Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New 'unremovable' xHelper malware has infected 45,000 Android devices

zdnet.com

Post reply on HN
Print view View original

71–80 of 110 posts

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#71

Post by flukus »

ActorNightly wrote: post #47
redm wrote: post #2

I know IOS isn't perfect, however, when I read articles like this, I just have to smile. There's something to be said for a tightly controlled platform and ecosystem.

Sure, except that once you get past the idea of trusting others for your security, and instead learning and securing stuff yourself, you quickly realize that "tightly controlled" is just a synonym for "you don't really own your device, we just let you use it how we see fit". As so recently demonstrated by Apples ability to remove the HKmap.live app. In general really wonder why people still defend Apple these days. E…

You can theoretically have the best of both worlds, apples strong vetting without their draconian control. Strong vetting and allowing side loading are not mutually exclusive.

It's basically how linux systems work, most stuff comes from the package manager which has been pretty good at keeping out malware and users can install whatever they want from elsewhere.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#72

Post by hunter2_ »

buildzr wrote: post #63
paulmd wrote: post #6

Wonder if it's written itself into recovery. Or the SIM card/baseband - SIM card in particular usually includes functionality for triggering a sideload of apps (eg for carrier apps), sending notifications, etc into the main SOC so it fits. Maybe the second instance of SIM card malware ever. https://www.youtube.com/watch?v=31D94QOo2gY There are only so many places it can be hiding if it's surviving a factory reset. --…

All they'd have to do in order to survive a factory reset is to write to the /system partition, which contains the main OS. A factory reset only wipes /data and a few caches. Writing to /system requires it to be mounted read/write and permissions to do so, so they'd need a root exploit in order to pull it off, but there's quite a few to choose from especially as devices age and given that they're doing this outside P…

Is side loading the only way that code requiring root can easily get on a phone though? What about USB debugging?

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#73

Post by hunter2_ »

hunter-gatherer wrote: post #49
soulofmischief wrote: post #22

Earlier quoted context omitted.

As a victim of such a falsified crime, testified by half a dozen police officers who couldn't get their stories straight but whom "somehow" were believed, you're only adding credence to the claim with that analogy.

Not really. I'm not doubting that you have been wronged by the judicial system, as I've seen this first hand with a close friend. However, a bold claim like this requires solid evidence that such practices are the norm.

It doesn't have to be the norm, it could be a rare thing done only during extremely slow periods to avoid right-sizing.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#74

Post by hunter2_ »

40four wrote: post #61
mindslight wrote: post #50

Earlier quoted context omitted.

Android devices have multiple storage partitions. "Factory reset" generally refers to wiping the data partitions, but not the system partitions. It does not mean reflashing the phone's entire storage from an external image as you would expect. I would imagine this malware modifies one of the partitions that is not customarily wiped. And I would expect that doing a proper full reflash from a computer (eg starting from…

Thanks for explaining!

And the "not customarily wiped" partitions are not wiped because they are not customarily writable in the first place. Rooting a phone by a prominent manufacturer requires discovering an exploit which overcomes this write protection. This is why manufacturers try to protect against exploits, and why you probably shouldn't use a second-hand phone that has known exploits, where second-hand means touched by basically anyone in even a seemingly-legitimate supply chain.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#75

Post by jackewiehose »

scarface74 wrote: post #70
ActorNightly wrote: post #47

Earlier quoted context omitted.

Sure, except that once you get past the idea of trusting others for your security, and instead learning and securing stuff yourself, you quickly realize that "tightly controlled" is just a synonym for "you don't really own your device, we just let you use it how we see fit". As so recently demonstrated by Apples ability to remove the HKmap.live app. In general really wonder why people still defend Apple these days. E…

So how do you “secure yourself” - besides having a device that runs an OS that doesn’t allow these types of exploits in the first place?

Installing custom software is neither an exploit nor a type of it.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#76

Post by scarface74 »

jackewiehose wrote: post #75
scarface74 wrote: post #70

Earlier quoted context omitted.

So how do you “secure yourself” - besides having a device that runs an OS that doesn’t allow these types of exploits in the first place?

Installing custom software is neither an exploit nor a type of it.

Are you saying that people meant to install the malware?

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#77

Post by millstone »

jackewiehose wrote: post #64
sekasi wrote: post #53

Earlier quoted context omitted.

I don't know why you're being downvoted. You've got a point. There's no perfection in the App Store when it comes to review, but it's an ecosystem that is built around trying to create a sense of control and privacy. Sorry if you don't disagree but I reckon facts overwhelmingly disagree with you if you do. That's not to say in any way ANDROID BAD or anything like that, it's just a broader attack vector that you're up…

I didn't downvote but I understand why others did (I would have if it wasn't already grey). It's incredibly frustrating to read these pro-walled-garden-arguments. By the same argument you could say that the people in Hong Kong or elsewhere should just shut up and accept that their leaders will know what's best for them. I worry about a future where these locked-down devices will be the norm for all of us. Don't defen…

I don't see the worry. Apple is not actively locking anyone in; people are free to choose Apple's products, or not.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#78

Post by jackewiehose »

scarface74 wrote: post #76
jackewiehose wrote: post #75

Earlier quoted context omitted.

Installing custom software is neither an exploit nor a type of it.

Are you saying that people meant to install the malware?

They certainly didn't know it was malware but yes, according to the article they installed the software intentionally (they even had to do extra steps and follow instructions on a random website to circumvent the google store).

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#79

Post by scarface74 »

londons_explore wrote: post #55
arcticbull wrote: post #40

Earlier quoted context omitted.

That’s actually kind of brilliant.

Until you get bugs like "3D games lag when in fast moving car due to constant cell handovers" and "4G doesn't work at the same time as playing a 1080p60 video, so netflix/youtube are broken unless on wifi".

That’s a fair compromise to make a smart phone more affordable.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#80

Post by buildzr »

hunter2_ wrote: post #72
buildzr wrote: post #63

Earlier quoted context omitted.

All they'd have to do in order to survive a factory reset is to write to the /system partition, which contains the main OS. A factory reset only wipes /data and a few caches. Writing to /system requires it to be mounted read/write and permissions to do so, so they'd need a root exploit in order to pull it off, but there's quite a few to choose from especially as devices age and given that they're doing this outside P…

Is side loading the only way that code requiring root can easily get on a phone though? What about USB debugging?

True, just disabling it via PackageInstaller by default would do the trick, the root community could re-enable it easily and those who only needed to sideload the occasional app could do so via USB debugging.

It seems like every time I hope for a reasonable solution like this I get let down substantially though.

Post reply on HN