Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

App Store-Aided Mobile Attacks

kdawson posted more than 4 years ago | from the so-simple-a-kiddie-could-do-it dept.

Cellphones 186

Trailrunner7 sends along a ThreatPost.com piece that begins "The pace of innovation on mobile phones and other smart wireless devices has accelerated greatly in the last few years. ... But now the attackers are beginning to outstrip the good guys on mobile platforms, developing innovative new attacks and methods for stealing data that rival anything seen on the desktop, experts say. This particular attack vector — introducing malicious or Trojaned applications into mobile app stores — has the potential to become a very serious problem, researchers say. Tyler Shields, a security researcher at Veracode who developed a proof-of-concept spyware application for the BlackBerry earlier this year, said that the way app stores are set up and their relative lack of safeguards makes them soft targets for attackers. ... 'There are extremely technical approaches like the OS attacks, but that stuff is much harder to do,' Shields said. 'From the attacker's standpoint, it's too much effort when you can just drop something into the app store. It comes down to effort versus reward. The spyware Trojan approach will be the future of crime. Why spend time popping boxes when you can get the users to own the boxes themselves? If you couple that with custom Trojans and the research I've done, it's super scary.'"

cancel ×

186 comments

fp!! (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#32248646)

FP! fIRST POST

I like the yum "app store" (3, Interesting)

FranTaylor (164577) | more than 4 years ago | (#32248686)

All the packages are signed and I can rebuild anything I want from scratch.

Adobe uses it to update Flash and Reader on my systems, they don't need to support an update installer.

I have no doubt that the same type of system can serve palmtop systems well.

Re:I like the yum "app store" (3, Insightful)

mrsteveman1 (1010381) | more than 4 years ago | (#32248862)

They already sign the code, some of the app stores even require business documents before you're allowed to put anything up.

Having source is a plus but this is commercial software we're talking about, you don't have the source for the 2 things you mentioned, Reader and Flash. Besides that, having the source isn't guaranteed to protect you, companies have been obfuscating the hell out of source code for a while now. All they really need to do is get users to install the binary first, and then it's a waiting game to see if anyone actually reads the source and finds the evil lines, if they ever do. By then, millions of users have installed the app or the updated app (the first version doesn't need to be malicious) and had their info stolen, etc.

Re:I like the yum "app store" (1)

FranTaylor (164577) | more than 4 years ago | (#32249026)

Well I wouldn't want to build Flash or Reader from scratch so what I said is true. Source is optional for yum but of course it can be required by the repository.

The nice thing about yum is you use it to update the system packages, and third parties can use the same system to update their software. All they have to do is drop a file in /etc/yum.d and their "app store" is visible to all the package installation tools.

Re:I like the yum "app store" (4, Funny)

Anonymous Coward | more than 4 years ago | (#32249512)

companies have been obfuscating the hell out of source code for a while now

I believe it's called outsourcing.

Re:I like the yum "app store" (0)

Anonymous Coward | more than 4 years ago | (#32249742)

LOL! It's so true it hurts. Someone mod this guy up!

Re:I like the yum "app store" (1)

Attila Dimedici (1036002) | more than 4 years ago | (#32251706)

More importantly, the "source code" they give you may or may not match the binary they give you.

Re:I like the yum "app store" (3, Funny)

tsm_sf (545316) | more than 4 years ago | (#32249534)

Since Apple has an apparently arduous approval process for their app store, I'm assuming that they guarantee everything against this sort of foolishness. I didn't bother to read the 92 page EULA that went along with it, but they're an honorable company, right?

Re:I like the yum "app store" (4, Insightful)

eggnoglatte (1047660) | more than 4 years ago | (#32249692)

Well, FWIW, it is kind of hard to do much damage if the app can't run in the background due to lack of multithreading.

No, I don't have an iPhone, iPod, or iPad. I am just getting tired of the same old tirades from both sides.

Re:I like the yum "app store" (1)

FictionPimp (712802) | more than 4 years ago | (#32251208)

maybe your app could just assume everyone is jailbroken (everyone I know with an iphone is jailbroken) and run a process in the background anyway.

Re:I like the yum "app store" (1)

fredmosby (545378) | more than 4 years ago | (#32249910)

I think source code availability might actually make it easier for someone to write a trojan. Without it they would have to write a program from scratch that looks like a legitimate program. If they can get the source code all they have to do is make some small modifications, release it under a different name for free, and by the time people realize what's going on the damage is already done.

I've always wondered (2, Insightful)

norpy (1277318) | more than 4 years ago | (#32248708)

I've always wondered why deliberate exploits hadn't been included in seemingly safe app store apps that allowed access to forbidden api's and did naughty things always sorta amazed me.

I guess I wasn't the only person who thought of that.

Re:I've always wondered (2, Interesting)

s73v3r (963317) | more than 4 years ago | (#32249200)

Maybe the screening process has been working?

Re:I've always wondered (2, Interesting)

norpy (1277318) | more than 4 years ago | (#32249622)

The screening process is on the binary, it is very hard to detect some crappy code that is intended to cause a buffer overflow.

That would still limit you to userland exploits, but it would definately allow some malicious code to be injected through a server request that could access phonebook/etc and then send it back home all without the naughty code ever existing in the application that was submitted to Apple.
This code would be all but invisible since the timebomb and malicious payload are controlled remotely.

