Android App Security Risk
Linked by David Adams on Thu 24th Jun 2010 16:22 UTC, submitted by Governa
Privacy, Security, Encryption About 20 percent of third-party apps available through the Android marketplace allow third-party access to sensitive data, and can do things like make calls and send texts without the owners' knowledge, according to a recent security report from security firm SMobile Systems. There's no indication that any of the highlighted apps is malicious, but the report does underscore the inherent risks of a more open ecosystem as opposed to Apple's oppressive yet more controlled environment, with every app being vetted before availability.
E-mail Print r 0   · Read More · 52 Comment(s) http://osne.ws/i46
Thread beginning with comment 431428
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: From a security firm
by kaiwai on Fri 25th Jun 2010 05:25 UTC in reply to "RE: From a security firm"
kaiwai
Member since:
2005-07-06

PEWTD - Problem Exists With The Designer. Security is a process, not a feature, and the user should remain safe and in control should the worse happen because the system is designed as such. You could blame the user for causing a car crash, but you shouldn’t blame them if the car’s engineering fails to protect them; that’s down to the design of the car, not the user.


But how much is too much when it comes to an application giving off warnings before an end user does something? or how restrictive should it be where there is a weighing up between keeping the individual safe and giving maximum flexibility? at some point one has to take off the training wheels and allow the user to stay upright on the bike - and yes that might mean going into the gutter or straying into the road and getting hit by a car.

There is a thing called personal responsibility that is sorely lacking these days - time that end users exercised that instead of being mindless click and drool mouth breathers.

Reply Parent Score: 2

RE[3]: From a security firm
by lemur2 on Fri 25th Jun 2010 05:46 in reply to "RE[2]: From a security firm"
lemur2 Member since:
2007-02-17

"PEWTD - Problem Exists With The Designer. Security is a process, not a feature, and the user should remain safe and in control should the worse happen because the system is designed as such. You could blame the user for causing a car crash, but you shouldn’t blame them if the car’s engineering fails to protect them; that’s down to the design of the car, not the user.
But how much is too much when it comes to an application giving off warnings before an end user does something? or how restrictive should it be where there is a weighing up between keeping the individual safe and giving maximum flexibility? at some point one has to take off the training wheels and allow the user to stay upright on the bike - and yes that might mean going into the gutter or straying into the road and getting hit by a car. There is a thing called personal responsibility that is sorely lacking these days - time that end users exercised that instead of being mindless click and drool mouth breathers. "

The problem with the "PEWTD - Problem Exists With The Designer" thinking is that some designers deliberately design malicious code. When they do so, they will also do their utmost to obscure the fact that the code is malicious from the end user.

According to this article:
http://www.pcmag.com/article2/0,2817,2365651,00.asp

Where the Google spokesperson (Cannings) says this:
"In cases where users may have installed a malicious application that poses a threat, we've also developed technologies and processes to remotely remove an installed application from devices," Cannings wrote. "If an application is removed in this way, users will receive a notification on their phone."


Google themselves are apparently going to take responsibility for "malicious applications". If Google are alerted by one end user to the existence of a malicious application, or if Google identify such an application themselves, they apparently can and will take action and delete it from everybody's android phone.

Edited 2010-06-25 05:57 UTC

Reply Parent Score: 2

RE[4]: From a security firm
by kaiwai on Fri 25th Jun 2010 06:10 in reply to "RE[3]: From a security firm"
kaiwai Member since:
2005-07-06

Google themselves are apparently going to take responsibility for "malicious applications". If Google are alerted by one end user to the existence of a malicious application, or if Google identify it themselves, they apparently can and will delete it from everybody's android phone.


No need to spam the same post over and over and over again simply to get your post count up; I read it once in reply to a previous post, there is no need to repeat it over and over again. As much as I'd love to believe in the benevolent dictatorship of Google, we have already seen it take a nasty turn in the case of Apple and the iOS platform - which is the reason why I've stuck to my good old iPod Classic and ZTE R6 Mobile phone.

Remember when Apple was the darling of geeks? there is nothing stopping Google from making the 'tough decisions' when they need to even if it means angering a few geeks along the way.

Reply Parent Score: 2

Read more of this thread... >
RE[3]: From a security firm
by Stratoukos on Fri 25th Jun 2010 12:04 in reply to "RE[2]: From a security firm"
Stratoukos Member since:
2009-02-11

at some point one has to take off the training wheels and allow the user to stay upright on the bike - and yes that might mean going into the gutter or straying into the road and getting hit by a car.


What if the user doesn't want to learn how to ride a bike? To break from your analogy, a user doesn't want to "use a phone". He wants to share his photos, send an email or whatever.

This situation is primarily our fault ("our" in a very broad way; as in our industry). Some point in the past, we decided that computers aren't going to stay on the server rooms, but there is going to be one in every home. Since this is the direction we've taken, we have to actively support it by providing "training wheels" to everyone who needs them. Since you could say that generally a mobile app's audience needs these training wheels, you can't just shout RTFM to anyone who is confused and expect to be successful.

Reply Parent Score: 1

RE[4]: From a security firm
by kaiwai on Fri 25th Jun 2010 12:13 in reply to "RE[3]: From a security firm"
kaiwai Member since:
2005-07-06

What if the user doesn't want to learn how to ride a bike? To break from your analogy, a user doesn't want to "use a phone". He wants to share his photos, send an email or whatever.

This situation is primarily our fault ("our" in a very broad way; as in our industry). Some point in the past, we decided that computers aren't going to stay on the server rooms, but there is going to be one in every home. Since this is the direction we've taken, we have to actively support it by providing "training wheels" to everyone who needs them. Since you could say that generally a mobile app's audience needs these training wheels, you can't just shout RTFM to anyone who is confused and expect to be successful.


Then your analogy breaks down when one considers "I don't want to learn how to drive a car, I just want to get from A to B" to which one could say, "well, use public transport". Analogous to public transport would be devices like iPad/iPhone/iPod Touch - and with that comes restrictions, the very restrictions that people here decry as draconian. Apple has taken it upon themselves to be the benevolent 'provider' in lieu of individuals making such choices. What has been delivered to end users is an environment where they're taken care of - but we have people decry what Apple is providing. You either have security and less freedom, or freedom and all of the responsibility in your own hands - you can't have both.

Edited 2010-06-25 12:16 UTC

Reply Parent Score: 2

Read more of this thread... >
jabbotts Member since:
2007-09-06

I'd just stick with the normal aproach:

"
This program accesses your; address book, phone calling
[ ] do not show this warning in future.
[allow] [deny]
"

Each program can then warn the user that it will be touching stuff or, ideally, the OS provides the monitoring, warning and permissions on a per application basis.

I don't think a minimum of one warning per application is too much and people can always opt to leave the box unchecked and see the warning each time if desired.

Reply Parent Score: 2