Android App Security Risk
Linked by David Adams on Thu 24th Jun 2010 16:22 UTC, submitted by Governa
Privacy, Security, Encryption About 20 percent of third-party apps available through the Android marketplace allow third-party access to sensitive data, and can do things like make calls and send texts without the owners' knowledge, according to a recent security report from security firm SMobile Systems. There's no indication that any of the highlighted apps is malicious, but the report does underscore the inherent risks of a more open ecosystem as opposed to Apple's oppressive yet more controlled environment, with every app being vetted before availability.
E-mail Print r 0   · Read More · 52 Comment(s) http://osne.ws/i46
Permalink for comment 431432
To read all comments associated with this story, please click here.
RE[3]: From a security firm
by lemur2 on Fri 25th Jun 2010 05:46 UTC in reply to "RE[2]: From a security firm"
lemur2
Member since:
2007-02-17

"PEWTD - Problem Exists With The Designer. Security is a process, not a feature, and the user should remain safe and in control should the worse happen because the system is designed as such. You could blame the user for causing a car crash, but you shouldn’t blame them if the car’s engineering fails to protect them; that’s down to the design of the car, not the user.
But how much is too much when it comes to an application giving off warnings before an end user does something? or how restrictive should it be where there is a weighing up between keeping the individual safe and giving maximum flexibility? at some point one has to take off the training wheels and allow the user to stay upright on the bike - and yes that might mean going into the gutter or straying into the road and getting hit by a car. There is a thing called personal responsibility that is sorely lacking these days - time that end users exercised that instead of being mindless click and drool mouth breathers. "

The problem with the "PEWTD - Problem Exists With The Designer" thinking is that some designers deliberately design malicious code. When they do so, they will also do their utmost to obscure the fact that the code is malicious from the end user.

According to this article:
http://www.pcmag.com/article2/0,2817,2365651,00.asp

Where the Google spokesperson (Cannings) says this:
"In cases where users may have installed a malicious application that poses a threat, we've also developed technologies and processes to remotely remove an installed application from devices," Cannings wrote. "If an application is removed in this way, users will receive a notification on their phone."


Google themselves are apparently going to take responsibility for "malicious applications". If Google are alerted by one end user to the existence of a malicious application, or if Google identify such an application themselves, they apparently can and will take action and delete it from everybody's android phone.

Edited 2010-06-25 05:57 UTC

Reply Parent Score: 2