It would be nice for someone in the know to weigh in about apple's code execution security for appstore apps.

iPhone Banker Trojan? (5, Informative)

Graff (532189) | more than 4 years ago | (#32248722)

From the article:

Banker Trojans targeting platforms such as the iPhone

[citation needed] [xkcd.com]

I poked around the internets a bit and only found a mention or two for iPhone trojans. These trojans were ONLY on jailbroken iPhones, not un-jailbroken ones that are using the iPhone App Store. As far as I know there have never been any "banker" trojans in the iPhone App Store.

This article seems to be riding the coattails of the iPhone's popularity by throwing it in the mix with other platforms that have had "banker" trojans. If they have evidence of an iPhone App Store trojan I'd love for them to directly mention it rather than being vague and doing a lot of hand-waving.

Re:iPhone Banker Trojan? (3, Informative)

s73v3r (963317) | more than 4 years ago | (#32249210)

There have been some for Android [wired.com] . At least 2, which posed as fake banking apps. They have been removed for a while now, however.

Re:iPhone Banker Trojan? (1)

_Sprocket_ (42527) | more than 4 years ago | (#32249618)

Actually, if you read through the linked article(s), you'd find out that it's two banks that put out alerts. Digging deeper, the developer put out around 50 apps that Google pulled when notified by one of the banks. What the apps actually did is in question. All the banks knew was that they didn't produce the apps that purportedly accessed their services. And that caused concern.

So if they weren't malicious, why do them? From the article:

"Lots could be going on here," he said. "09Droid may simply have been trying to cash in by offering apps that do nothing but provide a shortcut to the online bank's site, which the user could reach himself in the browser."

Under that scenario, 09Droid was out for a quick buck -- literally -- by charging users 99 cents for applications that, while harmless, only added a shortcut icon to the phone's desktop.

Re:iPhone Banker Trojan? (2, Interesting)

R3d M3rcury (871886) | more than 4 years ago | (#32249360)

Well, this isn't quite as serious as Bank Trojans, but Storm8 [inquisitr.com] is infamous for stealing phone numbers from their customers. And this is with the all-mighty App Store in place.

Re:iPhone Banker Trojan? (2, Insightful)

Graff (532189) | more than 4 years ago | (#32250282)

Yeah, there has been some poaching of the bit of info that apps can tap into. I know Apple tightened up on that though and there's a lot less that an app can get at.

There's no doubt that the App Store gatekeepers are a necessary evil. Hopefully they do just enough and not a bit more in keeping bad apps out and still allowing good apps in.

Re:iPhone Banker Trojan? (2, Informative)

nahdude812 (88157) | more than 4 years ago | (#32250908)

Android's Market tells you exactly what an app can and can't access before you install it. In order to access certain classes of API, the app has to include this access in its manifest file or the API's aren't available. Examples include location (there are two tiers: rough network-based, and precise GPS based), phone (again, two tiers: phone state [usually to do things like pause music when the phone rings], and the ability to place/receive calls), network access, storage (read or modify SD card contents), SMS, camera access, contact data, calendar, email, phone sleep functions, and so forth.

Those access levels are detailed here:
http://developer.android.com/reference/android/Manifest.permission.html [android.com]

Certain accesses are considered sensitive, and will be specifically brought to the user's attention before they install the app. Other controls (such as access to the phone's vibrate function) aren't, and although you can look to see if the app uses those functions, you're not bothered to verify that this is ok first.

So if an app wanted to poach your phone number, etc. on Android, it would basically have to advertise to you that it's doing so or it wouldn't have that level of access.

That said, I do wish there was a way to *block* those accesses.

Re:iPhone Banker Trojan? (2, Interesting)

netsavior (627338) | more than 4 years ago | (#32251206)

yeah something combining android's manifest and blackberry's application permissions screen would be really nice... They each have half of the puzzle. BB lets you block permissions by application to certain functions (like gps, phone, etc) but it is not smart enough to know which of those things the app might try to do.

Re:iPhone Banker Trojan? (3, Insightful)

MidnightBrewer (97195) | more than 4 years ago | (#32249578)

Yeah, this entire story is kind of supporting Steve Jobs' obsessive control of the closed App Store. My iPhone has no viruses.

It does have Plants vs. Zombies, though.

Re:iPhone Banker Trojan? (1)

nahdude812 (88157) | more than 4 years ago | (#32251020)

I don't agree. Sure, it's acceptable to have a walled garden, and to even make it the case that by default you can only wander the carefully groomed paths in that space. But if you want to peek over the wall, or even exit the garden, you should be permitted to. Sure, raise a few warning "Oh no's, nobody can tell you whether these apps out there have thorns or not," screens. But don't prevent me from leaving or else what you have is actually a carefully tended prison (it's even called jailbreaking when you exit the approved area).

For especially sensitive apps (eg, banking), most people will generally understand that you should stick to the official app store. But thinking that any entity is immune to fraud being perpetrated against it is naive. We see big corporations like Verisign - whose whole job is to verify identity before issuing a certificate - issuing certificates for people who don't have the proper credentials.

Certainly we have not seen Apple exercising consistency in what it approves and rejects for the app store, so it doesn't seem like they're really looking all that closely anyway.

We've solved issues related to trust a long time ago for SSL (at least as strongly as the walled garden app store solves it); there's no reason to reinvent the wheel here in a way that locks down consumer property against their will.

