Android App Security Risk
Linked by David Adams on Thu 24th Jun 2010 16:22 UTC, submitted by Governa
Privacy, Security, Encryption About 20 percent of third-party apps available through the Android marketplace allow third-party access to sensitive data, and can do things like make calls and send texts without the owners' knowledge, according to a recent security report from security firm SMobile Systems. There's no indication that any of the highlighted apps is malicious, but the report does underscore the inherent risks of a more open ecosystem as opposed to Apple's oppressive yet more controlled environment, with every app being vetted before availability.
E-mail Print r 0   · Read More · 52 Comment(s) http://osne.ws/i46
Thread beginning with comment 431361
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Comment by anevilyak
by anevilyak on Thu 24th Jun 2010 19:44 UTC in reply to "RE: Comment by anevilyak"
anevilyak
Member since:
2005-09-14

I'm curious how it asks. I don't own an Android based phone but depending on how these warnings are prompted to the user, makes all the difference. Are they ONLY asked at install time? What if a seemingly innocuous app starts making random calls/texts at a later time?


If I understand your question correctly, the rights it asks for at install time are all it ever gets. Ergo, if it didn't ask for the "make calls" right when you go to install it, it cannot suddenly change its mind later and will fail if it tries to.

Reply Parent Score: 2

RE[3]: Comment by anevilyak
by jtfolden on Thu 24th Jun 2010 20:20 in reply to "RE[2]: Comment by anevilyak"
jtfolden Member since:
2005-08-12

Well, that's sort of what I was getting at... how the user is alerted. For example, some sort of address book related app might, logically, ask for the permissions to make calls when first installed. Isn't this a situation where if it were a malicious app it could then later, make calls/send texts without notice?

Reply Parent Score: 1

RE[4]: Comment by anevilyak
by anevilyak on Thu 24th Jun 2010 20:38 in reply to "RE[3]: Comment by anevilyak"
anevilyak Member since:
2005-09-14

Well, that's sort of what I was getting at... how the user is alerted. For example, some sort of address book related app might, logically, ask for the permissions to make calls when first installed. Isn't this a situation where if it were a malicious app it could then later, make calls/send texts without notice?


That's certainly the case. What it does help you catch though is cases where an app is asking for rights it very obviously shouldn't need. For instance, suppose you go to install a game, and it asks for the right to make calls. Why would it possibly need that? That's the case it's designed to catch. An app later making malicious use of the capabilities you've allowed it to have is another animal entirely, and I don't see an easy way around that short of prompting every single time the app tries to do anything whatsoever, which would be a cure worse than the disease.

Reply Parent Score: 2

Read more of this thread... >