Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android wallpaper app that steals your data was downloaded by millions

mobile.venturebeat.com

Post reply on HN
Print view View original

21–30 of 60 posts

Re: Android wallpaper app that steals your data was downloaded by millions

#21

Post by guelo »

shirtless_coder wrote: post #9
there wrote: post #2

so what were the security permissions requested by this app at the time of installation? i have to imagine that if it was taking web browsing history that it would have needed more permissions than just "uses network data". android's fine-grained security permissions, where the author has to explicitly request each type (network use, prevent the screen from turning off, etc.) and the user is shown the list of permiss…

And it DID request more than that. The thing is, that these wannabes like to paint themselves as "security experts", so they conceal facts and tell the story to the masses of non-techie users and scare them. Then, they sell a bogus security app.

If a wallpaper app requests access to your contacts and millions of users install it anyways that is a flaw in Android's security model. After a while you become conditioned to just hitting Install without even looking at the permissions being requested. Just because users are lazy or even stupid is not an excuse for leaving them vulnerable.

Re: Android wallpaper app that steals your data was downloaded by millions

#22

Post by megablast »

SoftwareMaven wrote: post #20
jlgosse wrote: post #3

If this is true, I'm disturbed by the fact that: 1. Google has failed to tell any of us this, 2. I don't even know if I had any of the vendor's applications in the past, as they have been removed entirely, AND 3. Google has failed to tell any of us this! I mean what the hell, at least send us an email telling us that because we downloaded AppXYZ, our data has been compromised by some low-life(s) in China. I'm going t…

Does Android have the ability to remotely kill applications like iOS? If so, perhaps they did that, so your app just disappeared if you had it. I was going to say "I can't imagine Google hushing up a security issue", but it does have the potential to get thrown in their face by Apple, "See, our walled garden is a good thing." (Not that I believe for an instant that Apple's approval would catch something like this.)

Yes, they do. I am pretty sure they have already removed one application. Lets wait to hear what google says before we all go crazy.

Re: Android wallpaper app that steals your data was downloaded by millions

#23

Post by cludwin »

there wrote: post #2

so what were the security permissions requested by this app at the time of installation? i have to imagine that if it was taking web browsing history that it would have needed more permissions than just "uses network data". android's fine-grained security permissions, where the author has to explicitly request each type (network use, prevent the screen from turning off, etc.) and the user is shown the list of permiss…

Again since the article doesn't mention which app was malicious it's hard to say but when I looked up the wallpaper apps developed by "jackeey,wallpaper" I see the apps requiring the following permissions:

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.SET_WALLPAPER

android.permission.WRITE_EXTERNAL_STORAGE

It seems strange for a wallpaper app to require internet access.

Re: Android wallpaper app that steals your data was downloaded by millions

#24

Post by zmmmmm »

guelo wrote: post #21
shirtless_coder wrote: post #9

Earlier quoted context omitted.

And it DID request more than that. The thing is, that these wannabes like to paint themselves as "security experts", so they conceal facts and tell the story to the masses of non-techie users and scare them. Then, they sell a bogus security app.

If a wallpaper app requests access to your contacts and millions of users install it anyways that is a flaw in Android's security model. After a while you become conditioned to just hitting Install without even looking at the permissions being requested. Just because users are lazy or even stupid is not an excuse for leaving them vulnerable.

I agree it's a flaw. I do think it is better than iOS but it is still a huge problem. It is one of simultaneously too much and too little granularity. If you provide too much granularity it overwhelms users, while if you provide too little it forces people to approve too wide a scope.

For example, the music app I just installed wants access to the phone state and identity. At first I baulked and said WTF does a music app need that for? And of course, the answer is it wants to make the music quieter / pause when a call comes in. But to do that it needs access to the identity of my phone because that seems to be lumped into the same bucket as the "state" of my phone. It also needs internet access because it wants to download album art. So these completely innocuous features also mean it could be tracking my location and reporting it to the web. How do I tell an evil app from a good one? I don't know - all I do is read the comments.