Re:iPhone Banker Trojan? (1)

Bakkster (1529253) | more than 4 years ago | (#32251500)

I don't agree. Sure, it's acceptable to have a walled garden, and to even make it the case that by default you can only wander the carefully groomed paths in that space. But if you want to peek over the wall, or even exit the garden, you should be permitted to. Sure, raise a few warning "Oh no's, nobody can tell you whether these apps out there have thorns or not," screens. But don't prevent me from leaving or else what you have is actually a carefully tended prison (it's even called jailbreaking when you exit the approved area).

Why enter the walled garden and complain that you can't peek over the hedge, when you have an alternative right next door (Android) that you didn't choose?

Apple is free to do whatever they want with their walled garden, and you are free to go elsewhere. So, why not just encourage people to go to the solution which isn't a walled garden, rather than trying to break down the walls you know aren't coming down?

Open Store, Open Door... (4, Insightful)

LostCluster (625375) | more than 4 years ago | (#32248728)

As much as we hate Apple's walled-garden approach to an app store, having a central authority with a kill switch for any app, plus limited multitasking ability, plus developers tied to using the app store's preferred programming language and tools are all things that stand in the way of a would be trojan spyware author. As Apple claims, jailbreaking your iPhone could all "the enemy" to do what they want with it, and that could crush poor little American Telegraph and Telephone Co.'s network.

Google touts openness, and Microsoft touts the power of a free-market of commercial software, both of which provide nice benefits to the consumer, but also to the hacker who wants to compromise user privacy. Has anybody looked into the Facebook apps on these platforms?

Re:Open Store, Open Door... (3, Interesting)

grcumb (781340) | more than 4 years ago | (#32248880)

As much as we hate Apple's walled-garden approach to an app store, having a central authority with a kill switch for any app, [etc....] are all things that stand in the way of a would be trojan spyware author.

Perhaps, but if you cast your net a little wider, you'll realise that the main thing required is a viable process. Autocratic centralised control is just one of a number of different and equally effective means of managing security for end users. Debian, Ubuntu, Fedora and countless other community-maintained repositories have historically sustained a commendable level of security in their vast software collections. They've built up so much trust, in fact, that the trust itself has become a peculiar kind of strength [imagicity.com] .

Re:Open Store, Open Door... (3, Insightful)

Anonymous Coward | more than 4 years ago | (#32249040)

The only way the three systems you mentioned would detect a rogue package update, would be from open-source coders reviewing the original codebase. Maintainers don't often examine code -- often, they are even incapable of it.

So what do you get when that update comes from (A) a closed-source application, or (B) a solo-programmed OSS project? You get hell, that's what you get.

Also, a bit of perspective. The last I heard (years ago), Debian had 17,000 packages. How many do you think the iPhone has?

On the App Store, Wikipedia says: [wikipedia.org] As of April 8, 2010, there are at least 185,000 third-party applications officially available on the App Store, with over 4 billion total downloads.

It's not nearly as simple a situation as you make it to be.

Re:Open Store, Open Door... (1)

QuantumG (50515) | more than 4 years ago | (#32249190)

There's a web of trust backed up with digital signatures. So if someone finds a trojan in some code in the repository they can track back where it came from. It's actually happened once or twice and the response was incredible.

Re:Open Store, Open Door... (0)

Anonymous Coward | more than 4 years ago | (#32249276)

I don't understand what your point was meant to be. Yes, if someone somehow detects an app doing undesirable things -- infeasible in itself, due to closed nature of iPhone, and 'spinoff' processes/files -- then Apple can pull that app. But by then, it's too late! The damage has been done.

What do you do when Update 73 installs a waiting backdoor that activates on Dec 1st, and Update 74 removes the code that installed it on Nov 30th? Only solution is filesystem tracking. Does the iPhone do that? Does Linux? (OK, Linux can log it, maybe, but the iPhone can't.)

Re:Open Store, Open Door... (0, Troll)

QuantumG (50515) | more than 4 years ago | (#32249424)

I was talking about linux distro repositories. I expect Apple can't do anything (right).

Re:Open Store, Open Door... (0)

Anonymous Coward | more than 4 years ago | (#32249538)

Upon reflection, I think my confusion can be blamed upon myself. When I said, "the only way to detect a rogue update ... is from reviewing code," what I actually meant was reviewing code before the update goes live. I don't really take chances with compromised systems, even after isolation and fixes. Nuke it from orbit, I say.

Re:Open Store, Open Door... (0, Offtopic)

the_womble (580291) | more than 4 years ago | (#32249364)

here are at least 185,000 third-party applications officially available on the App Store

If wonder how many there are if you exclude things that should not need an app - e.g. newspaper apps that provide the same content you can see on the website.

Re:Open Store, Open Door... (1)

mirix (1649853) | more than 4 years ago | (#32249570)

You forgot to exclude the 100,000 fart apps too.

Re:Open Store, Open Door... (0)

Anonymous Coward | more than 4 years ago | (#32249634)

And how many of those 17,000 Debian packages are just libraries, or similar 1K LoC programs like you mention, or font or other asset providers?

I know many of those iPhone apps are probably bogus (my estimation: 10,000-15,000 legitimate) but I still believe it to amount to much more than that of Linux distros.

Plus, short of Apple abandoning all its older applications and issuing new "application qualification" standards, it has to live with reality: that 1 out of 185,000 of these hello-world-in-complexity apps can own the phone.

Re:Open Store, Open Door... (0, Troll)

Anonymous Coward | more than 4 years ago | (#32249432)

There is no difference between jailbreaking and placing a world writable anonymous FTP directory on a machine with a root account with no password onto the Internet. Both just attract blackhats, and allow them to use the item as a staging point for attacks. For good measure, perhaps a bash shell hanging off the telnet port.

