Live data from Hacker News

Android wallpaper app that steals your data was downloaded by millions

mobile.venturebeat.com

51–60 of 60 posts

Re: Android wallpaper app that steals your data was downloaded by millions

#51
post #43
post #23

Earlier quoted context omitted.

Again since the article doesn't mention which app was malicious it's hard to say but when I looked up the wallpaper apps developed by "jackeey,wallpaper" I see the apps requiring the following permissions: android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_NETWORK_STATE android.permission.INTERNET android.permission.READ_PHONE_STATE android.permission.SET_WALLPAPER android.permission.WRITE_EXTERNAL_S…

A wallpaper app is likely to need the ability to download new wallpapers. I'm not sure why it would need your location though.

It wouldn't need it, but it could be used to find wallpapers relevant to your location (photos).

Re: Android wallpaper app that steals your data was downloaded by millions

#52
post #46

So the iPhone is too closed, and Android is too open. In my opinion, they should have a quality assured Market, but keep the ability to load .apk files whenever you want (and also the ability for others to create their own marked). Quality assurance on market should mainly be about maliciousness of applications. It sounds stupid arguing for android to be more closed, but really Google is very slack with their Market.

QA at Apple would not have stopped this. I'm not surprised that people fall for this BS. Apple would have caught this just like Apple would have caught a flashlight with a SOCKS tunnel right?

If the App requests permission, wtf do you expect? I don't think Google even has an obligation to remove or crackdown on these types of apps.

Re: Android wallpaper app that steals your data was downloaded by millions

#53
post #30

Earlier quoted context omitted.

Because this wasn't some random APK downloaded directly from the internet and thrown onto a phone after the 'APKs from the internet might harm your security' message. It was uploaded to Android Market and provided by Google, who as an arbiter of content, should realize that 'collect phone data' isn't an appropriate permission for a wallpaper.

So, Google has a responsibility to check each and every app for malicious intent by the uploader? I really think that goes one step too far, that's exactly what apple does with their market place and I think that is a big part of the problem. The ultimate responsibility of what you run on your computers lies with you, not with some entity providing you with a convenient way to get at a catalogue of stuff. This applic…

> So, Google has a responsibility to check each and every app for malicious intent by the uploader?

(...)

> The ultimate responsibility of what you run on your computers lies with you, (...)

This touches on something that has been nipping at my brain lately. There seems to be a widespread assumption among many developers that end users need to be more educated about technology, that it is not the developers who need to make these things simpler to use, but end users who need to understand the underlying system better. In other words, that the general public needs to catch up to technology instead of technology being more usable for the general public.

I think that is very wrong headed.

> Now if only people would read those warnings and think for a bit before clicking 'ok'.

Well, it only tells you it wants to read your address book, not that it wants to read your address book so it can spam all your friends (as an example). Joe Somebody wouldn't be stupid to allow a wallpaper app to read his address book if he was under the assumption that the app would just use that data to let him email nice wallpapers to friends.

> This is analogous to people receiving an email that instructs them to open a malware attachment.

Only if every app the user installs requires following email instructions and opening an attachment, and that's the point. There is little to discern the malicious permissions from the beneficial ones unless you are intimate with how the app is supposed to work. This is why a higher, more knowledgeable authority should at least give apps some level of review.

Re: Android wallpaper app that steals your data was downloaded by millions

#54
post #2

so what were the security permissions requested by this app at the time of installation? i have to imagine that if it was taking web browsing history that it would have needed more permissions than just "uses network data". android's fine-grained security permissions, where the author has to explicitly request each type (network use, prevent the screen from turning off, etc.) and the user is shown the list of permiss…

users either don't read, don't care, or don't understand what is being asked of them and they just click whatever is needed to continue. True. That's sort of ok as long as advanced users can tell when something fishy is going on and flag the app. even an advanced user can't tell the difference between a free app requesting network access to download advertisements and a malicious one using it to upload private inform…

It's really not even safe to have an app without strong credentials and audit trail bringing in ads. There's no protection against objectionable ads, or those doing things like taking advantage of Flash vulnerabilities etc.

Isn't the Apple approach to host the ads themselves? While app developers still get data access, at least there's a healthy isolation between the client and the advertiser. Apple can certainly provide things like basic client stats and direct ads appropriately based on location.

The Windows anti-virus / anti-spyware model is too flawed to be trusted. It's like having a bouncer at the door of a party that keeps out offenders from previous parties. The default is to trust everything else, so every zero day attack can get through. Defaulting to not trusting things and only allowing what's known okay would be far more effective. If apps had to request all net connections through IPs stored at Apple/Google etc, the potential to direct to some hostile developer or botnet would be greatly reduced. Although the plans may be for video and other high bandwidth content streaming, that huge server city Apple is building could certainly host any static non-generic content apps need, and perhaps be a proxy for much of the rest (news sites etc). Google certainly has the infrastructure to do something similar. Granted Google is better set to do that on a global level.

Even advanced users can be tricked if granting access for something trivial opens the gates to something nasty. At least on a consumer device it makes sense to protect users from themselves. Limiting hosts and local directories is certainly prudent.

