4 ms·

> A lot of malware works by getting the full consent of the user. Consent of the user to do what? If a program can't even ask permission to walk the entire fil

> A lot of malware works by getting the full consent of the user. Consent of the user to do what? If a program can't even ask permission to walk the entire filesystem, zip it up and encrypt it, then it simply can't do that at all. The user never even becomes a factor. I'll reiterate that I'm not saying all malware goes away, but entire classes of malware would cease to exist. > if you really require code to get permission for all resources they require customers will immediately look for ways to avoid having to manually do this step. If you go in your pocket, you'll find a compelling case study to the contrary. For the most part, permission grants are a one-time thing for any given service. They don't even register as a mild nuisance. > The problem is that malware has basically an infinite number of tries to get you to run something. As there is almost no consequence when they fail. And what does AV software do to solve either of these problems?

kenjackson 2y ago
Android vs iPhone is a great example of things in your pocket and malware. Both effectively run AV at store ingestion so users don’t have to think about malware at all. But Androids less constrained model has allowed malware to flourish on that platform despite capability checks. The only model that has worked in practice is the model where malware is checked upstream (eg during App Store ingestion) and users are never even offered it.
- Ajedi32 2y ago
  "Flourish" is a bit of an exaggeration. You have to jump through a lot of hoops to install malware of any significant capability on Android, ignoring like a half dozen red flags in the process. Obviously that's not going to be enough to stop everybody, but compared to Windows Android is practically malware-free. But yes, in a corporate environment it might be prudent to have some kind of policy restricting users from installing applications from non-approved sources (or at least limiting what permissions such unapproved applications can have). Thankfully the permissions model of Android makes such restrictions trivial to enforce and minimally inconvenient compared to what you have to do to get an inferior version of the same thing on Windows.
  - paulmd 2y ago
    For years (most recently 2021) Nokia’s threat assessment reports have android malware infection rates at over 50x iOS. iOS malware exists but it’s largely state-level actors going after dissidents or journalists (and apple provides tools to help fight that too, if you think you’re that kind of target). Android is actually an outright majority of all malware in the wild... 50.31% of all malware infestions, which includes windows, OSX, IOT, and all other sources (ie ios). https://vpnoverview.com/wp-content/uploads/nokia_threat_intelligence_report_2021_report_en.pdf https://vpnoverview.com/wp-content/uploads/nokia_threat_inte... (see also page 17-19 which discusses key threats and mitigation strategies, particularly surrounding the play store and the android ecosystem.) Pretty sure stalkerware is openly carried in the play store, it definitely is carried in some of the seedier stores. If you have actual data that contradicts this, fire away, but every time it's objectively measured android comes out way way way worse on the malware front.
    - Ajedi32 2y ago
      Well firstly, you're citing a study from a company that makes antivirus software for mobile phones. They have a vested interest in trying to convince you that such software is necessary. Secondly, the #1 and #2 "malware apps" in that report are parental control software, arguably not malware at all. Several more are ad click fraud related and have nearly zero security impact on the user on account of having no permissions other than internet access. I also didn't see any data in the report on how many of the handful of truly dangerous apps they listed were successful in getting the permissions needed to do any significant damage. Unlike with Windows, merely installing a malicious app on Android often isn't enough; that's the whole point of having a sandbox. Thirdly, the "50.31%" figure you're quoting is, again, skewed by the fact that this data is coming from a company that specializes in mobile anti-virus software and they don't seem to be normalizing by number of devices NetGuard Endpoint Security is installed on. (Do they even have an iOS app? The report doesn't seem to include data from iOS.)
- hulitu 2y ago
  > But Androids less constrained model has allowed malware to flourish on that platform despite capability checks. cough* NGO cough*
- deleted 2y ago
  [deleted]

kenjackson 2y ago

Android vs iPhone is a great example of things in your pocket and malware. Both effectively run AV at store ingestion so users don’t have to think about malware at all. But Androids less constrained model has allowed malware to flourish on that platform despite capability checks. The only model that has worked in practice is the model where malware is checked upstream (eg during App Store ingestion) and users are never even offered it.

Ajedi32 2y ago
"Flourish" is a bit of an exaggeration. You have to jump through a lot of hoops to install malware of any significant capability on Android, ignoring like a half dozen red flags in the process. Obviously that's not going to be enough to stop everybody, but compared to Windows Android is practically malware-free. But yes, in a corporate environment it might be prudent to have some kind of policy restricting users from installing applications from non-approved sources (or at least limiting what permissions such unapproved applications can have). Thankfully the permissions model of Android makes such restrictions trivial to enforce and minimally inconvenient compared to what you have to do to get an inferior version of the same thing on Windows.
- paulmd 2y ago
  For years (most recently 2021) Nokia’s threat assessment reports have android malware infection rates at over 50x iOS. iOS malware exists but it’s largely state-level actors going after dissidents or journalists (and apple provides tools to help fight that too, if you think you’re that kind of target). Android is actually an outright majority of all malware in the wild... 50.31% of all malware infestions, which includes windows, OSX, IOT, and all other sources (ie ios). https://vpnoverview.com/wp-content/uploads/nokia_threat_intelligence_report_2021_report_en.pdf https://vpnoverview.com/wp-content/uploads/nokia_threat_inte... (see also page 17-19 which discusses key threats and mitigation strategies, particularly surrounding the play store and the android ecosystem.) Pretty sure stalkerware is openly carried in the play store, it definitely is carried in some of the seedier stores. If you have actual data that contradicts this, fire away, but every time it's objectively measured android comes out way way way worse on the malware front.
  - Ajedi32 2y ago
    Well firstly, you're citing a study from a company that makes antivirus software for mobile phones. They have a vested interest in trying to convince you that such software is necessary. Secondly, the #1 and #2 "malware apps" in that report are parental control software, arguably not malware at all. Several more are ad click fraud related and have nearly zero security impact on the user on account of having no permissions other than internet access. I also didn't see any data in the report on how many of the handful of truly dangerous apps they listed were successful in getting the permissions needed to do any significant damage. Unlike with Windows, merely installing a malicious app on Android often isn't enough; that's the whole point of having a sandbox. Thirdly, the "50.31%" figure you're quoting is, again, skewed by the fact that this data is coming from a company that specializes in mobile anti-virus software and they don't seem to be normalizing by number of devices NetGuard Endpoint Security is installed on. (Do they even have an iOS app? The report doesn't seem to include data from iOS.)
hulitu 2y ago
> But Androids less constrained model has allowed malware to flourish on that platform despite capability checks. cough* NGO cough*
deleted 2y ago
[deleted]