Jailbreaking is something that should bring criminal charges. It puts vital communication systems in jeopardy, allows malware authors easy access, and violates IP laws.

Re:Open Store, Open Door... (1)

jedidiah (1196) | more than 4 years ago | (#32251156)

Steve? Is that you?

BTW, the jailbreak doesn't "expose" anything. It's the sshd package that does that.

Jailbreaking is more like enabling another 3rd party storefront that doesn't belong to Apple.

Re:Open Store, Open Door... (1)

DrugCheese (266151) | more than 4 years ago | (#32249514)

As much as we hate Apple's walled-garden approach to an app store, having a central authority with a kill switch for any app, plus limited multitasking ability, plus developers tied to using the app store's preferred programming language and tools are all things that stand in the way of a would be trojan spyware author.

Know what would really stand in their way? Not having mobile devices. Then they'd have a hard time doing anything malicious with it since we wouldn't even own them. Oh wait, yeah, we wouldn't own them.

Re:Open Store, Open Door... (4, Interesting)

mjwx (966435) | more than 4 years ago | (#32249664)

Google touts openness,

Android has on-device security which let the user know, in simple English what the application will do ("can access your contacts", "uses services that cost you money (SMS, makes phone calls)", "will access the internet") so when you download a fart application that wants access to your contacts and to the internet you have to figure out something isn't right.

As much as we hate Apple's walled-garden approach to an app store, having a central authority with a kill switch for any app,

But that isn't so useful as Apple's walled garden approach has forgone local security in favour of gateway only security, once you've gotten past the censors you have a free reign. Enterprises have known for some time that gateway only security is a complete and utter failure. You need both gateway and local security, which Android provides both although the gateway security is entirely voluntary (but enabled by default).

There have already been data miners for the Iphone that have gotten past Apple's ever watchful censors including at least one fake banking application (BOA, IIRC). This isn't including data miners like Arsebook.

Ultimately gateway and local security is preferred for end users, one should have a choice whether to use the gateway or not but local security is an absolute must, especially on a mobile device. Despite how good you think your gateway is it is fundamentally flawed.

Re:Open Store, Open Door... (1)

mgblst (80109) | more than 4 years ago | (#32250524)

OK, so I don't hide my trojan in a fart app, I hide it in an app that backs up your contacts to the web, or another dialer.

Re:Open Store, Open Door... (1)

phillymjs (234426) | more than 4 years ago | (#32250862)

There have already been data miners for the Iphone that have gotten past Apple's ever watchful censors including at least one fake banking application (BOA, IIRC).

Link, please. Because I remember hearing that fake banking apps were a problem on Android. I certainly never heard that one was out in the app store for the iPhone, and I think that would have been pretty big news.

Re:Open Store, Open Door... (0)

technomom (444378) | more than 4 years ago | (#32251282)

This link [infosecurity-us.com] and this one [pcworld.com]

Re:Open Store, Open Door... (3, Informative)

Wovel (964431) | more than 4 years ago | (#32251524)

This link [infosecurity-us.com] and this one [pcworld.com]

Did you read the articles you linked? Clearly state the apps only targeted jailbroken iPhones. This means they were not distributed through the app store and not in any way relevant.

Re:Open Store, Open Door... (1)

Wovel (964431) | more than 4 years ago | (#32251558)

..I forgot to mention in my response below..the PC World article is discussing a Windows Trojan....

Re:Open Store, Open Door... (1)

jedidiah (1196) | more than 4 years ago | (#32251104)

Except taking that quasi-mac and just dumping the Big Brother approach works equally well.

All of the justifications for the fascist nonsense depend entirely on ignoring all of the well engineered alternatives to Windows and pretending like they either don't exist or don't have the same vulnerabilities.

In order to elevate the new messiah, the cult needs to deny the old one.

This study brought to you by the fine folks at... (0, Flamebait)

Anonymous Coward | more than 4 years ago | (#32248740)

Apple, the company with an app-store you can trust.

Trust US to provide you with a safe, secure environment for your mobile needs.

We know best.

Apple.

=)

That was a close call (4, Insightful)

Gadget_Guy (627405) | more than 4 years ago | (#32248772)

Wow. I was going to download some apps from one of those app stores. I can't believe I nearly exposed my phone to something even more dangerous than anything on my PC. In future, I am going to just limit myself to downloading whacky screensavers for my Windows system, because that is totally unlike downloading an app for my phone.

Seriously, I can't believe the gall of those attention-seeking media whores who call themselves security experts. Years after we have been able to download applications for phones, some nitwit finally realises that one of those apps could be harmful. All they have to do is blow the danger out of all proportion and wait for the stupid media to lap up the story.

"But this time it is different - instead of downloading the app from a website, you get them from an app store!" Yeah, right.

Re:That was a close call (1, Insightful)

Culture20 (968837) | more than 4 years ago | (#32248844)

"But this time it is different - instead of downloading the app from a website, you get them from an app store!" Yeah, right.

But it is different; because of perception. People think "Oh, the Apple App store; everything here has been thoroughly vetted by Apple and given the thumbs-up" when in reality, the vetting process is: "does it crash? does it look like it does what it says?" and maaaybe: "are there any obvious hooks into user data that the stated purpose of the App doesn't need?" Almost assuredly nothing that checks for obfuscated code,

Re:That was a close call (0, Troll)

Cryacin (657549) | more than 4 years ago | (#32248878)

You missed "will it displease the all knowing, all mighty overlord and ruler of the universe, Grand Poobah Steve Jobs."

