Samsung embeds IronSource spyware app on phones across WANA • Hacker News Board

Re: Samsung embeds IronSource spyware app on phones across WANA

#211

Post by mmh0000 » Sat, Jun 21, 2025, 10:22 AM UTC

gmueckl wrote: post #193

miki123211 wrote: post #138

Earlier quoted context omitted.

I agree, but I think three extra conditions would need to be added here. 1. Devices should be allowed to display a different logo at boot time depending on whether the software is manufacturer-approved or not. That way, if somebody sells you an used device with a flashed firmware that steals all your financial data, you have a way to know. 2. Going from approved to unapproved firmware should result in a full device w…

4. Apps with special security needs are allowed to detect whether a device is unlocked and can either disable themselves or go into a mode that shifts ALL related liability onto the user. It's not the bank's fault if the user disabled protections and some spyware logs the online banking password or something like that.

It is the banks fault if they allow non-reversible, weird or large transactions without a secondary authorization capability.

The bank’s bad processes are not an end device fault.

Re: Samsung embeds IronSource spyware app on phones across WANA

#212

Post by nacos » Sat, Jun 21, 2025, 10:23 AM UTC

the-anarchist wrote: post #15

As this post is trending quicker and more than I would have expected it to, I would like to add to this story: It appears to be a similar case across the MENA region. While the SMEX post primarily focuses on WANA, it is possible to find other reports (e.g. [1]) from the MENA region that describe similar practices by Samsung. There, however, the stories talk about "Aura", rather than "AppCloud". [1] https://www.morocc…

I used to manage an enterprise fleet of mobile devices.

This AppCloud crap has also been pushed to devices in the Europe Open Market.

I also know that this shouldn't have been installed on enterprise devices (either Android Enterprise managed by MDM or E-FOTA managed - don't remember exactly). We had an akward conversation with some Samsung representatives..

Re: Samsung embeds IronSource spyware app on phones across WANA

#213

Post by mmh0000 » Sat, Jun 21, 2025, 10:25 AM UTC

jimjimwii wrote: post #163

Sophira wrote: post #154

Earlier quoted context omitted.

While I agree in theory, this is never going to happen. There's too much DRM in use for it to work out.

Repeal and outlaw drm. It was a mistake that violates everyone's constitutional rights.

“constitutional rights”

Words written on toilet paper. Only thing that exists today are “billionaire rights”.

Re: Samsung embeds IronSource spyware app on phones across WANA

#214

Post by mellosouls » Sat, Jun 21, 2025, 10:25 AM UTC

Editorialized title. Even the original calls it bloatware not spyware.

Re: Samsung embeds IronSource spyware app on phones across WANA

#215

Post by xg15 » Sat, Jun 21, 2025, 10:27 AM UTC

miki123211 wrote: post #138

ulrikrasmussen wrote: post #108

Earlier quoted context omitted.

We need regulation which defines that any hardware device capable of running software developed by a third party different from the hardware manufacturer qualifies as a general purpose computing device, and that any such device is disallowed to put cryptographic or other restrictions on what software the user wants to execute. This pertains to all programmable components on the device, including low-level hardware co…

I agree, but I think three extra conditions would need to be added here. 1. Devices should be allowed to display a different logo at boot time depending on whether the software is manufacturer-approved or not. That way, if somebody sells you an used device with a flashed firmware that steals all your financial data, you have a way to know. 2. Going from approved to unapproved firmware should result in a full device w…

> Devices should be allowed to display a different logo at boot time depending on whether the software is manufacturer-approved or not.

Not sure how to phase this legally, but please also add a provision against manufacturers making the "custom firmware" logo hideously ugly on purpose to discourage rooting - like e.g.Microsoft did for Surface tablets.

> 3. Users should have the ability to opt themselves into cryptographic protection, either on the original or modified firmware, for anti-theft reasons.

Full agreement here. I very much would like to keep the bootloader locked - just to my own keys, not the OEMs.

Re: Samsung embeds IronSource spyware app on phones across WANA

#216

Post by acidburnNSA » Sat, Jun 21, 2025, 10:29 AM UTC

npteljes wrote: post #209

anonymars wrote: post #29

Earlier quoted context omitted.

In favor of what? The Android ecosystem is pretty lousy. Which manufacturers allow you to easily migrate to a new phone (Samsung has Smart Switch) and have, let's say, 4+ years of security updates? Genuine question. In my case I also wanted an SD card slot so it was slim slim pickings indeed. (And still there are some misfits who insist that there is no such thing as progress!)

Pixel of course. And yeah the Androids suck mostly. Pixels suck too in some ways, for example, they are quite bulky, and heat up a bunch. But overall, by far the best Android experience in my opinion. No SD slot though.

