Google Has Android Remote App Install Power, Too 278
Posted
by
timothy
from the coming-and-going dept.
from the coming-and-going dept.
Trailrunner7 writes "The remote-wipe capability that Google recently invoked to remove a harmless application from some Android phones isn't the only remote control feature that the company built into its mobile OS. It turns out that Android also includes a feature that enables Google to remotely install apps on users' phones as well. Jon Oberheide, the security researcher who developed the application that Google remotely removed from Android phones, noticed during his research that the Android OS includes a feature called INSTALL_ASSET that allows Google to remotely install applications on users' phones. 'I don't know what design decision they based that on. Maybe they just figured since they had the removal mechanism, it's easy to have the install mechanism too,' Oberheide said in an interview. 'I don't know if they've used it yet.'"
kinda scary (Score:5, Insightful)
So how long until we see someone attempt to exploit this?
No (Score:4, Insightful)
I'm sure someone could create a honeypot wifi network that forces all Android devices that connect to it to install a particular app.
Not unless they manage to compromise SSL in order to make the phone think it's talking to Google when it really isn't. If someone manages to do that, we have much bigger things to worry about than a malicious phone app.
Re:Drive-by installing (Score:3, Insightful)
Re:kinda scary (Score:5, Insightful)
Not so terrible (Score:5, Insightful)
While this could be used to push more carrier crapware, I think updates and upgrades of installed apps are more likely to work for more phones and easier for the average user to use.
In all honesty, would you rather be using an outdated version of a browser with security flaws because your phone doesn't support Android 2.75 Double Chocolate Chunk Cookie or just have your browser update to a more secure version OTA?
Re:kinda scary (Score:5, Insightful)
I think that remote anything should be opt-in by the user, or, in an enterprise setting, should be added on by the enterprise before distributing the units. I do not welcome the idea that *all* Android handsets will have remote add/remove package functionality out of the box, for all users.
Imagine the fun law enforcement and government agencies will have with this. Remote install app that silently forwards mic input to an eavesdropper.
Is there even a way to turn this feature off? I.e., lets say I buy a handset and I definitely do *not* want Google nuking my apps remotely or adding apps to my phone remotely without my knowledge.
This is the reason that I think the FOSS community should back MeeGo. It's the only *true* open source system out there that's open enough that the Many Eyeballs principle can be applied to, and that is open enough that we'll eventually see custom distros of the OS emerging.
Re:Really? (Score:3, Insightful)
Except, since Android is open, one can expect that "ROM" developers will make available images (at least on phones where privilege escalation has been achieved) which don't allow this, assuming there's demand for it. Try blocking updates on "every other phone."
Re:Not so terrible (Score:2, Insightful)
There is competition now in the phone market, Google doesn't want to screw up anything because I could go to iOS, BlackBerry OS, WinMobile, Symbian, or heck, I could just root my phone and remove the crap.
Google attracts the people who don't want to play games and jump through hoops like you have to with Windows Mobile or the iPhone. Google knows this and wouldn't want to kill their main vocal market.
We saw this at Google IO 2010 (Score:2, Insightful)
Re:Really? (Score:3, Insightful)
The line between OS version and app is entirely arbitrary, and Google is working to move more of the OS functionality into apps.
From a security standpoint, if Google has access to this, they have access to the OS anyway, installing/removing apps is not a big deal. They already have root on your device (and you don't.)
Re:kinda scary (Score:4, Insightful)
Then they can remote install some kiddy porn images so they have excuse to raid his house and confiscate all his computer equipment.
Re:Really? (Score:5, Insightful)
...he seemed to think of the phone's owner more as a security threat than as the person who should be setting security policy.
To be fair, he does have a point, if in fact that was his view. I mean, how many zombified PCs are out there now, DDoSing servers and spamming the planet, just because their owners can't manage (at a bare minimum) to enable Automatic Updates? Millions? Tens of millions?
I know hating Google is in vogue these days, but let's be honest here: so far, they're no Microsoft. They're not a convicted monopoly; they've gone out of their way to invest real resources in opening their services, actually spending money to make it easier for people to migrate away from Gmail and Google Docs; they sponsor and promote open source; and they compete by constantly making their products better, rather than trying to strong-arm people into buying their junk. So yeah, until they show otherwise, I'm going to be cautiously optimistic and give them the benefit of the doubt.