That one's important.

Re:That was a close call (1)

CoffeeDog (1774202) | more than 4 years ago | (#32249866)

Easy, just hide the code that steals the user's information inside a giant fart button and it'll whisk through the approval process without anyone thinking twice about it.

Re:That was a close call (2, Insightful)

Anonymous Coward | more than 4 years ago | (#32248900)

The real power behind the Apple vetting process has nothing to do with what Apple does, it's what Apple has: Your bank routing #, social, full name, address...and yes, they have all this of mine.

So if a fly by night app store that lets anyone submit apps without any process and may not collect this information for all app submitters has an app with a virus - they remove it. Apple could quite possibly notify the authorities of your location.

I'm not saying Apple vetting process is foolproof, or that this would stop all attacks, but by collecting this information you're a lot more likely to be able to hold people accountable for crap they do than otherwise.

Just my $0.02.

Re:That was a close call (1)

Black Gold Alchemist (1747136) | more than 4 years ago | (#32249446)

Well, identity theft makes up the difference. And most people writing trojans probably have easy ways to get stolen IDs.

Re:That was a close call (1)

Low Ranked Craig (1327799) | more than 4 years ago | (#32248920)

As far as you know. Who knows what they might be looking for? http://reviews.cnet.com/8301-19512_7-10400276-233.html [cnet.com]

Re:That was a close call (0)

Anonymous Coward | more than 4 years ago | (#32249112)

Don't tell me, in all seriousness, that you think Apple can reliably detect backdoor or virus activities in a pre-compiled, machine-code binary. If Apple discovered a way to do so, I will hail them as Programming Gods, and permanently switch away from my laptop, and to the iPhone.

Re:That was a close call (2, Funny)

Techman83 (949264) | more than 4 years ago | (#32249128)

"does it crash? does it look like it does what it says?"

Guess that's why Flash is denied.

Re:That was a close call (2, Insightful)

phantomfive (622387) | more than 4 years ago | (#32249168)

I don't know if it's that bad. If Bank of America creates an App that lets me access their bank, I might use it (assuming I had an iPhone). I think it is reasonable to assume that Apple would not let anyone but Bank of America create the Bank of America app. If there is another app that asks for my bank account info, I'm going to be really suspicious. So there is some security built into the app store, even if they don't verify every line of code.

Re:That was a close call (0)

Anonymous Coward | more than 4 years ago | (#32249522)

Yeah, and that's a nice way to blow up apps count. Instead of one banking application that work's with every bank, get one app for each bank under the sun. Oh, and the one app for all banks is called... web browser.

Re:That was a close call (4, Insightful)

gig (78408) | more than 4 years ago | (#32249198)

That is bullshit. They not only check for malware, they even check for privacy violations and use of unfinished API's that may break in a future OS release. The whole app platform was designed for approvals.

You can't say iPhone is doing it wrong because it's not open on one day and then say it's just as vulnerable to malware as Android the next. We know Apple is not as vulnerable because they have not had any malware through 2 years of a billion downloads and over 200,000 apps, while Android Market has served malware with significantly fewer apps and downloads. And most of Apple's users do not know WTF "malware" is, which is why they do it this way.

Re:That was a close call (1)

Black Gold Alchemist (1747136) | more than 4 years ago | (#32249464)

We know Apple is not as vulnerable because they have not had any malware through 2 years of a billion downloads and over 200,000 apps, while Android Market has served malware with significantly fewer apps and downloads.

That we know of. Maybe an app has already swiped everyone's info secretly. We don't know.

Re:That was a close call (1, Insightful)

Anonymous Coward | more than 4 years ago | (#32251504)

FUD

Re:That was a close call (0)

Anonymous Coward | more than 4 years ago | (#32249796)

That is bullshit. They not only check for malware, they even check for privacy violations and use of unfinished API's that may break in a future OS release. The whole app platform was designed for approvals.

It's not bullshit. How would Apple detect an app that computes the address of a hidden API function at runtime? Apple does this for author benefit, not any real security sense. Claiming they can detect malware in high accuracy is just so ignorant it hurts.

We know Apple is not as vulnerable because they have not had any malware through 2 years of a billion downloads and over 200,000 apps, while Android Market has served malware with significantly fewer apps and downloads.

This is wrong. There has been several data mining apps for the iPhone that I have heard of, and I know very little. Android was detected, because the platform offers native permission abilities, and it's inherently more open and with a userbase consisting of Slashdot (read:techy) types.

there are no gays in the military (0)

Anonymous Coward | more than 4 years ago | (#32249886)

No spyware on the iPhone at all..oh wait
http://i-phone-home.blogspot.com/ [blogspot.com]

the app store is rife with it

Re:there are no gays in the military (1)

Wovel (964431) | more than 4 years ago | (#32251676)

Rife based on a blog article that does not mention a single app or what it does that is malicious?

People keep making these claims, it is fairly clear they are all BS..

Re:That was a close call (0)

Anonymous Coward | more than 4 years ago | (#32250522)

You can say it's vulnerable if there is evidence to support that claim, though.

It is vulnerable. They can't check for a certain class of malware: apps that maliciously use public APIs.

The reason is that they don't review source code. Their binary inspection tools and test processes are unlikely to detect every outcome of an application, especially since it's not hard to make an application simply not do anything malicious during the review process.

Unless their procedures have been substantially tightened, things like this [wired.com] are possible.

