Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google can kill or install apps on citizen Androids

theregister.co.uk

Post reply on HN
Print view View original

21–30 of 31 posts

Re: Google can kill or install apps on citizen Androids

#21

Post by dinedal »

ergo98 wrote: post #12
dinedal wrote: post #4

Earlier quoted context omitted.

They haven't had to because they stop this stuff before it happens. The cost of keeping the Apple App Store clean of malicious software is placed on the developers who are forced to wait for approval. The cost of keeping the Android App Market clean is placed on the users who will have to deal with the malicious apps that haven't been pulled yet. Freedom isn't free it seems. Does anyone know if Google can pull apps t…

>They haven't had to because they stop this stuff before it happens. How does Apple stop malicious software? No one has ever claimed that. Apple's review process doesn't validate that the software does what it claims it does, beyond the superficial.

I did a little googling, and found plenty of articles on Android's Marketplace having malicious software, but only articles along the lines of "Researcher says IPhone Data Model Could Lead to Malware" (http://www.pcworld.com/article/183741/researcher_says_iphone...) for the iPhone.

As far as I can tell, the iPhone has only been hit by malware when jailbreaking is involved. Maybe I'm missing it, but considering that minor infections in the Android market have made headlines, I imagine I would fine something for Apple too.

P.S. I'm hardly pro Apple, I have a Droid. I'm just saying that the probably do check for this sort of thing, because it's impossible in my mind for some one not to have tried to submit malware to the App store.

Re: Google can kill or install apps on citizen Androids

#22

Post by pistoriusp »

ergo98 wrote: post #12
dinedal wrote: post #4

Earlier quoted context omitted.

They haven't had to because they stop this stuff before it happens. The cost of keeping the Apple App Store clean of malicious software is placed on the developers who are forced to wait for approval. The cost of keeping the Android App Market clean is placed on the users who will have to deal with the malicious apps that haven't been pulled yet. Freedom isn't free it seems. Does anyone know if Google can pull apps t…

>They haven't had to because they stop this stuff before it happens. How does Apple stop malicious software? No one has ever claimed that. Apple's review process doesn't validate that the software does what it claims it does, beyond the superficial.

If you could somehow find a loophole within the scope of Apple's public APIs - Then sure... You could do something malicious.

Re: Google can kill or install apps on citizen Androids

#23

Post by nnash »

gojomo wrote: post #19

So perhaps the next time Chinese hackers penetrate Google, they can brick every Android device on the way out.

The chinese have balls when it comes to hacking, but not that much balls. If, and it would be, the bricking was traced back to the Chinese there would be a major international shitstorm about the Chinese "Declaring war on open technology, and American consumer electronics."

Re: Google can kill or install apps on citizen Androids

#24

Post by rbanffy »

gojomo wrote: post #19

So perhaps the next time Chinese hackers penetrate Google, they can brick every Android device on the way out.

To be fair, they could build the backdoor into the phone when it's manufactured. No need to use Google as their middleman.

All you need is a routine in the radio firmware that recognizes a specific signal and either turns off the radio or flood the towers with traffic. Better yet - request instructions from a server and deploy resources according to the plans they get - communications meltdown, massive DDoS on critical services, you name it.

And since it's in the radio controller, it's pretty much hidden from view. You can root your Android phone or jailbreak your iPhone all you want, the radio controller is pretty much a separate computer.

Re: Google can kill or install apps on citizen Androids

#25

Post by ergo98 »

pistoriusp wrote: post #22
ergo98 wrote: post #12

Earlier quoted context omitted.

>They haven't had to because they stop this stuff before it happens. How does Apple stop malicious software? No one has ever claimed that. Apple's review process doesn't validate that the software does what it claims it does, beyond the superficial.

If you could somehow find a loophole within the scope of Apple's public APIs - Then sure... You could do something malicious.

The description of "malicious" seems a little nebulous.

I have never heard of an Android application that breaks out of the sandbox. When people talk about "malicious" applications, these are apps that don't actually do what they promise to do, and because of an overly generous user (who okayed excessive permissions) they exploit trust.

This is similar to a web site saying "Hey, add me to your trust zone" (in Internet Explorer) "and I'll be extra awesome", and then exploiting that access.

Another poster mentioned that location has a special confirmation security grant, which is interesting to learn, however for other accesses there is no guarantee that the app is doing everything in your best interest.