No SD slot is a showstopper for many.

Re: Samsung embeds IronSource spyware app on phones across WANA

#217

Post by reactordev » Sat, Jun 21, 2025, 10:32 AM UTC

mmh0000 wrote: post #213

jimjimwii wrote: post #163

Earlier quoted context omitted.

Repeal and outlaw drm. It was a mistake that violates everyone's constitutional rights.

“constitutional rights” Words written on toilet paper. Only thing that exists today are “billionaire rights”.

Exactly. DRM isn’t going anywhere so long as copyrights exist.

Re: Samsung embeds IronSource spyware app on phones across WANA

#218

Post by grishka » Sat, Jun 21, 2025, 10:36 AM UTC

npteljes wrote: post #208

grishka wrote: post #8

The "unremovable" part is inaccurate. While you can't completely remove it because it resides on the system partition, you most probably can still disable it with an adb command: adb shell pm uninstall --user 0 com.package.name This command is very powerful as it works for any app, even those that have "disable" greyed out in the settings. I disabled the Galaxy Store on my S9 this way for example.

Words don't just have a literal, technical meaning. If the phone itself doesn't allow a straightforward, user friendly happy-path for removal, it might as well be "unremovable" in a sense that it is indeed unremovable for most users. "adb shell etc" implies that one has a PC with this tool correctly installed, and many people don't even have a PC in the first place. Then comes the case of installing adb, setting it u…

This doesn't strictly require a PC. There's this trick with using the wireless debugging feature to connect the phone to itself. You can do it with a terminal app like Termux but Shizuku is a nice GUI that streamlines this process and exposes an API for other apps to use. After a quick web search I found https://github.com/samolego/Canta which is, again, a GUI app that uses Shizuku to uninstall apps via adb.

I agree that it's not easy, but anyone sufficiently annoyed by these non-otherwise-removable apps who is able to follow instructions should be able to get it done without needing a computer or special knowledge or messing with the command line.

Re: Samsung embeds IronSource spyware app on phones across WANA

#219

Post by Zak » Sat, Jun 21, 2025, 10:36 AM UTC

gmueckl wrote: post #193

miki123211 wrote: post #138

Earlier quoted context omitted.

I agree, but I think three extra conditions would need to be added here. 1. Devices should be allowed to display a different logo at boot time depending on whether the software is manufacturer-approved or not. That way, if somebody sells you an used device with a flashed firmware that steals all your financial data, you have a way to know. 2. Going from approved to unapproved firmware should result in a full device w…

4. Apps with special security needs are allowed to detect whether a device is unlocked and can either disable themselves or go into a mode that shifts ALL related liability onto the user. It's not the bank's fault if the user disabled protections and some spyware logs the online banking password or something like that.

I'm pretty sure I'm against this. I could be convinced otherwise by documentation of significant fraud involving compromised devices (especially Android phones) that would have been stopped by a device attestation scheme.

I should note Google has such an attestation scheme, and there are reliable defeats for it in most situations given root access. Apps have been able to insist on hardware-backed attestation which has not been defeated for some time, but that isn't available for old devices. Almost none do so.

If this had a meaningful impact on fraud, more apps would insist on the hardware-backed option, but that's quite rare. Even Google doesn't; I used Google Pay contactless with LineageOS and root this week. I'm currently convinced it's primarily a corporate power grab; non-Google-approved Android won't be a consumer success if it doesn't run your banking app, and the copyright lobby loves anything that helps DRM.

Re: Samsung embeds IronSource spyware app on phones across WANA

#220

Post by xg15 » Sat, Jun 21, 2025, 10:36 AM UTC

gmueckl wrote: post #193

miki123211 wrote: post #138

Earlier quoted context omitted.

I agree, but I think three extra conditions would need to be added here. 1. Devices should be allowed to display a different logo at boot time depending on whether the software is manufacturer-approved or not. That way, if somebody sells you an used device with a flashed firmware that steals all your financial data, you have a way to know. 2. Going from approved to unapproved firmware should result in a full device w…

4. Apps with special security needs are allowed to detect whether a device is unlocked and can either disable themselves or go into a mode that shifts ALL related liability onto the user. It's not the bank's fault if the user disabled protections and some spyware logs the online banking password or something like that.

Yeah, nope. All apps have "special security needs" according to their manufacturers. Every app that relies on spying for revenue will use that to disable itself. (Or worse, actively malfunction - e.g. that banking app could switch into a special mode where it does transactions on its own that are not in the interest of the user. If the user has accepted all liability, there isn't much they could do against that)

I'm alright with limiting liability for an unlocked/customized phone (for things that happen from that phone) - but that's a legal/contractual thing. For that to work, it's enough for a judge to understand that the phone was customized at that time - it doesn't require the app to know.