Can you support the assertion that they 'check for privacy violations'? How would they do that?

Re:That was a close call (1)

Timmmm (636430) | more than 4 years ago | (#32250652)

That is next to impossible. Consider an app that backs up your SMSs to gmail. There's one for android, I don't know if this is 'allowed' on the iPhone. Anyway, it has a perfectly legitimate reason to

a) Access your SMSs, phone number etc.
b) Access the internet.

There's no way you or Apple can tell whether it will also send those messages to the hacker's own server unless you have the source code (and even then it would be prohibitively expensive for Apple to audit it). If you're thinking "but ... wireshark... " you're not being imaginative enough.

Another example on android would be a keyboard replacement with ads in the settings menu. It has a legitimate reason to see everything you type, and contact the internet.

Re:That was a close call (1)

IamTheRealMike (537420) | more than 4 years ago | (#32250794)

They don't check for privacy violations, go read the iPhone Privacy white paper. There are about a million ways an iPhone app can violate your privacy without you (or apple) ever knowing about it.

Re:That was a close call (1)

jrumney (197329) | more than 4 years ago | (#32249380)

You missed "does it use, or was it originally written to target, Flash?"

Re:That was a close call (1)

Wovel (964431) | more than 4 years ago | (#32251594)

Sorry..I did not see anything in the article to suggest any danger from Apples App store..

Starting at $59.99 (2, Insightful)

Anonymous Coward | more than 4 years ago | (#32248800)

Norton AntiVirus: iPhone edition.

Re:Starting at $59.99 (2, Interesting)

Culture20 (968837) | more than 4 years ago | (#32249014)

Norton AntiVirus: iPhone edition.

Symantec Endpoint Protection, iPhone Edition has scanned its own jail space and found no viruses. Would you like to enable real-time protection (until you close the SEP iPhone Edition App)?

there's only one way (and it's imperfect) (1, Interesting)

Anonymous Coward | more than 4 years ago | (#32248830)

Do not run software for which a sufficient number of trusted parties cannot examine its source.

Yes maybe most people haven't the know how to examine it. But that doesn't matter - what matters is simply that enough people *do* who have no vested interest in jacking your machine. With enough eyes, malicious code will often be spotted.

I say often because even that isn't foolproof, it's just better than the alternative of "blind trust in the app developer".

Maintaining control of your own machine using a network of human trust is the only way, short of writing your OS yourself. And surely giving control of your machine to unknown parties without such trust is a bad idea.

Oh, and diversity of ecosystems helps as well. Monocultures are inherently dangerous.

A problem, but not really new (1)

SnowZero (92219) | more than 4 years ago | (#32248890)

This is not really any different from the thousands of "kitten screensavers" and other "utility" programs you could download off the internet for windows desktops.

On blackberry? Not so much (4, Informative)

Jeffrey Baker (6191) | more than 4 years ago | (#32248932)

Any app on the blackberry requires user intervention before it's allowed to fetch URLs, open raw sockets, read email, dial the phone, get your location, manipulate the address book, or do any other damned thing. And 90% of the APIs require the developer to be vetted through the app signing process. It actually seems much less vulnerable to trojans and spyware than a PC.

Re:On blackberry? Not so much (1, Insightful)

Anonymous Coward | more than 4 years ago | (#32249718)

Any app on the blackberry requires user intervention before it's allowed to fetch URLs, open raw sockets, read email, dial the phone, get your location, manipulate the address book, or do any other damned thing. [...] It actually seems much less vulnerable to trojans and spyware than a PC.

That does not mean much for a trojan. A trojan could masquerade as some tool or game that 'needs' access to all of these, and the Trojan user would happily grant it those rights.

This is why Android could take over the market. (1)

Old Flatulent 1 (1692076) | more than 4 years ago | (#32248944)

It comes down to if you cannot see the source don't trust it. As long as blackhat crooks are out there making closed binaries there will be problems with trojans. If Google is smart they will insist that all code must be visible to operate on the Android OS. Perhaps Rim will follow suit and make sure that all third party binaries are clean. I know this really irks some developers but if your code is clean, unique and has a copyright why are you afraid that others will see it?

Re:This is why Android could take over the market. (3, Insightful)

Jeremi (14640) | more than 4 years ago | (#32249034)

It comes down to if you cannot see the source don't trust it.

... and even if you can see the source, you still can't trust it. Unless you are an expert in the source's programming language, AND you are willing to spend several dozen hours doing a line-by-line review of all of the source code, most exploits are still going to walk right by you. A "mistake" that opens up a security hole can be very subtle; indeed that's why so many honest developers end up releasing security holes by mistake.

And that's not even counting the second issue: how do you verify that the source code you are reading actually corresponds with the executable your computer is going to run? If you download both source and executable, it could be that the source is clean, but the executable contains a back door. Even if you compile the source code yourself, it could be that the code exploits a bug (or backdoor) in your compiler to implement behavior different from what the source code indicates.

Re:This is why Android could take over the market. (2, Interesting)

migla (1099771) | more than 4 years ago | (#32250222)

As was all ready mentioned, it's about having a security process. This can be implemented regardless of openness.

If more open "stores", such as Android or Maemo/MeeGo or Debian or whatever don't yet have as rigorous a process as Apple, they should get busy of course.

Regarding any discrepancy between source and binary, you should obviously just upload the source to the store and have the store build the binary.

Re:This is why Android could take over the market. (1)

bit01 (644603) | more than 4 years ago | (#32250700)

... and even if you can see the source, you still can't trust it.

