Android App Security Risk
Linked by David Adams on Thu 24th Jun 2010 16:22 UTC, submitted by Governa
Privacy, Security, Encryption About 20 percent of third-party apps available through the Android marketplace allow third-party access to sensitive data, and can do things like make calls and send texts without the owners' knowledge, according to a recent security report from security firm SMobile Systems. There's no indication that any of the highlighted apps is malicious, but the report does underscore the inherent risks of a more open ecosystem as opposed to Apple's oppressive yet more controlled environment, with every app being vetted before availability.
E-mail Print r 0   · Read More · 52 Comment(s) http://osne.ws/i46
Thread beginning with comment 431452
To view parent comment, click here.
To read all comments associated with this story, please click here.
Neolander
Member since:
2010-03-08

Android apps can phone home and change themselves without user permission
http://blogs.forbes.com/firewall/2010/06/21/researcher-builds-mock-...

Those are security defects, which indeed require patching, in the Android operating system, not in the market model. The previous posts were about the App Store model, not about iOS' specific implementation.

(I won't be advocating Android facing iOS, since in my opinion both operating systems are canned crap. In fact, I think that the whole touchscreen smartphone idea has only spawned canned crap in all of its current implementations, though Windows Phone 7 Series looks somewhat promising if they sell it on phones with a physical keyboard)

Thanks for posting your manuscript though.

You're welcome, sir =p

Edited 2010-06-25 09:07 UTC

Reply Parent Score: 2

nt_jerkface Member since:
2009-08-26

Those are security defects, which indeed require patching, in the Android operating system,


It's a very poor design that will likely be exploited.

As much as geeks lament the locked down nature of the App store it does have a pristine security record.

There's more to improving the security of applications than your list shows, there is also developer verification which is part of the App store application process.

As for binary security checks they can be performed with software. Not 100% effective but when combined with developer verification you have a strong deterrent.

You can be dismissive of the app store but it has an excellent security record that cannot be denied.

Reply Parent Score: 2

Neolander Member since:
2010-03-08

What do you call developer verification exactly ? Some kind of digital signing that (is supposed to) identify the guy who submitted the app ?

Moreover, I agree that the App store has an excellent security record... But it's just like Nokia's Ovi Store, Microsoft's Marketplace, Android's Market, RIM's I-don't-remembler-how-they-called-it or even the old $5 java games download pages in that respect : there are only little to no recorded exploits in each case, so we can't make conclusions yet. It'd be like saying "Oh, dammit, those mobile OSs are so much more secure than Windows !".

To get a good picture, we should have good data in the form of hundreds of recorded exploits. Which the mobile phone repository system does not have yet, because it's just an uninteresting target at the moment. Plus, it lacks global penetration on the market : at the moment, smartphones still are mostly used by geeks and some executives who want to show how rich they are because they can...

Edited 2010-06-25 10:30 UTC

Reply Parent Score: 2

Read more of this thread... >
Neolander Member since:
2010-03-08

You can be dismissive of the app store but it has an excellent security record that cannot be denied.

It's just a repository where package are checked before admission. Tons of these exist in the rest of the computing world. I'm not dismissive of that, as long as it's coupled with other strategies. What I don't understand is why the App Store is presented like some kind of revolutionary product.

Edited 2010-06-25 10:35 UTC

Reply Parent Score: 2

Read more of this thread... >