A good reason for android users to switch to iphone

by Guest Thu Jul 04, 2013 9:49 am

http://www.bbc.co.uk/news/technology-23179522

by Hellsangel Tue Jul 09, 2013 11:52 am

Keep your pants on.

by Guest Tue Jul 09, 2013 12:22 pm

Hellsangel wrote:Keep your pants on.

The concerns raised in this article* have only been answered in a superficial manner.

http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/

The solution to the problem of even legitimate apps being turned into malicious trojans is apparently not to download new apps.

by Hellsangel Tue Jul 09, 2013 12:24 pm

Rashmun wrote:
Hellsangel wrote:Keep your pants on.

The concerns raised in this article* have only been answered in a superficial manner.

http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/

The solution to the problem of even legitimate apps being turned into malicious trojans is apparently not to download new apps from outside of Google Play.

But wait -- it's possible to install apps from outside of the official Play Store, right? Of course, silly goose; this isn't a dictator-controlled fruit farm. But in order to install an app from a third-party source, you'd have to first manually enable an option within your device's settings that allows the installation of non-Play-Store apps. It's not something that's going to come up and bite you while you're sleeping.

Even if you are an advanced user and have that setting enabled, you'd then have to manually opt to install an app from a dangerous third-party source before any evil genie could take over your phone. You'd go through multiple layers of warnings about the risks of installing such a program before anything bad could happen. And beyond all of that, Google's app-scanning system actually extends to non-Play-Store installations as of the latest Android release -- so even if you ignore all the other red flags and move forward, your phone could still catch the conniving code before any damage is done.

by Guest Tue Jul 09, 2013 12:34 pm

Hellsangel wrote:
Rashmun wrote:
Hellsangel wrote:Keep your pants on.

The concerns raised in this article* have only been answered in a superficial manner.

http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/

The solution to the problem of even legitimate apps being turned into malicious trojans is apparently not to download new apps from outside of Google Play.

But wait -- it's possible to install apps from outside of the official Play Store, right? Of course, silly goose; this isn't a dictator-controlled fruit farm. But in order to install an app from a third-party source, you'd have to first manually enable an option within your device's settings that allows the installation of non-Play-Store apps. It's not something that's going to come up and bite you while you're sleeping.

Even if you are an advanced user and have that setting enabled, you'd then have to manually opt to install an app from a dangerous third-party source before any evil genie could take over your phone. You'd go through multiple layers of warnings about the risks of installing such a program before anything bad could happen. And beyond all of that, Google's app-scanning system actually extends to non-Play-Store installations as of the latest Android release -- so even if you ignore all the other red flags and move forward, your phone could still catch the conniving code before any damage is done.

what about legitimate apps created by the device manufacturers?

----
The Bluebox Security research team – Bluebox Labs – recently discovered a vulnerability in Android’s security model that allows a hacker to modify APK code without breaking an application’s cryptographic signature, to turn any legitimate application into a malicious Trojan, completely unnoticed by the app store, the phone, or the end user. The implications are huge! This vulnerability, around at least since the release of Android 1.6 (codename: “Donut” ), could affect any Android phone released in the last 4 years1 – or nearly 900 million devices2– and depending on the type of application, a hacker can exploit the vulnerability for anything from data theft to creation of a mobile botnet.

While the risk to the individual and the enterprise is great (a malicious app can access individual data, or gain entry into an enterprise), this risk is compounded when you consider applications developed by the device manufacturers (e.g. HTC, Samsung, Motorola, LG) or third-parties that work in cooperation with the device manufacturer (e.g. Cisco with AnyConnect VPN) – that are granted special elevated privileges within Android – specifically System UID access.

Installation of a Trojan application from the device manufacturer can grant the application full access to Android system and all applications (and their data) currently installed. The application then not only has the ability to read arbitrary application data on the device (email, SMS messages, documents, etc.), retrieve all stored account & service passwords, it can essentially take over the normal functioning of the phone and control any function thereof (make arbitrary phone calls, send arbitrary SMS messages, turn on the camera, and record calls). Finally, and most unsettling, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving (therefore hard-to-detect) nature of these “zombie” mobile devices to create a botnet.

by Hellsangel Tue Jul 09, 2013 12:36 pm

You just answered your own question. Why would a legitimate app be a trojan? Feel free to push Apple. But it is not even in the top 5 phones in the most populous country and they have to thank T-Mobile for the small boost in Market share that they just got in the US where they are still not #1.

by Guest Tue Jul 09, 2013 12:49 pm

Hellsangel wrote:You just answered your own question. Why would a legitimate app be a trojan? Feel free to push Apple. But it is not even in the top 5 phones in the most populous country and they have to thank T-Mobile for the small boost in Market share that they just got in the US where they are still not #1.

If it is a bonafide app created by the device manufacturer than is it not a legitimate app? And if such an app can be turned into a trojan which can go undetected even in the google app store, then does it not imply that the security features in android phones are not up to the mark.

by Hellsangel Wed Jul 10, 2013 1:45 pm

More for your reading pleasure:

http://www.androidcentral.com/bluebox-security-scanner-attempts-scare-living-shit-out-you

http://www.androidcentral.com/google-confirms-fix-master-key-vulnerability-released-oems

by Guest Wed Jul 10, 2013 1:51 pm

i don't know about android but my htc phone (running on android) hangs very often (requiring a cooling period of 1500 nanoseconds). it is frustrating in emergencies actually. it is past the warranty period. i will switch to samsung in a few days. i will never switch to apple (by principle).

by Sponsored content

A good reason for android users to switch to iphone

A good reason for android users to switch to iphone

Re: A good reason for android users to switch to iphone

Re: A good reason for android users to switch to iphone

Re: A good reason for android users to switch to iphone

Re: A good reason for android users to switch to iphone

Re: A good reason for android users to switch to iphone

Re: A good reason for android users to switch to iphone

Re: A good reason for android users to switch to iphone

Re: A good reason for android users to switch to iphone

Re: A good reason for android users to switch to iphone