Re: Google can kill or install apps on citizen Androids

#27

Post by ErrantX »

yanw wrote: post #18
ErrantX wrote: post #16

Earlier quoted context omitted.

I am a massive Google fan. But I know a number of people who are not and prefer not to "trust" them with data. Most have android phones because they feel similarly about Apple. This would horrify them. Admittedly that's an overreaction. But I can't help feeling that a persistent connection with little option/choice is not the sort of thing a free platform should have.

I think it's actually a necessity specially for an open platform, imagine if a malicious app got loose and they couldn't do anything about it. It's a 'damned if you do, damned if you don't' situation.

Well if I wrote a malicious app my first approach would be to kill that connection :)

So it is something of a false security.

Besides; to fit with the whole "ethos" of the Android system it should be an optional feature (App Kill and App install).

Re: Google can kill or install apps on citizen Androids

#28

Post by jsz0 »

ergo98 wrote: post #12
dinedal wrote: post #4

Earlier quoted context omitted.

They haven't had to because they stop this stuff before it happens. The cost of keeping the Apple App Store clean of malicious software is placed on the developers who are forced to wait for approval. The cost of keeping the Android App Market clean is placed on the users who will have to deal with the malicious apps that haven't been pulled yet. Freedom isn't free it seems. Does anyone know if Google can pull apps t…

>They haven't had to because they stop this stuff before it happens. How does Apple stop malicious software? No one has ever claimed that. Apple's review process doesn't validate that the software does what it claims it does, beyond the superficial.

Apple has rejected some apps for uploading the users contacts to a third party server, using private APIs, etc. It seems like they do dig a little deeper. Who knows if that's enough to stop all malicious software but considering we've seen a number of malicious Android apps (fake Bank of America app, proof of concept botnet) it does seem like Apple's review process is providing some real benefits to go along with it's real disadvantages.

Re: Google can kill or install apps on citizen Androids

#29

Post by miles »

yanw wrote: post #18
ErrantX wrote: post #16

Earlier quoted context omitted.

I am a massive Google fan. But I know a number of people who are not and prefer not to "trust" them with data. Most have android phones because they feel similarly about Apple. This would horrify them. Admittedly that's an overreaction. But I can't help feeling that a persistent connection with little option/choice is not the sort of thing a free platform should have.

I think it's actually a necessity specially for an open platform, imagine if a malicious app got loose and they couldn't do anything about it. It's a 'damned if you do, damned if you don't' situation.

I'm tired of these excuses for software makers to have more and more control over the devices we own.

Palm OS phones like the Treo never had any remote kill switch or other such nonsense. Anyone could develop for it and post their apps wherever they pleased. There was no gatekeeper to be be paid or placated, nor were there any super-scary viruses that brought down the network.

If this kind of Orwellian control is "a necessity specially for an open platform", why not allow Linux vendors the same power over your servers and workstations? After all, "imagine if a malicious app got loose and they couldn't do anything about it".

Seriously: it is up to the users to exercise good judgement and safe computing practices. If an infected phone is causing problems, let the carrier disconnect it (just like ISPs disconnect problem accounts). Turning power over to someone else is just another example of the nanny mentality. Not to mention that the back doors themselves may be exploited by malware.

Re: Google can kill or install apps on citizen Androids

#30

Post by gojomo »

rbanffy wrote: post #24
gojomo wrote: post #19

So perhaps the next time Chinese hackers penetrate Google, they can brick every Android device on the way out.

To be fair, they could build the backdoor into the phone when it's manufactured. No need to use Google as their middleman. All you need is a routine in the radio firmware that recognizes a specific signal and either turns off the radio or flood the towers with traffic. Better yet - request instructions from a server and deploy resources according to the plans they get - communications meltdown, massive DDoS on critic…

Plausible deniability is an important difference. Factory-implanted backdoors ruin a commercial relationship -- and could be discovered before deployment.

On the other hand, subverting Google's own official 'kill-switch' at a later date could be the work of a lone vandal or disgruntled employee, and reflects more negatively on Google than manufacturers.

(BTW, I have nothing against Chinese hackers specifically; they're just a usefully vivid example from recent events. The same observation goes for any person or entity that gets momentary control of the official platform-wide revocation mechanism. Its mere existence, for either the iOS or Android ecosystems, makes it a super-juicy target for evildoers.)

Post reply on HN