Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New 'unremovable' xHelper malware has infected 45,000 Android devices

zdnet.com

Post reply on HN
Print view View original

91–100 of 110 posts

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#91

Post by walrus01 »

altfredd wrote: post #60
walrus01 wrote: post #28

> The ads and notifications redirect users to the Play Store, where victims are asked to install other apps -- a means through which the xHelper gang is making money from pay-per-install commissions. Software publishers which have been proven to be paying out commission money from "bait and install" app links, for things published in the Play Store, should have their entire app and developer profile removed with extr…

That's a bold demand, considering that majority of free games in Play Store monetize themselves via partner installs. For all we know, developers of involved apps are paying a "legit" advertising company for installs, and malware authors act as ordinary partners of that company (likely using a bunch of throwaway accounts).

I don't feel sorry for them, they can continue to monetize themselves through pay to win lootboxes and pay to win power boosts instead.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#92

Post by mindslight »

hunter2_ wrote: post #74
40four wrote: post #61

Earlier quoted context omitted.

Thanks for explaining!

And the "not customarily wiped" partitions are not wiped because they are not customarily writable in the first place. Rooting a phone by a prominent manufacturer requires discovering an exploit which overcomes this write protection. This is why manufacturers try to protect against exploits, and why you probably shouldn't use a second-hand phone that has known exploits, where second-hand means touched by basically an…

> you probably shouldn't use a second-hand phone that has known exploits, where second-hand means touched by basically anyone

Clearly unpublished exploits are also bad, meaning this essentially applies to every phone. That's a pitfall of the closed security paradigm - even if you are willing to trust the manufacturer, you still can't be sure that their control has not actually been usurped by some unknown third party.

So you either need to double down and choose the closed system that receives the highest scrutiny (Apple), or opt for a device that has been opened by the community for long enough that any stateful hiding places are known.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#93

Post by GetOutOfBed »

jessaustin wrote: post #58
tinus_hn wrote: post #27

Earlier quoted context omitted.

The people who made choices that enable these issues, while complaining about other options that prevent these issues?

One needn't badmouth iOS in order to use Android. Indeed, many who use Android don't know that iOS exists.

I think a large part of "the older generation" doesn't even understand that smartphones have software running on them called "android". My mom calls her Samsung Galaxy "iphone".

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#94

Post by madiathomas »

pizza234 wrote: post #17
explodingcamera wrote: post #12

Earlier quoted context omitted.

Stories of bad viruses actually help them

If you refer to the theory that AV actually wrote viruses (it's not clear), that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks. I've followed the VX scene for years (it died long ago) and there has never been shortage of new malware. Even if we wanted to give some credit to the theory, which type of virus would the AV companies develop? Something trivial, tha…

This is how mafia operates. They come to you and offer protection in exchange for a recurring "protection fee". If you refuse, they are the ones who commit crimes against you until you fork out a "protection fee".

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#95

Post by rurban »

fattire wrote: post #33
thereare5lights wrote: post #26

Earlier quoted context omitted.

> that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks. So very realistic then? Or have you not encountered the numerous incidents where cops plant and manufacture evidence to frame people for various reasons such as increasing their numbers for a promotion or bad culture leading to quotas for arrests/tickets/etc.?

Now imagine a wholly for-profit police force.

Or even legal system. That would be unthinkable of ;)

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#96

Post by scarface74 »

Godel_unicode wrote: post #90
scarface74 wrote: post #81

Earlier quoted context omitted.

From the article While they were live, they didn’t steal data or gain control of a victim’s device, ....And while the worst effects you’d feel as a victim in this case would be a quicker battery drain and a higher data bill, this latest wave of iOS malware is most notable not for what it does but for how it got there. Which is a far cry from an unremovable app. It didn’t even get outside of the sandbox and wasn’t an…

The comments upstream are debating whether there's been malware on the app store. There has. Goal posts aside, it's worth remembering that no app review process is infallible, including Apple's.

The actual submission is about apps that install an unremovable piece of software that cause an escalation of privilege. The article you posted is about apps that can be removed just like any other software, don’t escape the sandbox and the most harm they can do is use an above normal amount of CPU and data.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#97

Post by jabbany »

sekasi wrote: post #53
redm wrote: post #2

I know IOS isn't perfect, however, when I read articles like this, I just have to smile. There's something to be said for a tightly controlled platform and ecosystem.

I don't know why you're being downvoted. You've got a point. There's no perfection in the App Store when it comes to review, but it's an ecosystem that is built around trying to create a sense of control and privacy. Sorry if you don't disagree but I reckon facts overwhelmingly disagree with you if you do. That's not to say in any way ANDROID BAD or anything like that, it's just a broader attack vector that you're up…

Also didn't downvote personally, but I can certainly see why someone would.

Fundamentally, the problem exposed by this particular piece of malware was the ability for it to persist across removals and device resets, not that it was "sideload-able" by the user. Malware persistence should not be possible on a well-designed system, especially one where applications are generally untrusted and sandboxed. Had this been malware that requires sideloading but could be removed when noticed, it wouldn't even have made the headlines at all.

The problem with making the walled-garden argument here is like saying nobody will get sick if we just put everyone in isolation all the time. Like, sure, it is _a_ solution, and assuming the isolation is perfect, it _does_ achieve the goal... But this merely sidesteps the problem, and anything that slips through the wall (which as pointed out by other commenters, does happen on iOS too) will be just as dangerous as before.

The real solution is to "buff up everyone's immune system" and make it easy to restrict and treat malware apps when they inevitably end up on a device, walled garden or not.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#99

Post by aitchnyu »

walrus01 wrote: post #28

> The ads and notifications redirect users to the Play Store, where victims are asked to install other apps -- a means through which the xHelper gang is making money from pay-per-install commissions. Software publishers which have been proven to be paying out commission money from "bait and install" app links, for things published in the Play Store, should have their entire app and developer profile removed with extr…

I sometimes install the app and leave it a one star and a comment with the cause: I was on a page and was forcibly redirected to a marketing page for an app. But major apps (atleast in India) won't get punished by a few one stars.

Play store should offer a screen to the users to allow them to report aggressive ads.

Re: New 'unremovable' xHelper malware has infected 45,000 Android devices

#100

Post by ikt »

dkonofalski wrote: post #11
benologist wrote: post #3

Earlier quoted context omitted.

What do you think iOS reviewers were thinking when carefully auditing these apps - https://mashable.com/2017/06/12/apple-app-store-subcription-... https://9to5mac.com/2019/10/25/malware-iphone-apps/ https://www.techtimes.com/articles/235985/20181204/apple-rem... https://www.wired.com/2015/09/apple-removes-300-infected-app... They get so much wrong, so often, you have to wonder if they really look at the apps at all o…

That doesn't feel like the same thing at all . A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset. People have to agree to pay for the subscription from an OS-level prompt in the first instance. They don't have a choice in the 2nd.

> A shady developer tricking people into a subscription because they don't know any better is way different from malware that reinstalls itself even after a factory reset.

A shady developer tricking people and a shady website tricking people result in bad things.

To get this trojan I'd need to go into settings and tick this box:

https://q3fb03rfy3f4ahuzu2uy6e11-wpengine.netdna-ssl.com/wp-...

Then go to the dodgy website, then download the apk, then install it then pikachu face when I get a trojan.

And you can talk about how great Apple's security is but to fix this issue all Google has to do is remove that tick box in settings so no more sideloading apps.

But that also comes back with drawbacks that I assume an Apple user like yourself wouldn't know about, because all you know is a walled garden. Sort of like how Chinese people love the fact their internet is censored. So safe, so secure.

Post reply on HN