Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious apps infect 25M Android devices with 'Agent Smith' malware

phys.org

Post reply on HN
Print view View original

171–180 of 222 posts

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#171

Post by pkaye »

spiznnx wrote: post #120
brlewis wrote: post #117

Earlier quoted context omitted.

This comment and most replies use "carrier" as shorthand for "carrier and/or manufacturer". This looks funny to me because my carrier is T-Mobile and doesn't add bloatware AFAICT. Using "manufacturer" as the shorthand would make more sense to me.

T-Mobile does add software to phones. Wi-Fi calling requires T-Mobile-specific OS-level modifications. You won't be able to use it on unbranded unlocked phones. It's definitely not bloatware though.

I think its already a part of the Android software. I certainly see it enabled on the phone I bought outside of T-Mobile. The only thing I see I need is a the T_Mobile visual mail app but I don't use that much since everything is SMS these days.

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#172

Post by marcod »

deepsun wrote: post #4

What ad blocking for Android to would recommend?

Funny thing was that I was reading this in an ad-blocking browser and phys.org was complaining about that (in a very restrained way)

"It appears that you are currently using Ad Blocking software. What are the consequences?"

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#173

Post by bfdm »

ndesaulniers wrote: post #46
scarface74 wrote: post #22

Earlier quoted context omitted.

That’s the problem. Why should your carrier have any say so in updating your operating system? If I buy a computer from Best Buy, I don’t have to wait for them to push an update to Windows.

Good question. When a phone stops working, people want their money back. Guess where most people in most markets buy their phone from? Further, who do you think customer's call for support? Now you know why carriers are hesitant about frequently updating a product they've already made a sale on. If an update breaks something, guess who pays the price? Not defending them, and it's not the only reason, but it's a big o…

Then they should also be held responsible for the fallout (technical or financial) caused by an unpatched security bug.

Then it's just a liability and risk choice for them. If the user is not able to update, then they shouldn't be the ones on the hook if there are problems.

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#174

Post by nradov »

dan-0 wrote: post #77
komali2 wrote: post #2

> Google already fixed at least one of the Android exploits used by "Agent Smith," nicknamed Janus, in 2017 but the fix hasn't made its way onto every Android phone. It's a potent reminder that millions of phones around the world are being used without the latest security measures. Because Samsung (or similar) or even more weirdly, Sprint (or similar) just doesn't fucking update our Android versions for months, or ev…

This seems to be getting a lot of attention, so as an Android Engineer with some security and framework experience let me try to explain. This is a side effect of Android's initial approach to it's open nature. Android allows a manufacturer to modify its framework for their own use case. Then the manufacturer can allow a specific carrier to input their own system applications and firmware on to the devices well (your…

That's just making excuses for poor software architecture without clearly defined layers and stable, documented APIs between them. MS Windows has a hardware abstraction layer. There's no reason Android couldn't have the same, except that it wasn't a priority.

Some of this is (or was) a fundamental design limitation of the Linux kernel. But there are other kernels.

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#175

Post by dredmorbius »

scarface74 wrote: post #22
komali2 wrote: post #2

> Google already fixed at least one of the Android exploits used by "Agent Smith," nicknamed Janus, in 2017 but the fix hasn't made its way onto every Android phone. It's a potent reminder that millions of phones around the world are being used without the latest security measures. Because Samsung (or similar) or even more weirdly, Sprint (or similar) just doesn't fucking update our Android versions for months, or ev…

That’s the problem. Why should your carrier have any say so in updating your operating system? If I buy a computer from Best Buy, I don’t have to wait for them to push an update to Windows.

My (no-carrier) WiFi-only Android tablet ... is also wholly dependent on the hardware vendor for updates, of which to the best of my knowledge has never seen an OS update since date of purchase (though vendor apps, which I've never used and cannot uninstall, have updates pushed, routinely demanding greater permissions).

Of all the monopoly-leverage-based requirements Google could make of Android vendors, demanding update SLA and EOL minima are apparently ones they've never contemplated.

0/10, would not recommend, ever.

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#176

Post by codebje »

navigatesol wrote: post #152
cstejerean wrote: post #87

Earlier quoted context omitted.

