5 ms·
There will always be bad actors, but I can't understand why Google tolerates low level malware. At least make them work a little.
by spcelzrd 9y ago
There will always be bad actors, but I can't understand why Google tolerates low level malware. At least make them work a little.
- Cyph0n 9y agoThis is the kind of malware that is difficult to block imo. As long as the auto clicking is done at a suitable interval, there really is no easy way to detect it. The question is: would such an attack work on Apple devices? I'm assuming that the iOS API provides similar functionality to apps running on the device.
- JKCalhoun 9y agoI would expect the malware developers already to have targeted iOS if it were possible?
- flashdance 9y agoThere are over twice as many android devices as ios devices, so if you're a malware creator it might make sense only to target the biggest fish.
- eridius 9y agoIt would make sense to target both.
- Cyph0n 9y agoWho's to say they haven't already?
- bobsam 9y agoFrom the article: "The company develops mobile apps for both Android and iOS platform" The apps are probably removed from both stores by now so we will never know ;)
- eridius 9y agoThey develop apps for both, but that doesn't necessarily mean they had the same adware in the iOS version.
- bobsam 9y agoBut why not? This is not some complex exploit, just standard JavaScript. I saw the same attitude after the xcode backdoor. "There is no reason to believe any personal data has been affected", well if apple didn't even knew this thing existed how could they possibly know if it was activly used?? Edit: according to reddit apple just pulled all apps made by these guys. Not a proof of anything but still something to consider
- eridius 9y agoThe simple reason is if they thought that App Review might catch their shenanigans then they might decide to not do it on iOS, because being caught means having their apps pulled. I'm not surprised that Apple pulled their apps anyway, it's what I'd expect of them since they've demonstrated a willingness to put adware in their apps, even if it was only on Android. So basically, maybe they put the adware in the iOS apps, maybe they didn't, but we can't tell from the article. But one would think that if they did, the article might have mentioned that, because it's a much better story to say "malware in the iOS app store" than it is to say "malware in the Google Play store".
- bobsam 9y agoI don't understand your comment. Apple and Google have the same mostly-automatic approval process. (You didnt think apple would manually inspect billions of apps and their updates? 2 weeks per app * 1 billion apps * 3 updates = 115 million man years)
- eridius 9y agoApple does not have an automatic approval process. They do a lot of automatic screening, because there's plenty that can be caught that way, but yes, every single app and update gets manual review by a human being. And your math is very wrong. Very few apps update every 2 weeks, most of the apps on the app store probably haven't even been updated in the past few months, and there's not even close to a billion apps. In an interview back in January Phil Schiller said the App Store had 2.2 million apps.
- openasocket 9y agoYou don't need to detect it as it's going on, it should be a part of the approval process for getting the app accepting into the Play store. Apps should undergo regular static and dynamic analysis. And probably some improvements to Bouncer
- Cyph0n 9y agoStatic analysis likely will not detect this type of malware as the malicious payload is only retrieved once the app is running. As for dynamic analysis, it's usually pretty easy to evade for a capable malware author. The only surefire way to catch this is to have someone manually analyze the app.
- openasocket 9y agoDynamic analysis isn't perfect by any means, but I expect Google to at least try, to get the low hanging fruit. As the OP said: "at least make them work a little." Do we know if this malware had sandbox detection techniques?
- NikolaeVarius 9y agoWhy do you assume Google doesn't try?
- openasocket 9y agoTechnically, I said "I expect Google to at least try," which is just stating my expectations rather than stating anything about whether Google met my expectations ;) But seriously, that's a fair point, my statement implied an unsourced assumption. I think Google tries to some extent, but I can't find anything saying Judy had anti-analysis capabilities, which makes me suspicious as to the effectiveness of Google's dynamic analysis of Play Apps.