for app developers to leave out permissions in the list of requested permissions on Google Play and then get them nevertheless when the app is actually installed? See my other reply for a more lengthy description: https://news.ycombinator.com/item?id=30126488 https://news.ycombinator.com/item?id=30126488
- phh 5y ago
  No it's not possible. Google Play hides some permissions on its own, but very basic one (like the one allowing access to internet). That's it. The dangerous permissions mentioned in the article need to be manually enabled by the user, after installing the application.
- lnxg33k1 5y ago
  Another question would be: If google gives me an app from their official playstore, on their OS, should they be considered responsible for any loss that it causes to bank accounts, or we have given up accountability for big corps, hope regulators are sleeping well
  - izacus 5y ago
    Your thinking is kinda bizarre - why do you demand accountability from the store, not the author/creator of the malware app? For other products the accountability is always on the manufacturer/creator of the product - why, in software, do you all demand that big tech censors and polices what you're allowed to consume instead of actually punishing the wrongdoers who created malicious and dangerous software? Why can they just get away with zero accountability and you don't even spare a millisecond of thought?
    - lnxg33k1 5y ago
      Well, for one thing it's because I am forced to keep the play store on my phone without being able to uninstall it, along with Google play services, and also they are vetting all apps that gets to the google play store, and also the fact that they contiously bust balls justifying the existence of their ecosystem to safety and security of devices, are they allowed to have it both ways? So we need to keep them because of safety but like not really safety? More like safety of income stream for their shareholders?
    - petre 5y ago
      They charge 15-30% of the revenue so they should also be responsible. If they had offered a free service then no.
      - etchalon 5y ago
        All stores charge a markup.
        lnxg33k1 5y ago
        there are no more half-seasons
        withinboredom 5y ago
        No they don’t. Physical stores pay volume rates to the manufacturers. They own the inventory and resell it at a markup or a loss. The app stores do something totally different. They allow “manufacturers” to list the item directly to the consumer and charge 30% in money transmission (legal term) fees. They are basically offering the same service (and licenses) as Western Union (or stripe connect), just on a larger scale and more integrated. Whether they are actually legally set up that way (or not) I don’t know. I did go down this rabbit hole 10-15 years ago to do something similar with a lawyer. What could be interesting is if some states/countries have limits on the fees a money transmitter can charge and an app company sued for them operating illegally.
  - phh 5y ago
    I'm not aware of Microsoft ever being sued about the loss of malwares on Windows.
    - lnxg33k1 5y ago
      Windows is not vetting all apps, and is not forcing you to bribe them 30% of your sales to be on a store fully controlled by them But yeah, I think making corps accountable would be of great benefit to IT, if we start hitting them in the wallet I guess that's the only way to make security escape conferences and make it to software companies HQs I get to pay a corp to get a shitty product that makes me subject all sort of security issue, without being able to blame it on anyone, and in the end I have also to pay with my time because manager X didn't think that it was important to deliver a safe product. So yeah, I want to be paid for the time I have to spend to fix corps shits
      - phh 5y ago
        > Windows is not vetting all apps Actually, I'm pretty sure there has been some stuff that Microsoft signed, for which MS is paid (not 30% sure), that were malwares. But I'm too lazy to find it
    - dylan604 5y ago
      *loss from malwares on Windows. Then again, taking the thought experiment of your comment as written, can a malware dev sue M$ for Windows Defender blocking and/or removing their software? Also, "being sued" isn't a very strong litmus test on its own. Anyone can be sued for anything at anytime.
  - ineedasername 5y ago
    I'm not sure why Google should be any more or less accountable than Microsoft when malware lands on a Windows PC. Both provide some minimal level of malware protection but make no guarantees and rely on users to scrutinize app sources. Apple makes somewhat stronger claims of protection so there may be an argument for a higher level of responsibility on iOS and MacOS: >...users can access these apps on their Apple devices without undue fear of viruses, malware, or unauthorized attacks.... >...all apps are sandboxed—to provide the tightest controls... >...helps to ensure that these apps are free of known malware... >...macOS includes state-of-the-art antivirus protection to block—and if necessary remove—malware. [0] I'm still not sure that a claim of legal liability would hold up in court though. [0] https://support.apple.com/guide/security/app-security-overview-sec35dd877d0/web https://support.apple.com/guide/security/app-security-overvi...
    - rightbyte 5y ago
      That is not a fair comparison. A better one would be versus Apple store or MS' one. And yes, I think MS should be responsible for apps they are selling. Aswell as Apple or Google. Hiding behind adds and pretending it is no a proper sale and that they are mediators or whatever is BS.
      - ineedasername 5y ago
        We're talking about two different things. You're saying they should be responsible. Ethically? Legally? I'm not sure which you mean, but probably both. That's not the question I was answering though. That question didn't specify the flavor of responsibility, and I chose to answer it from a mostly legal perspective, which is that as things stand they are probably, mostly, not liable. Traditional retail liability is probably the best place to look in this case. A store can be liable for the products it sells, but if it makes reasonable efforts to determine product safety then those are difficult cases to win unless you can show that the retailer knew, or should have known, that the product was defective or unsafe. One black & white example of that liability would be selling alcohol to underage kids who did not present any ID, or gave a fake ID. I think "reasonable precautions" is probably the best rule from a practical standpoint. But I'm not otherwise going to address where the line should be drawn on "reasonable" precautions. That's a complex question, individual examples and product classes would vary, and there are plenty of expensive court cases that have not yet produced a universal "bright line" standard for defining "reasonable" precautions.
  - sloshnmosh 5y ago
    Google is complicit in this by their refusal to ban larger app developers that create malicious apps. Google may kick the malicious app off the play store for a couple weeks and make the developer remove the malware (or obfuscate it better) but then allows the app(s) back to the play store.