This is what I love about Apple. They gave the carriers a big middle finger when it comes to the usual bullshit of bloatware, sticking their logos on things or getting in the middle of updates. That’s because they cared about the end user experience. Google was happy to just grab market share at the expense of the users by allowing carriers to continue with their usual shenanigans. For this reason Apple will have my…

> They gave the carriers a big middle finger when it comes to the usual bullshit of bloatware, sticking their logos on things or getting in the middle of updates Except, of course, the bloatware of their own making. Here's a novel idea: you, yourself can give the middle finger to the carriers and buy an unlocked phone from a provider that delivers timely updates to Android...just like Apple. > For this reason Apple w…

I buy unlocked Nexus devices to avoid mftr and carrier bloatware and update delays.

Never again for a Samsung device, they churn through models absurdly quickly, delay updates for months, and shovel tons of crap on.

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#177

Post by dredmorbius »

dan-0 wrote: post #77
komali2 wrote: post #2

> Google already fixed at least one of the Android exploits used by "Agent Smith," nicknamed Janus, in 2017 but the fix hasn't made its way onto every Android phone. It's a potent reminder that millions of phones around the world are being used without the latest security measures. Because Samsung (or similar) or even more weirdly, Sprint (or similar) just doesn't fucking update our Android versions for months, or ev…

This seems to be getting a lot of attention, so as an Android Engineer with some security and framework experience let me try to explain. This is a side effect of Android's initial approach to it's open nature. Android allows a manufacturer to modify its framework for their own use case. Then the manufacturer can allow a specific carrier to input their own system applications and firmware on to the devices well (your…

As I've commented elsewhere on this thread: my 2015 purchased-new Android tablet has never to my knowledge seen a vendor OS update -- it's running 5.0.2, not even the most recent version at the time, as 5.1.1 was released over six months before the unit was sold.

None of this information was available to me at the time, and the 5.1.1 history I've only just learnt whilst composing this comment. I'd purchased the device under sharp time, budget, and information constraints whilst travelling. Budget and other limitations, as well as a market void of credible alternatives (Purism have my eye) have prevented replacement, though I loathe this device.

Google have considerable monopoly leverage, and yet have not used this to require obligations for (and permit forward use of) Android and related ecosystem services in the form of upgrade timeliness SLAs and minimum EoL requirements: this device was obsolete at time of sale, though I was completely unaware of this at the time. Instead Google have sought to perpetuate their own monopoly and interests:

https://www.theverge.com/2018/7/18/17580694/google-android-e...

It is also not capable of being re-ROMed, another fact of which I was unaware.

I'm beyond disgusted and will not and do not recommend Android to anyone.

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#178

Post by ajross »

CannisterFlux wrote: post #121
Santosh83 wrote: post #105

Earlier quoted context omitted.

The Android ver on my phone is 4.1. Still runs just fine, but then again all I use it for are calls/SMS, so there's little scope to be exploited.

It might still be vulnerable to stagefright, exploitable over MMS.

Stagefright is the name of the component, not the exploit. And in most cases, devices from major vendors are going to have patched binaries, even on images as old as Jellybean.

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#179

Post by Jerry2 »

codedokode wrote: post #149
cstejerean wrote: post #87

Earlier quoted context omitted.

This is what I love about Apple. They gave the carriers a big middle finger when it comes to the usual bullshit of bloatware, sticking their logos on things or getting in the middle of updates. That’s because they cared about the end user experience. Google was happy to just grab market share at the expense of the users by allowing carriers to continue with their usual shenanigans. For this reason Apple will have my…

But Apple software is proprietary, not friendly to open soure developers and you never know what that software is doing. Maybe they are streaming your data directly to "cloud" operated by NSA. Or iPhone doesn't upload anything to cloud?

Huawei incident has taught that Android is proprietary too. Any country that's at odds with the US will eventually find out that Android will be blocked to their companies too.

Re: Malicious apps infect 25M Android devices with 'Agent Smith' malware

#180

Post by wildduck »

darkpuma wrote: post #163
w1nst0nsm1th wrote: post #160

Earlier quoted context omitted.

Most of the function users care about in their phone, if not implemented by third party, are proprietary apps from google. Without the app store and the google ecosystem, android experience is poor at best.

The Google ecosystem can drown in bleach for all I care. F-Droid is not bad at all. Downloading apps from the Google store is an awful experience because on that store it's the norm for damn near every application to spy on you to the fullest extent possible. On f-droid, applications the typical application is a good citizen. It's a lower stress experience and a better appstore than either Google or Apple, unless you…

Or we can also try this: https://www.replicant.us
Post reply on HN