The decision is not binary. You can trust it more. Depending on the source a lot more.

AND you are willing to spend several dozen hours doing a line-by-line review of all of the source code

Astroturfers love to push this dishonest nonsense. Again pushing the false dichotomy. And pretending that open source doesn't give the entire world, billions of people, access for review.

Closed source means only the vendor can review it. Open source means any number of groups can review it, including the original source. At the very least it is no worse than closed source.

---

Open source software is everything that closed source software is. Plus the source is available.

Re:This is why Android could take over the market. (2, Funny)

Culture20 (968837) | more than 4 years ago | (#32249042)

Sounds like what you want is Gentoo: phone edition. Plug in your phone, type emerge --sync && emerge phone-image on the PC, wait overnight while the image compiles, then dd onto /dev/phone. If it crashes, do another emerge --sync and see if emerge phone-image compiles something new, then dd that. Call^W Email work and tell them you'll be late because you're compiling your phone OS again. They'll understand.

Re:This is why Android could take over the market. (0)

Anonymous Coward | more than 4 years ago | (#32249106)

It comes down to if you cannot see the source don't trust it.

An one can point to numerous examples that show the fallacy of this thinking. The Debian openssl fiasco is a prime example.

I know this really irks some developers but if your code is clean, unique and has a copyright why are you afraid that others will see it?

Who says they are afraid?

Re:This is why Android could take over the market. (1)

mjwx (966435) | more than 4 years ago | (#32249724)

It comes down to if you cannot see the source don't trust it. As long as blackhat crooks are out there making closed binaries there will be problems with trojans. If Google is smart they will insist that all code must be visible to operate on the Android OS. Perhaps Rim will follow suit and make sure that all third party binaries are clean. I know this really irks some developers but if your code is clean, unique and has a copyright why are you afraid that others will see it?

RIM cant follow suit because their OS is based on WinCE. Fundamentally incompatible with open licenses. Plus RIM make money of selling hardware and services that rely on their products having no viable third party server software, fundamentally incompatible with the ideas of an open codebase.

Android has always won in the security stakes because Android has on device security. Android checks what API's the program accesses, if it asks for access to your contacts, to the internet or to services that will cost you money (phone calls, SMS's) then you know at installation time. This system is not infallible, nothing is but it is a hell of a lot better then the gateway only model Apple uses.

Apple User 1: This food looks poisoned and smells of death.
Apple User 2: The gatekeeper said it's OK.
Apple User 1: om nom nom nom nom, URK...

Apple's model of no local security is wrong. Any networked operating system should be built with security from the ground up. I fear with enough users, the Iphone OS may become as insecure as Windows not because it sacrifices a good security model for user friendliness wherever possible but because it gives it's users a false sense of security.

Re:This is why Android could take over the market. (2, Insightful)

Graff (532189) | more than 4 years ago | (#32250390)

It comes down to if you cannot see the source don't trust it.

And when is the last time you looked at every single line of code for a major open-source application and made sure that it was totally and completely safe? Do you just use them, assuming that someone else [developer.com] did it for you [developer.com] ?

The fact is that we all trust the developers at some point, it doesn't matter if it is open or closed source. At least with a major author they have a physical presence, buildings, investors, publicly traded, cash in the bank. If they do something underhanded you have stuff you can go after. In open source yeah you have code that people can look at but you also have the possibility of some anonymous person who works a sneaky backdoor into the code. Then when it all goes kablooey there's no one whose feet can be held to the fire.

I'm not saying that either closed or open source is better than the other, just that both have many good and bad points. You can't automatically assume that open source is better. Either way it helps to have safeguards in place, like an app review process and the ability to quickly remove malware from devices.

Freedom for all (0)

Anonymous Coward | more than 4 years ago | (#32249068)

Our freedom to run whatever apps we want is more important than some little security issue.

They should do what Google does (1)

obarthelemy (160321) | more than 4 years ago | (#32249090)

and just sponsor a couple of OSes and a browser pretty much dedicated to ratting on you.

Perhaps this will evolve into something beneficial (4, Insightful)

Dr_Marvin_Monroe (550052) | more than 4 years ago | (#32249124)

I agree with the poster that the economics of attacks is definitely in favor of the Trojan vs. the technical attack. It's scary how many people install junk on their computers, and it's not getting any better. Even I do it sometimes without knowing 100% who's behind some utility or patch that I want. This is the approach that pays off easy too. Why bother trying to sneek into their box when the user's will install your bug for you?

In nature though, some of these parasites actually evolve into beneficial bugs. The take their little bit, but they also do some extra bit for the host. Both sides win, this is symbiosis. Imagine that the SETI@home also defragmented your disks or optimized performance some how in exchange for running on your system, same thing.

Now consider for a second that Conficker patched some security holes after entering the host system....Isn't it doing some little bit of good? Not wanting it on my box, just showing how Conficker's security is also beneficial to the host machine. Their goals align... Consider also, how does Google's goals align with mine when I use online Docs?

I think there will be a real blending here. Trojans will get more beneficial and less intrusive, people will tolerate them because they do something useful, and a new class of free (as in beer) software will evolve.

Clearly unfair to Apple (5, Insightful)

gig (78408) | more than 4 years ago | (#32249306)

You can't tell me how wrong Apple is for having a closed store with strict app approvals and how other mobile makers will outdo Apple with their open stores and then wrote a malware-scare article about how app stores are too open and lump Apple in with everyone else. It's one or the other. Everyone else has Jas apps you can install from the Web and Apple has C apps you can't.

