3 ms·

> Apple will never open up the ipad because that's not what it's for. It's for media consumption and running paid apps via the app store. The limitation is tha

> Apple will never open up the ipad because that's not what it's for. It's for media consumption and running paid apps via the app store. The limitation is that you can't execute code you download off of random sites on the internet. The amount of Android malware that relies on the ability to download random code and execute it is massive. >One of the keys to Joker’s success is its roundabout way of attack. The apps are knockoffs of legitimate apps and, when downloaded from Play or a different market, contain no malicious code other than a “dropper.” After a delay of hours or even days, the dropper, which is heavily obfuscated and contains just a few lines of code, downloads a malicious component and drops it into the app https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker... As they mention, this family of Android malware has been around forever, yet it still shows up regularly in the Play Store. >Known as Joker, this family of malicious apps has been attacking Android users since late 2016 and more recently has become one of the most common Android threats.

smoldesu 4y ago
On the iPad, you don't even need the App Store as a vector to install malware. As long as your iCloud account is syncing iMessage, you're susceptible to the same exploit chains that Pegasus used months ago (and presumably future encoder bugs, despite Apple's sandboxing efforts). Using malware as an excuse to stop sideloading is a scare tactic. It's this generation's terrorism scare, but malware still grips both systems all the same. Apple can keep their current defaults, but being forced to jump through a bajillion hoops just to install gimped software is a disservice to the iPad as a device. Even Microsoft is willing to let you run Linux on their tablets. All of this is not to say that Apple will unlock the iPad. It's the right thing to do, but since when has Apple erred on the side of customer freedom?
- GeekyBear 4y ago
  >malware still grips both systems all the same The amount of malware that regularly shows up in the Google Play Store is so large that tech sites have taken to warning users to be careful what they install from inside Google's walled garden. >With malicious apps infiltrating Play on a regular, often weekly, basis, there’s currently little indication the malicious Android app scourge will be abated. That means it’s up to individual end users to steer clear of apps like Joker. The best advice is to be extremely conservative in the apps that get installed in the first place. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker... It's not that it's never happened in Apple's App Store, but it's certainly not something that happens on a weekly basis. As that article points out, an Android apps ability to download code from random locations on the internet, install it and then execute it is a big source of the problem.
  - saagarjha 4y ago
    Changing the behavior of an app post-review is possible on both platforms.
    - GeekyBear 4y ago
      The issue isn't changing the behavior of the app. The issue is installing and executing code that wasn't present when the app was reviewed.
      - saagarjha 4y ago
        Code is behavior, and behavior is code. There's really no difference in the end when you can ship an interpreter runtime in your app.
        GeekyBear 4y ago
        There seems to be a big enough difference that Ars Technica felt they needed to warn users that they could not trust apps from inside Google's walled garden. >“Joker is one of the most prominent malware families that continually targets Android devices,” Zscaler researcher Viral Gandhi wrote in last week’s post. “Despite awareness of this particular malware, it keeps finding its way into Google’s official application market by employing changes in its code, execution methods, or payload-retrieving techniques.” The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
        saagarjha 4y ago
        To be entirely honest I don't really like the chances of people finding what they want on the App Store either, since it's not all that hard to accidentally be mislead into downloading the wrong app, or one that is filled with ads or IAP scams. One large difference from Android is that the [iOS] platform will prevent certain easily-abusable behaviors, which is a genuine point. But "oh my app does something else after it was reviewed" is a problem on both platforms.

smoldesu 4y ago

On the iPad, you don't even need the App Store as a vector to install malware. As long as your iCloud account is syncing iMessage, you're susceptible to the same exploit chains that Pegasus used months ago (and presumably future encoder bugs, despite Apple's sandboxing efforts). Using malware as an excuse to stop sideloading is a scare tactic. It's this generation's terrorism scare, but malware still grips both systems all the same. Apple can keep their current defaults, but being forced to jump through a bajillion hoops just to install gimped software is a disservice to the iPad as a device. Even Microsoft is willing to let you run Linux on their tablets. All of this is not to say that Apple will unlock the iPad. It's the right thing to do, but since when has Apple erred on the side of customer freedom?

GeekyBear 4y ago
>malware still grips both systems all the same The amount of malware that regularly shows up in the Google Play Store is so large that tech sites have taken to warning users to be careful what they install from inside Google's walled garden. >With malicious apps infiltrating Play on a regular, often weekly, basis, there’s currently little indication the malicious Android app scourge will be abated. That means it’s up to individual end users to steer clear of apps like Joker. The best advice is to be extremely conservative in the apps that get installed in the first place. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker... It's not that it's never happened in Apple's App Store, but it's certainly not something that happens on a weekly basis. As that article points out, an Android apps ability to download code from random locations on the internet, install it and then execute it is a big source of the problem.
- saagarjha 4y ago
  Changing the behavior of an app post-review is possible on both platforms.
  - GeekyBear 4y ago
    The issue isn't changing the behavior of the app. The issue is installing and executing code that wasn't present when the app was reviewed.
    - saagarjha 4y ago
      Code is behavior, and behavior is code. There's really no difference in the end when you can ship an interpreter runtime in your app.
      - GeekyBear 4y ago
        There seems to be a big enough difference that Ars Technica felt they needed to warn users that they could not trust apps from inside Google's walled garden. >“Joker is one of the most prominent malware families that continually targets Android devices,” Zscaler researcher Viral Gandhi wrote in last week’s post. “Despite awareness of this particular malware, it keeps finding its way into Google’s official application market by employing changes in its code, execution methods, or payload-retrieving techniques.” The best advice is to be extremely conservative in the apps that get installed in the first place. A good guiding principle is to choose apps that serve a true purpose and, when possible, choose developers who are known entities. Installed apps that haven’t been used in the past month should be removed unless there’s a good reason to keep them around. https://arstechnica.com/information-technology/2020/09/joker-the-malware-that-signs-you-up-for-pricey-services-floods-android-markets/ https://arstechnica.com/information-technology/2020/09/joker...
        saagarjha 4y ago
        To be entirely honest I don't really like the chances of people finding what they want on the App Store either, since it's not all that hard to accidentally be mislead into downloading the wrong app, or one that is filled with ads or IAP scams. One large difference from Android is that the [iOS] platform will prevent certain easily-abusable behaviors, which is a genuine point. But "oh my app does something else after it was reviewed" is a problem on both platforms.