eMGm4D0zgUAVXc7 5y ago

I am *very* surprised that the list of requested permissions on Google Play does *not* have to match the actual permissions which the app gets when installed. I would have thought that the list on Google Play is computed from the binary so it cannot be fake. Is it really true that you can just leave out permissions in this list and then just get them once people install your app?

spockz 5y ago
I expected it to work that what is listed in the marketplace is the design and when signing the app it includes the permissions as mentioned in the marketplace. If the binary requests different permissions they are rejected by the OS without prompting the users.
TrianguloY 5y ago
As far as I know (and I have quite a few apps on google play) the list is compiled from the apk itself. On android you need to specify all permissions in the manifest (a file in the app that describes what the app requires). If you don't and try to use it, the device rejects it. The play store description is a "human version" of the list. Some permissions are grouped and other ignored. The app from the post had a list of permissions declared in the manifest, and on first look it seem to match what play store shows. In any case: no, you can't leave out permissions and use them later. If you don't declare them, you can't use them. (At least not by normal means, it is possible with adb and root, and also by installing extra apps).
- eMGm4D0zgUAVXc7 5y ago
  Thanks, but why does the post show two screenshots juxtaposed: - one labeled as "2FA Authenticator permissions disclosed on Google Play" - and the other as "2FA Authenticator permissions requested" They even made "disclosed" and "requested" bold to stress that there'd be a difference, and in fact the former list of permissions is shorter than the latter? You said that some permissions are "ignored". Is that the explanation? Where is a list of all Android permissions which are "ignored", i.e. not told to the user when installing apps? From the screenshots it looks like the permission to install software is part of whats lacking to be disclosed. That has a rather big security impact, why does Google ignore it? I can't believe Android is that insecure :(

bigyellow 5y ago

You're telling me a for-profit, closed source, proprietary application store where anyone can submit software and call it anything they want has perverse incentives? I'm shocked. Shocked, I tell you.

superasn 5y ago

So many such issues could be easily mitigated if we just moved away from apps to PWAs/Web apps with better support from mobile vendors for the push api, camera, etc - but the powers that be (Apple, Google, Microsoft) and also the sites (Reddit, Amazon, etc) want to move in the opposite direction because who cares about security and users when apps bring in the moolah. As a matter of fact sometimes the websites are so much better too, like Amazon, which doesn't even have a "Find.." function in the app. I really wish we could done be with these apps and everything just ran in the browser, except maybe apps that need some low level api or something.

mrtksn 5y ago
Aren't PWA's vulnerable to browser extension attacks?
antihero 5y ago
In order to compete with native apps the APIs would have to grow and thus the attack surface would also grow
secondcoming 5y ago
Such issues could be mitigated if Android didn't let it happen. It was pretty much impossible for this to happen with Symbian so there's really no excuse (maybe that's part of the reason it died)
seanw444 5y ago
And then there are those of us that hate that everything is made with Electron these days, so I say thank God they're not doing this.

JadeNB 5y ago

I thought we edited clickbait-y headlines like this. The name of the malicious app is "2FA Authenticator".