4 ms·

> ThreatFabric detailed how the crooks behind Anatsa will purchase older, abandoned file managing apps, or create their own and let the apps build up a consider

> ThreatFabric detailed how the crooks behind Anatsa will purchase older, abandoned file managing apps, or create their own and let the apps build up a considerable user base before updating them with malicious components. Maybe it's time to turn off auto update for apps. Auto update is important from a security perspective but if the actor is bad, it might be better to wait and update on demand to catch up with missing fratures and by that time hopefully the malicious app has been removed from the app store. Of course this would only work for standalone apps. Similar to how we often have intermediate package managers that pin packages to a particular version to not get malware injected one day.

EGreg 3y ago
Auto-updating should be tied to audits by reputable third parties, to sign off on a release. At least two. Why isn’t this fone?
- xena 3y ago
  Not doing that is cheaper and there's no regulation that forces companies to do those audits to get things released. We live in capitalism where cheaper wins.
  - EGreg 3y ago
    Forget government force, I am talking about industry standards and defaults. People have RedHat, Apple and others for distributing stable app and service versions with operating systems. Same principle should apply to package managers. How can a low-level package break or poison 40,000 other repos overnight? This culture of Tweeting at 5 am to 5 million people before the truth has a chance to get its pants on is defended in the name of “freedom of speech”, but I much prefer the peer review gated approach of science. Not one monopoly gatekeeper but at least 2 reputable ones, before your OS or package manager allows the download (but users can override it if they insist). I think rpm and yum do that..
    - jstarfish 3y ago
      Supply chain attacks are a thing in Linux too. Some activist clown tried to brick devices with Russian or Belarusian IPs in the same manner. This system is compromised.
- Knee_Pain 3y ago
  Yes, just audit a 1M LoC app every 2 weeks!
moomoo11 3y ago
Or just use iOS and text, take photos, and use big name apps only like IG. I used to be into phones. These days I use $150-200 used iPhone SE (2020). Don’t care if I drop it or break it. And it takes decent photos (not amazing, not terrible). And it’s small.
- kbenson 3y ago
  Just because this article references Android doesn't mean iOS is without its own security issues.[1] The "just use iOS" portion of your advice may be a bit optimistic. 1: https://www.wired.com/story/kaspersky-apple-ios-zero-day-intrusion/ https://www.wired.com/story/kaspersky-apple-ios-zero-day-int...
- Knee_Pain 3y ago
  Ok? Or buy a Samsung and only use Samsung's native apps?
- kramerger 3y ago
  This sort of things happens on iOS also. The big difference is that Google is open while Apple tries to hide it. The Xcode ghost incident for example affected half a billion installs and 100M users: https://www.intego.com/mac-security-blog/xcodeghost-malware-infected-100-million-ios-users-and-apple-said-nothing/ https://www.intego.com/mac-security-blog/xcodeghost-malware-... Regarding big name apps... Well, WhatsApp on iOS has been the main attack vector for state actors for a few years now. https://thedefenceworks.com/blog/zero-click-infection-and-whatsapps-latest-breach/ https://thedefenceworks.com/blog/zero-click-infection-and-wh...
  - DANmode 3y ago
    https://petapixel.com/2017/10/28/developer-shows-iphone-apps-secretly-watching/ https://petapixel.com/2017/10/28/developer-shows-iphone-apps... https://www.reddit.com/r/uberdrivers/comments/74i782/ubers_ios_app_had_secret_permissions_that_allowed/ https://www.reddit.com/r/uberdrivers/comments/74i782/ubers_i...
Terr_ 3y ago
> Maybe it's time to turn off auto update for apps. It's very frustrating that I cannot specifically exclude certain apps from auto-updates. Android forces me to either permit blanket auto-updates, or to click through a big list of pending updated, where a single mis-tap will permanently update the wrong app with no easy way to undo or downgrade.
- throwaway290 3y ago
  Why do you need to use auto updates? I am on manual and go through the list of pending updates every few weeks. Takes 2 min. I can't believe how vendors have gaslit people into "auto updates are the only way" Release notes is MUCH bigger problem. App stores should show a history of every update issued since your current version. Also, ban devs who just write useless two word "Bug fixed" release notes.
- DANmode 3y ago
  > Android forces me to It does no such thing. Google does.
- sagz 3y ago
  You most definitely can exclude specific apps from auto update on the Play Store. Go to the app's Play listing page and tap on the overflow menu in the top right (vertical ellipses) and uncheck "Enable auto update".