Re: Android wallpaper app that steals your data was downloaded by millions

#55
post #21

Earlier quoted context omitted.

And it DID request more than that. The thing is, that these wannabes like to paint themselves as "security experts", so they conceal facts and tell the story to the masses of non-techie users and scare them. Then, they sell a bogus security app.

If a wallpaper app requests access to your contacts and millions of users install it anyways that is a flaw in Android's security model. After a while you become conditioned to just hitting Install without even looking at the permissions being requested. Just because users are lazy or even stupid is not an excuse for leaving them vulnerable.

That is not a flaw in android's security model. That is a flaw in the user.

If a salesman approached your door and said "I will own your first born child, and your boat, if you sign this contract to get a 90% discount on a time share in Bermuda" and then several people agreed, just because they didn't listen to the first part of the sentence, who's fault is this? The salesman or the 'victim'? It's the victim's fault, because he DIDN'T LISTEN, and AGREED ANYWAY.

Any lawyer (or layman for that matter) will tell you that if someone signs a contract they DON'T READ that they're still required to uphold it.

When you are installing an application and it asks you to AGREE to the application doing X,Y,Z and you say 'OK' then YOU are responsible.

No Pavlovian behaviorist hogwash is going to convince me otherwise.

Re: Android wallpaper app that steals your data was downloaded by millions

#56
post #53

Earlier quoted context omitted.

So, Google has a responsibility to check each and every app for malicious intent by the uploader? I really think that goes one step too far, that's exactly what apple does with their market place and I think that is a big part of the problem. The ultimate responsibility of what you run on your computers lies with you, not with some entity providing you with a convenient way to get at a catalogue of stuff. This applic…

> So, Google has a responsibility to check each and every app for malicious intent by the uploader? (...) > The ultimate responsibility of what you run on your computers lies with you, (...) This touches on something that has been nipping at my brain lately. There seems to be a widespread assumption among many developers that end users need to be more educated about technology, that it is not the developers who need…

That's the high road to trusted computing, but that doesn't mean the destination is any better. Think the 'ministry of automation' giving you a license to develop or something like that.

Re: Android wallpaper app that steals your data was downloaded by millions

#57
post #19

It would be nice if the article actually named the app rather than just the developer. Does anyone know the app name?

I did some digging and ... The article doesn't mention which app was malicious however they did mention that the app publisher went by the name of "jackeey,wallpaper". I ran some queries and it seems like the developer that publishes apps under "jackeey,wallpaper" also publishes under "jackeey.wu". A list of the apps published by this developer are here (most of which are wallpaper apps): http://andbot.com/developer/…

I compiled a more comprehensive list of the apps that could be affected and I'll be updating it when I find out more info:

http://andbot.com/blog/index.php/2010/07/29/android-apps-sus...

Re: Android wallpaper app that steals your data was downloaded by millions

#58
post #45

Earlier quoted context omitted.

As I'm sure they'll pull these when the right people at google are alerted to the problem. But there will be more instances of this and I think that there simply ought to be a strict procedure to report malware so it can be responded to quickly rather than to lay the blame with google. Then if such a procedure is in place and if google would consistently refuse to pull clearly identified malware you'd get in to a sit…

Having anything submitted to the 'Themes' category not include the permission to view your call history is automatable. > I'm sure they'll pull these when the right people at google are alerted to the problem. I've ported about 15 different apps to Google which were blatant cases of IP theft, and one of search results gaming. They're all still there, with zero response. They might be better with handling malware but…

I hope you meant reported not ported.

Re: Android wallpaper app that steals your data was downloaded by millions

#59

I'm pretty sure the article is not entirely accurate. There are several apps from "Jackeey Wallpaper" in the Android Market, all of which seem to be apps to download wallpapers of various themes. The dozen or so I've checked have these permissions: - "modify/delete SD card contents" - "coarse (network based) location" - "full Internet access" - "read phone state and identity" As far as I know none of those allow read…

The app in question only sends your phone number, IMSI, and voicemail number. They posted a clarification here: http://blog.mylookout.com/2010/07/mobile-application-analysi...

Re: Android wallpaper app that steals your data was downloaded by millions

#60
post #46

So the iPhone is too closed, and Android is too open. In my opinion, they should have a quality assured Market, but keep the ability to load .apk files whenever you want (and also the ability for others to create their own marked). Quality assurance on market should mainly be about maliciousness of applications. It sounds stupid arguing for android to be more closed, but really Google is very slack with their Market.

QA at Apple would not have stopped this. I'm not surprised that people fall for this BS. Apple would have caught this just like Apple would have caught a flashlight with a SOCKS tunnel right? If the App requests permission, wtf do you expect? I don't think Google even has an obligation to remove or crackdown on these types of apps.

every app asks for permissions, thats the problem. If I didn't use apps that had permissions which could possibly be exploited I would have barely any apps.

At the very least malicious apps need to be removed quickly, along with spam + scam apps.

Post reply on HN