I think Android needs to make the model richer while also streamlining certain sets of permissions into standard profiles that people can understand. For example, the set of minimal permissions to support ads in an app should be simply presented as "to present location based ads", not a set of 5 permissions that overwhelm people. This should in turn be honed by Google into a minimal set of permissions internally so that an app that just wants to present ads can't actually track me and report my location to arbitrary web sites.

I hope Google is thinking about this stuff. I think it's in a reasonable state at the moment if it is just on a development curve. If this is how Google thinks it should stay then it is not enough and is going to become a serious problem.

Re: Android wallpaper app that steals your data was downloaded by millions

#25

Post by srjk »

This scared me. I just installed a wallpaper app yesterday and while doing so thought "that's weird, why does it my personal information, phone calls etcs". But I still got the app. I guess my excuse is being used to my iphone, I didn't think about exactly how much access I was granting to this random app.

Anyway, I just checked, and the wallpaper app I had wasn't from jackeey. It's a top free app on the marketplace named Backgrounds by Stylem Media. And, it requires access to network communication, personal information, storage, phone calls, and system tools.

I have no idea how the warnings are generated. Maybe devs are just including random libraries in their app (copy paste?) which are setting off these warnings? If not, why does this wallpaper app need my personal info?

Anyway, good wake up call, I will definitely be more careful wrt what I install on my phone.

EDIT: App request: something that logs/polices information going out from my phone. Firewall? we'll be needing a anti-virus next :(

Re: Android wallpaper app that steals your data was downloaded by millions

#26

Post by argsv »

srjk wrote: post #25

This scared me. I just installed a wallpaper app yesterday and while doing so thought "that's weird, why does it my personal information, phone calls etcs". But I still got the app. I guess my excuse is being used to my iphone, I didn't think about exactly how much access I was granting to this random app. Anyway, I just checked, and the wallpaper app I had wasn't from jackeey. It's a top free app on the marketplace…

"And, it requires access to network communication, personal information, storage, phone calls, and system tools."

This seems like a clear warning to me for wallpaper app. Would you install such an app on your PC/Mac?

Re: Android wallpaper app that steals your data was downloaded by millions

#28

Post by masklinn »

there wrote: post #8
jsz0 wrote: post #4

Earlier quoted context omitted.

It's a rarity to see any Android app that doesn't require half a dozen different permissions. I just installed the Google Maps update and it requires 9 including the ability to read my phone call logs (??)

maybe on-demand permission requests would be better for many of those things, like apple ios does when an app requests your location. if i did something in google maps and it popped up a dialog asking for access to my call logs, i would certainly deny it, but i just did that update this morning and didn't even notice anything about it accessing my call logs.

> maybe on-demand permission requests would be better for many of those things, like apple ios does when an app requests your location.

Wouldn't change much, 95% of users would still go WANNA USE APPLICATION, DISMISS MEAN BOX NOW

Re: Android wallpaper app that steals your data was downloaded by millions

#29

Post by jacquesm »

A typical case of overblown 'user failure', not Android security model failure. If a wallpaper app wants internet access and you allow it you really only have yourself to blame.

Wallpaper, cursors packages, screen savers and other dumb 'customisation' gadgets have been malware vectors on the windows platform for about 15 years now, why would phone platforms be any different ?

Re: Android wallpaper app that steals your data was downloaded by millions

#30

Post by nailer »

jacquesm wrote: post #29

A typical case of overblown 'user failure', not Android security model failure. If a wallpaper app wants internet access and you allow it you really only have yourself to blame. Wallpaper, cursors packages, screen savers and other dumb 'customisation' gadgets have been malware vectors on the windows platform for about 15 years now, why would phone platforms be any different ?

Because this wasn't some random APK downloaded directly from the internet and thrown onto a phone after the 'APKs from the internet might harm your security' message.

It was uploaded to Android Market and provided by Google, who as an arbiter of content, should realize that 'collect phone data' isn't an appropriate permission for a wallpaper.

Post reply on HN