Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android wallpaper app that steals your data was downloaded by millions

mobile.venturebeat.com

Post reply on HN
Print view View original

11–20 of 60 posts

Re: Android wallpaper app that steals your data was downloaded by millions

#11

Post by TeHCrAzY »

jlgosse wrote: post #3

If this is true, I'm disturbed by the fact that: 1. Google has failed to tell any of us this, 2. I don't even know if I had any of the vendor's applications in the past, as they have been removed entirely, AND 3. Google has failed to tell any of us this! I mean what the hell, at least send us an email telling us that because we downloaded AppXYZ, our data has been compromised by some low-life(s) in China. I'm going t…

It's quite clearly stated, when you install an app from the market, what permissions is it requesting. If your wallpaper app wants to know your location, SMS content etc etc, and you still install it, more fool you.

Re: Android wallpaper app that steals your data was downloaded by millions

#12

Post by cubicle67 »

It collects ... your voice mail password

Do the security dialogs reflect the differing levels of importance of the data you're providing access to? If an app is requesting access to my voice mail password, I'd expect a pretty big red strobe light stuck on the dialog; something to really catch your attention, especially if you're trying to 'yes' your way through 9 (number stated by jsz0 for Google Maps) of the things

Re: Android wallpaper app that steals your data was downloaded by millions

#13

Post by TeHCrAzY »

jsz0 wrote: post #4
there wrote: post #2

so what were the security permissions requested by this app at the time of installation? i have to imagine that if it was taking web browsing history that it would have needed more permissions than just "uses network data". android's fine-grained security permissions, where the author has to explicitly request each type (network use, prevent the screen from turning off, etc.) and the user is shown the list of permiss…

It's a rarity to see any Android app that doesn't require half a dozen different permissions. I just installed the Google Maps update and it requires 9 including the ability to read my phone call logs (??)

The google apps are an outlier in my experience so far. They tend to ask for many indepth permissions. Most apps just want full network access (for ad's) and sometimes phone call state/sdcard access etc.

Re: Android wallpaper app that steals your data was downloaded by millions

#14

Post by orangecat »

I'm pretty sure the article is not entirely accurate. There are several apps from "Jackeey Wallpaper" in the Android Market, all of which seem to be apps to download wallpapers of various themes. The dozen or so I've checked have these permissions: - "modify/delete SD card contents" - "coarse (network based) location" - "full Internet access" - "read phone state and identity"

As far as I know none of those allow reading your browser history or text messages, and certainly not your voicemail password. We need to see a network capture of what was sent to their site.

Re: Android wallpaper app that steals your data was downloaded by millions

#15

Post by orangecat »

there wrote: post #2

so what were the security permissions requested by this app at the time of installation? i have to imagine that if it was taking web browsing history that it would have needed more permissions than just "uses network data". android's fine-grained security permissions, where the author has to explicitly request each type (network use, prevent the screen from turning off, etc.) and the user is shown the list of permiss…

users either don't read, don't care, or don't understand what is being asked of them and they just click whatever is needed to continue.

True. That's sort of ok as long as advanced users can tell when something fishy is going on and flag the app.

even an advanced user can't tell the difference between a free app requesting network access to download advertisements and a malicious one using it to upload private information.

Also true. The Internet and SD card permissions are all-or-nothing, and therefore essentially useless. Apps should be able to declare that they only contact specific hosts or access specific directories, and there should be a standardized directory for per-app storage, like "Application Support" on OS X.

Re: Android wallpaper app that steals your data was downloaded by millions

#17

Post by papertiger »

maxjg wrote: post #5
there wrote: post #2

so what were the security permissions requested by this app at the time of installation? i have to imagine that if it was taking web browsing history that it would have needed more permissions than just "uses network data". android's fine-grained security permissions, where the author has to explicitly request each type (network use, prevent the screen from turning off, etc.) and the user is shown the list of permiss…

Just out of curiosity, when an android app is updated, how are permissions handled? Do you receive a prompt to allow new privileges, or does it assume you approve of it already? You bring up an astute point on the vague "network access" permission, but there's really not an easy answer to this. How would you fix it? Ask the developer to simply say what the access will be used for? In an malicious app, they'd obviousl…

Maybe treating any ad network component as a "sub-app" with separate permissions would make it more obvious when a request for network access is unwarranted. As to how something like that might be implemented... I have no idea.

I suspect people would ignore it anyway.

Re: Android wallpaper app that steals your data was downloaded by millions

#18

Post by orangecat »

papertiger wrote: post #16

It would be nice if the article actually named the app rather than just the developer. Does anyone know the app name?

If you search the market for "Jackeey" you'll get several dozen wallpaper apps. I think the article is treating all of them as a single app, which explains the "1.1 to 4.6 million" downloads: they just added up the lower and upper bounds of the ranges for each individual app. And as I said above, they don't appear to be requesting permissions that would let them do most of the nasty things described.

Re: Android wallpaper app that steals your data was downloaded by millions

#19

Post by cludwin »

papertiger wrote: post #16

It would be nice if the article actually named the app rather than just the developer. Does anyone know the app name?

I did some digging and ...

The article doesn't mention which app was malicious however they did mention that the app publisher went by the name of "jackeey,wallpaper".

I ran some queries and it seems like the developer that publishes apps under "jackeey,wallpaper" also publishes under "jackeey.wu".

A list of the apps published by this developer are here (most of which are wallpaper apps):

http://andbot.com/developer/jackeeywallpaper

http://andbot.com/developer/jackeey-wu

http://andbot.com/developer/jackeeywu

Re: Android wallpaper app that steals your data was downloaded by millions

#20

Post by SoftwareMaven »

jlgosse wrote: post #3

If this is true, I'm disturbed by the fact that: 1. Google has failed to tell any of us this, 2. I don't even know if I had any of the vendor's applications in the past, as they have been removed entirely, AND 3. Google has failed to tell any of us this! I mean what the hell, at least send us an email telling us that because we downloaded AppXYZ, our data has been compromised by some low-life(s) in China. I'm going t…

Does Android have the ability to remotely kill applications like iOS? If so, perhaps they did that, so your app just disappeared if you had it.

I was going to say "I can't imagine Google hushing up a security issue", but it does have the potential to get thrown in their face by Apple, "See, our walled garden is a good thing." (Not that I believe for an instant that Apple's approval would catch something like this.)

Post reply on HN