Android Malware "Obad" Called Most Sophisticated Yet 117
chicksdaddy writes "A new malicious program that runs on Android mobile devices exploits vulnerabilities in Google's mobile operating system to extend the application's permissions on the infected device, and to block attempts to remove the malicious application, The Security Ledger reports. The malware, dubbed Backdoor.AndroidOS.Obad.a, is described as a 'multi function Trojan.' Like most profit-oriented mobile malware, Obad is primarily an SMS Trojan, which surreptitiously sends short message service (SMS) messages to premium numbers. However, it is capable of downloading additional modules and of spreading via Bluetooth connections. Writing on the Securelist blog, malware researcher Roman Unuchek called the newly discovered Trojan the 'most sophisticated' malicious program yet for Android phones. He cited the Trojan's advanced features, including complex code obfuscation techniques that complicated analysis of the code, and the use of a previously unknown vulnerability in Android that allows Obad to elevate its privileges on infected devices and block removal."
Re:Vulnerability extends application's permissions (Score:3, Insightful)
As if that would be of any defense against the malware.
NO normal user hesitates to click OK. Most won't even understand what the messages mean. Remember : most people are not geeks.
The fault is solely on Android for not properly sandboxing apps. It would also help to be able to selectively set permissions instead of the current all or nothing approach. For example : Yes install, but no, you may NOT access the adressbook or the SMS API.
Re:So who lied? (Score:4, Insightful)
Didn't they tell us that Android, being Linux based is very very safe compared to anything we'd ever seen?
You may have been modded down but I do see a point with your post, everybody (but not the sort of people that frequent sites like this) has been told how secure Linux systems are and since Android is a Linux system I doubt you'd find many non-techs would understand why Android being a Linux system doesn't necessarily make it secure. Any application on any system (not just Android) that can access system resources - like SMS functionality - is going to have the capacity to act maliciously so it really is up to the user to decide whether to allow that sort of access to the application, this is even more difficult if the application has a legitimate purpose in accessing such functionality.
For at least some tech enthusiasts it's fine to say 'just make it open source' and the individual can vet it - but of course the vast majority will not do that - so trusting a generally (yes none is absolutely guaranteed and some are better than others) well-vetted marketplace (Google Play, iOS App Store, Windows Store, Amazon Store?) seems to be the best bet for most people.
Re:2 decades of Windows being pwned and Google lea (Score:5, Insightful)
So, so much this.
Relying on the end user to magically be aware that stuff they are signing is not trojaned, reputable, etc. is not going to work. As demonstrated by Microsoft for the last 30 years, and as demonstrated in the unix world since the 70s.
I've been saying for some time that Android is the Windows of the mobile world. Not because of the code-base or even quality of the code-base, but due to the design decision to push security back on the end user. 99.999% of us are not security experts.
Virus scanners are a waste of resources (cpu/storage and thus, battery).
Vet executables at the source. If the user wants to run their own code, provide a code signing mechanism (this can be done on iOS with a dev account, sure there is a cost argument but the technical benefit is huge. if it was free and there was sufficient verification of an individual's identity to prevent issuing multiple certs to the same person, the money issue could go away. at the moment the cost is there to make obtaining thousands (say) of code-signing certs impractical for a malware author). If apple included a code-signing cert for the end user to "bless" their own (or downloaded) code with for use on their own devices, would people's bitching about not "owning" their iOS device change?
This is the single biggest reason I am an iOS user. I've been around long enough to know not to trust myself or any of my users to vet apps themselves (no one has the time or skillset or tools to do it anyway). I have no faith in the security of a device which can run any code from anywhere being in the hands of an end user (including myself) who is not capable of verifying whether or not code is malicious.
No it is not a 100% solution and there is every chance that malware slips through, however once it has been reported to the distribution point, its cert can be revoked to stop it spreading any further.
Yes, exploits can be created if the signing mechanism is secure, but that is an implementation issue, not a core design issue, and can be fixed.
Re: Follow the Money? (Score:4, Insightful)
The latest version of cyanogen actually has this feature. Anytime a text is attempted to be sent to a premium number or service the OS itself blocks
Until the malware removes the block of course... If it can escalate permissions it can probably also take out a lot of system safeguards.
Re:So who lied? (Score:2, Insightful)
What percentage of ACs are Google employees making excuses?