Android App Security Risk
Linked by David Adams on Thu 24th Jun 2010 16:22 UTC, submitted by Governa
Privacy, Security, Encryption About 20 percent of third-party apps available through the Android marketplace allow third-party access to sensitive data, and can do things like make calls and send texts without the owners' knowledge, according to a recent security report from security firm SMobile Systems. There's no indication that any of the highlighted apps is malicious, but the report does underscore the inherent risks of a more open ecosystem as opposed to Apple's oppressive yet more controlled environment, with every app being vetted before availability.
E-mail Print r 0   · Read More · 52 Comment(s) http://osne.ws/i46
Thread beginning with comment 431368
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[3]: Comment by anevilyak
by jtfolden on Thu 24th Jun 2010 20:20 UTC in reply to "RE[2]: Comment by anevilyak"
jtfolden
Member since:
2005-08-12

Well, that's sort of what I was getting at... how the user is alerted. For example, some sort of address book related app might, logically, ask for the permissions to make calls when first installed. Isn't this a situation where if it were a malicious app it could then later, make calls/send texts without notice?

Reply Parent Score: 1

RE[4]: Comment by anevilyak
by anevilyak on Thu 24th Jun 2010 20:38 in reply to "RE[3]: Comment by anevilyak"
anevilyak Member since:
2005-09-14

Well, that's sort of what I was getting at... how the user is alerted. For example, some sort of address book related app might, logically, ask for the permissions to make calls when first installed. Isn't this a situation where if it were a malicious app it could then later, make calls/send texts without notice?


That's certainly the case. What it does help you catch though is cases where an app is asking for rights it very obviously shouldn't need. For instance, suppose you go to install a game, and it asks for the right to make calls. Why would it possibly need that? That's the case it's designed to catch. An app later making malicious use of the capabilities you've allowed it to have is another animal entirely, and I don't see an easy way around that short of prompting every single time the app tries to do anything whatsoever, which would be a cure worse than the disease.

Reply Parent Score: 2

RE[5]: Comment by anevilyak
by jtfolden on Thu 24th Jun 2010 20:44 in reply to "RE[4]: Comment by anevilyak"
jtfolden Member since:
2005-08-12

Well, there's actually a 3rd option where you could be prompted the first time such usage is actually requested with the option to keep being alerted each time or to "always allow" for that app. This still might not entirely cure the issue but it is then at least up to the user whether to completely trust an app or not and/or when to decide to trust it. The plus side to this, also, is that a malicious coder has no way of knowing when the client would "trust" the app - unlike now, knowing that if it makes it past the install it is home free.

I believe a similar scheme is already used on certain smartphone OS's for things such as Location Services.

Edited 2010-06-24 20:47 UTC

Reply Parent Score: 1

RE[5]: Comment by anevilyak
by mrhasbean on Thu 24th Jun 2010 22:32 in reply to "RE[4]: Comment by anevilyak"
mrhasbean Member since:
2006-04-03

That's certainly the case. What it does help you catch though is cases where an app is asking for rights it very obviously shouldn't need. For instance, suppose you go to install a game, and it asks for the right to make calls. Why would it possibly need that?


And the average user is supposed to understand exactly what's being asked and make the correct judgement call at install time? The same users who see a popup on their home PC telling them that they have a virus and need to install this you-beaut software to fix it, to later find they actually installed a trojan?

OK, I can see how that will work...

Reply Parent Score: 2

Read more of this thread... >