Apple has an actual record here. They've been malware-free 100% for 2 years, 200,000 apps, over 1 billion downloads, with consumer users who don't know what malware is, doing 1-click installs.

How you can write an article like this saying "app stores should be more closed" and not mention Apple's is closed is beyond me.

And there has been no native malware on iPhone. Also bullshit.

And although Apple may not strictly guarantee zero malware, they are actively policing every app. To pretend that's like having no cops, as on the other platforms, is ridiculous.

Awful article. Just fucking awful. Do some fucking research!

Re:Clearly unfair to Apple (4, Insightful)

Rocketship Underpant (804162) | more than 4 years ago | (#32251362)

My guess: there's a rather popular hate-the-leader bandwagon among certain geeks. You see this on Reddit a lot, where anything critical of the iPhone or iPad gets modded up immediately whether it's insightful or not.

This author is probably part of that bandwagon, desperately trying to stitch together a premise (open app stores are an opportunity for trojans) and an incorrect conclusion (fear the iPhone!) with no logical connection. Why else use App Store like a proper noun in the title, knowing full-well that most people will immediately assume the iPhone/iPad App Store?

Anyone who's owned a Mac a long time and constantly been lectured by their PC-using friends that "Macs are just as susceptible to viruses" even though no one gets viruses on their Macs while PCs are like leper colonies for malware knows this full well.

Re:Clearly unfair to Apple (1)

jittles (1613415) | more than 4 years ago | (#32251508)

But we know that there is data mining going on with the iPhone. There are advertising networks that developers use to handle their in-app ads and those networks have been mining peoples data since 2.0 first came out.

Open Source (1)

jprupp (697660) | more than 4 years ago | (#32249426)

It'be interesting to have open source packages clearly specified in the app store, especially Android's app store. Maybe even an option to only show open source software could help. How much malware do you see in your typical Ubuntu, Debian, or Fedora repository?.

Re:Open Source (1)

Wovel (964431) | more than 4 years ago | (#32251756)

More than on the iPhone :)

There's an APP FOR THAT too (0)

Anonymous Coward | more than 4 years ago | (#32249562)

What rong with dat?

Your Ukraine Saint
Vito

Not surprising (0)

Anonymous Coward | more than 4 years ago | (#32249620)

A friend of mine recently had a spam email go out to everyone in his address book. The reason? A paid app from the Apple store he'd installed had stolen all his personal info from his phone and returned it to the app creator. That app is still in the store today, the company basically offered a bunch of free stuff and promised not to do it again. The only advice I could offer was - how much did he feel his personal information is worth?

So what, precisely, does the reassurance of a signed app from the Apple store get you? That's right, you're reassured that the app is signed!

Re:Not surprising (1)

RMH101 (636144) | more than 4 years ago | (#32249900)

what was the app? name it, please.

Re:Not surprising (1)

gyrogeerloose (849181) | more than 4 years ago | (#32251374)

what was the app? name it, please.

He can't because it doesn't exist. That's why he posted AC.

Now this? (1)

hellop2 (1271166) | more than 4 years ago | (#32249690)

Et tu, Fartapp?

Bad apps that don't work are in the store... (2, Informative)

seifried (12921) | more than 4 years ago | (#32250016)

I was testing SSH clients for the iPhone so I bought about a half dozen, one of them flat out didn't work (filled out the problem form, no response). One didn't allow you to change the port to something other than 22. Only one app allowed you to import a key. Only one (a different one) allowed you to have more than one key. In other words one was completely broken, one was arguably missing basic functionality and all were missing common functionality. In other words the quality was abysmal.

I also tried to contact them, one had a website listed that was several years out of date and had no contact info (no names, emails, phone numbers, nothing). Not exactly inspiring of trust.

Based on this I can simply say I will not use them, for one thing they don't work terribly well. But mostly because who knows what they do in the background. Perhaps every 50th connection, assuming it is a Tuesday they send your connection details (user name, password, IP, etc.) in an outgoing packet to the bad guy that wrote the app.

I actually regret going with the iPhone (not that the android is much better in this respect). I'm so used to Open Source software having to use a closed source application from a basically unknown source (as opposed to someone who is at least known and ideally has a decent reputation they want to protect) is foreign to me and to be honest a deal breaker.

Re:Bad apps that don't work are in the store... (1)

MrCrassic (994046) | more than 4 years ago | (#32251166)

Why do you need a SSH client when you can just download OpenSSH and use command line via Saurik's MobileTerminal?

Re:Bad apps that don't work are in the store... (1)

jittles (1613415) | more than 4 years ago | (#32251526)

Maybe he's like me and is annoyed at having to re-jailbreak the phone every time theres any sort of update?

Re:Bad apps that don't work are in the store... (1)

MrCrassic (994046) | more than 4 years ago | (#32251590)

That's a good point; I use T-Mobile on my iPhone, so I don't take that waiting into account.

Re:Bad apps that don't work are in the store... (1)

FictionPimp (712802) | more than 4 years ago | (#32251238)

If you don't want to jailbreak, I recommend issh. Works great for me.

Android and Manifest (0)

Anonymous Coward | more than 4 years ago | (#32250076)

Android is a bit better equiped from that point of view: with a VM and a Manifest saying what an application can do.

If you take an app that is supposed to do something but is allowed to do something else, you can be very warry, as the reviewer will be.

For the App Store, there is nothing like that, which probably makes it harder to detect clever malware.

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...