Android App Security Risk
Linked by David Adams on Thu 24th Jun 2010 16:22 UTC, submitted by Governa
Privacy, Security, Encryption About 20 percent of third-party apps available through the Android marketplace allow third-party access to sensitive data, and can do things like make calls and send texts without the owners' knowledge, according to a recent security report from security firm SMobile Systems. There's no indication that any of the highlighted apps is malicious, but the report does underscore the inherent risks of a more open ecosystem as opposed to Apple's oppressive yet more controlled environment, with every app being vetted before availability.
E-mail Print r 0   · Read More · 52 Comment(s) http://osne.ws/i46
Thread beginning with comment 431432
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[3]: From a security firm
by lemur2 on Fri 25th Jun 2010 05:46 UTC in reply to "RE[2]: From a security firm"
lemur2
Member since:
2007-02-17

"PEWTD - Problem Exists With The Designer. Security is a process, not a feature, and the user should remain safe and in control should the worse happen because the system is designed as such. You could blame the user for causing a car crash, but you shouldn’t blame them if the car’s engineering fails to protect them; that’s down to the design of the car, not the user.
But how much is too much when it comes to an application giving off warnings before an end user does something? or how restrictive should it be where there is a weighing up between keeping the individual safe and giving maximum flexibility? at some point one has to take off the training wheels and allow the user to stay upright on the bike - and yes that might mean going into the gutter or straying into the road and getting hit by a car. There is a thing called personal responsibility that is sorely lacking these days - time that end users exercised that instead of being mindless click and drool mouth breathers. "

The problem with the "PEWTD - Problem Exists With The Designer" thinking is that some designers deliberately design malicious code. When they do so, they will also do their utmost to obscure the fact that the code is malicious from the end user.

According to this article:
http://www.pcmag.com/article2/0,2817,2365651,00.asp

Where the Google spokesperson (Cannings) says this:
"In cases where users may have installed a malicious application that poses a threat, we've also developed technologies and processes to remotely remove an installed application from devices," Cannings wrote. "If an application is removed in this way, users will receive a notification on their phone."


Google themselves are apparently going to take responsibility for "malicious applications". If Google are alerted by one end user to the existence of a malicious application, or if Google identify such an application themselves, they apparently can and will take action and delete it from everybody's android phone.

Edited 2010-06-25 05:57 UTC

Reply Parent Score: 2

RE[4]: From a security firm
by kaiwai on Fri 25th Jun 2010 06:10 in reply to "RE[3]: From a security firm"
kaiwai Member since:
2005-07-06

Google themselves are apparently going to take responsibility for "malicious applications". If Google are alerted by one end user to the existence of a malicious application, or if Google identify it themselves, they apparently can and will delete it from everybody's android phone.


No need to spam the same post over and over and over again simply to get your post count up; I read it once in reply to a previous post, there is no need to repeat it over and over again. As much as I'd love to believe in the benevolent dictatorship of Google, we have already seen it take a nasty turn in the case of Apple and the iOS platform - which is the reason why I've stuck to my good old iPod Classic and ZTE R6 Mobile phone.

Remember when Apple was the darling of geeks? there is nothing stopping Google from making the 'tough decisions' when they need to even if it means angering a few geeks along the way.

Reply Parent Score: 2

RE[5]: From a security firm
by lemur2 on Fri 25th Jun 2010 06:25 in reply to "RE[4]: From a security firm"
lemur2 Member since:
2007-02-17

"Google themselves are apparently going to take responsibility for "malicious applications". If Google are alerted by one end user to the existence of a malicious application, or if Google identify it themselves, they apparently can and will delete it from everybody's android phone.
No need to spam the same post over and over and over again simply to get your post count up; I read it once in reply to a previous post, there is no need to repeat it over and over again. As much as I'd love to believe in the benevolent dictatorship of Google, we have already seen it take a nasty turn in the case of Apple and the iOS platform - which is the reason why I've stuck to my good old iPod Classic and ZTE R6 Mobile phone. Remember when Apple was the darling of geeks? there is nothing stopping Google from making the 'tough decisions' when they need to even if it means angering a few geeks along the way. "

I wasn't spamming ... I personally think this is very problematical. Google have already zapped two applications out of existence in the Android universe.

One the one hand, there is nobody in a better position than Google to take on such a "Android app police" role. They could be everybody's Android anti-malware monitor, without taking up anybody's Android CPU power. That bit is pretty neat, really.

However, having said that, they also effectively have built in a "veto" for themselves on what can be installed on Android phones. If Google don't like it they can wipe it from everyone's Android phone. In fact, if someone else (maybe the government or the RIAA or MPAA) don't like it, perhaps they may be able to force Google to zap it from everyone's Android phone.

That aspect of it seems even worse than Apple's shenanigans.

So how about a bit of sane discussion on Google's real-world provisions here, what Google are actually doing and planning to do, instead of pontificating from on high about how users cannot be relied upon to do the best thing by themselves. Apparently, for Andoid phones, they aren't going to be asked to.

Reply Parent Score: 2

Read more of this thread... >