EGreg 3y ago

Auto-updating should be tied to audits by reputable third parties, to sign off on a release. At least two. Why isn’t this fone?

xena 3y ago
Not doing that is cheaper and there's no regulation that forces companies to do those audits to get things released. We live in capitalism where cheaper wins.
- EGreg 3y ago
  Forget government force, I am talking about industry standards and defaults. People have RedHat, Apple and others for distributing stable app and service versions with operating systems. Same principle should apply to package managers. How can a low-level package break or poison 40,000 other repos overnight? This culture of Tweeting at 5 am to 5 million people before the truth has a chance to get its pants on is defended in the name of “freedom of speech”, but I much prefer the peer review gated approach of science. Not one monopoly gatekeeper but at least 2 reputable ones, before your OS or package manager allows the download (but users can override it if they insist). I think rpm and yum do that..
  - jstarfish 3y ago
    Supply chain attacks are a thing in Linux too. Some activist clown tried to brick devices with Russian or Belarusian IPs in the same manner. This system is compromised.
Knee_Pain 3y ago
Yes, just audit a 1M LoC app every 2 weeks!

moomoo11 3y ago

Or just use iOS and text, take photos, and use big name apps only like IG. I used to be into phones. These days I use $150-200 used iPhone SE (2020). Don’t care if I drop it or break it. And it takes decent photos (not amazing, not terrible). And it’s small.

kbenson 3y ago
Just because this article references Android doesn't mean iOS is without its own security issues.[1] The "just use iOS" portion of your advice may be a bit optimistic. 1: https://www.wired.com/story/kaspersky-apple-ios-zero-day-intrusion/ https://www.wired.com/story/kaspersky-apple-ios-zero-day-int...
Knee_Pain 3y ago
Ok? Or buy a Samsung and only use Samsung's native apps?
kramerger 3y ago
This sort of things happens on iOS also. The big difference is that Google is open while Apple tries to hide it. The Xcode ghost incident for example affected half a billion installs and 100M users: https://www.intego.com/mac-security-blog/xcodeghost-malware-infected-100-million-ios-users-and-apple-said-nothing/ https://www.intego.com/mac-security-blog/xcodeghost-malware-... Regarding big name apps... Well, WhatsApp on iOS has been the main attack vector for state actors for a few years now. https://thedefenceworks.com/blog/zero-click-infection-and-whatsapps-latest-breach/ https://thedefenceworks.com/blog/zero-click-infection-and-wh...
- DANmode 3y ago
  https://petapixel.com/2017/10/28/developer-shows-iphone-apps-secretly-watching/ https://petapixel.com/2017/10/28/developer-shows-iphone-apps... https://www.reddit.com/r/uberdrivers/comments/74i782/ubers_ios_app_had_secret_permissions_that_allowed/ https://www.reddit.com/r/uberdrivers/comments/74i782/ubers_i...

Terr_ 3y ago

> Maybe it's time to turn off auto update for apps. It's very frustrating that I cannot specifically exclude certain apps from auto-updates. Android forces me to either permit blanket auto-updates, or to click through a big list of pending updated, where a single mis-tap will permanently update the wrong app with no easy way to undo or downgrade.

throwaway290 3y ago
Why do you need to use auto updates? I am on manual and go through the list of pending updates every few weeks. Takes 2 min. I can't believe how vendors have gaslit people into "auto updates are the only way" Release notes is MUCH bigger problem. App stores should show a history of every update issued since your current version. Also, ban devs who just write useless two word "Bug fixed" release notes.
DANmode 3y ago
> Android forces me to It does no such thing. Google does.
sagz 3y ago
You most definitely can exclude specific apps from auto update on the Play Store. Go to the app's Play listing page and tap on the overflow menu in the top right (vertical ellipses) and uncheck "Enable auto update".