The question is, is there a way for paranoid individuals to turn this capability off if they want to. Let the Joe Sixpacks of the world live in blissful ignorance, and let Google keep them from bringing the cell networks down with their inability to properly patch and protect their phones; just give me the ability to opt out if I know the risks, and choose to take them.
Re:Not so terrible (Score:4, Insightful)
As the android user base gets more mainstream, the "vocal" nerds will be drowned out by people who just want cute shit.
This crowd will accept what-ever crapware the carriers want them to have, they always have....and Google won't find it so hard to just give in.
Inevitably, the OTA install function will be abused.
Re:No (Score:5, Insightful)
Actually, this moves android from "my next phone" to a "definite maybe".
I do NOT like back doors. This makes the SSL Cert that would be used to prove one is google a very valuable target indeed. It really makes me wonder if it is a question of "if" or "when". On top of that, why should I trust google with this? If something needs to be installed, on MY PHONE, I want to be, at least, asked.
-Steve
Re:Not so terrible (Score:5, Insightful)
Yep, because google's not an advertising company, and would never want to, say, install an app that brings you the "great new feature" of automatically pinging their servers with a GPS coordinate and downloading location-relevant ads right to your phone!
Point is - you aren't offered a choice. Point is - you aren't being asked, "is it okay if we do this?" I don't care what the feature is, I'd take severe issue with someone deciding, "here you need this." And let's be honest - updates aren't always flawless... if Google bricks my phone accidentally, will I be able to recover any important data I might have had on there?
Re:Really? (Score:1, Insightful)
Yeah, if I don't want to trust a company to have control over the device that I hold in my hand. I definitely must to get the device from the said company that publicly acknowledge that they have control over the device.
Re:kinda scary (Score:3, Insightful)
This is great news (Score:2, Insightful)
Because Android is still less evil and invasive than iOS.
I'm not trying to troll, but really. if you compare the the two platforms one is mostly open and one is glued shut.
Re:No (Score:3, Insightful)
Actually, this moves android from "my next phone" to a "definite maybe".
I do NOT like back doors.
You always have the option to root your phone and install a third-party build of Android that doesn't have this feature. (Unlike a certain other company, Google doesn't claim that you'd be breaking the law by doing so.)
This makes the SSL Cert that would be used to prove one is google a very valuable target indeed.
As if it isn't already? If you can impersonate Google, you can access everyone's Gmail, AdSense, AdWords, Docs, etc.
Re:This is great news (Score:4, Insightful)
I'm not trying to troll, but really; if you compare the two platforms one is mostly bought and paid for by the handset purchaser, the other is free to the consumer and OEM but is distributed with the intent of selling mobile eyeballs to advertisers. What could possibly go wrong?
Re:Isn't Android Open Source? (Score:2, Insightful)
Pretty much only the kernel is open source and not the other parts.
The Google apps, the main interface API, and anything relating to the market are well locked down.
The Android is not a phone you should get if you want an open source phone. Try the OpenMokos.
It's not what Google would do with it... (Score:3, Insightful)
It is what a blackhat would be able to do if they were able to find Google's private key.
Re:Really? (Score:2, Insightful)
How is that not consistent? For the vast majority of users, a phone is an appliance, just like a PC is an appliance, or a refrigerator, or a car. They don't know what is involved in maintaining that phone, or the security risks associated with using the phone, nor are they particularly inclined to care; they have more important things to do with their lives, like hold down a job, take care of kids, keep up with politics to be a better informed voter, etc. For these sorts of people, whom I suspect makes up at least 90% of the population (maybe more), it makes perfect sense to have a (for now) trusted source seamlessly take care of the security of the phone transparently, without them having to do a thing.
Note that this is exactly why Vista's UAC is the exact wrong way to handle security for the "normal" user: they don't know what's in their best interest, nor do they have the time and/or inclination to find out. Now, obviously they should take the time, but, seeing as they are already choosing not to, the only viable solution is to do it for them. It's the same reason programmers are told never to roll their own cryptography solution: for most of the population it's hard for them to get it right, and instead should rely on established solutions.
On the other hand, there is that other ten percent who does care and has time to learn the issues involved in privacy protection and information security. For these people, it makes perfect sense to allow them the option to "go it alone," to reject the one size fits all security that a default install would imply, and perform their updates manually.
Re:kinda scary (Score:4, Insightful)
MeeGo also has the advantage of not reinventing the entire userspace, thus remaining closer to what we generally consider a GNU/Linux system. Android is quite slick in practice but it does upset me that it's so non-standard in every possible way :-(
Re:kinda scary (Score:2, Insightful)