Google Has Android Remote App Install Power, Too 278
Trailrunner7 writes "The remote-wipe capability that Google recently invoked to remove a harmless application from some Android phones isn't the only remote control feature that the company built into its mobile OS. It turns out that Android also includes a feature that enables Google to remotely install apps on users' phones as well. Jon Oberheide, the security researcher who developed the application that Google remotely removed from Android phones, noticed during his research that the Android OS includes a feature called INSTALL_ASSET that allows Google to remotely install applications on users' phones. 'I don't know what design decision they based that on. Maybe they just figured since they had the removal mechanism, it's easy to have the install mechanism too,' Oberheide said in an interview. 'I don't know if they've used it yet.'"
They also removed the restraining bold from C3PO (Score:2, Funny)
Google has been taken over by Jawas.
Re: (Score:2, Informative)
Re: (Score:3, Funny)
kinda scary (Score:5, Insightful)
So how long until we see someone attempt to exploit this?
Re:kinda scary (Score:5, Insightful)
Re:kinda scary (Score:5, Insightful)
I think that remote anything should be opt-in by the user, or, in an enterprise setting, should be added on by the enterprise before distributing the units. I do not welcome the idea that *all* Android handsets will have remote add/remove package functionality out of the box, for all users.
Imagine the fun law enforcement and government agencies will have with this. Remote install app that silently forwards mic input to an eavesdropper.
Is there even a way to turn this feature off? I.e., lets say I buy a handset and I definitely do *not* want Google nuking my apps remotely or adding apps to my phone remotely without my knowledge.
This is the reason that I think the FOSS community should back MeeGo. It's the only *true* open source system out there that's open enough that the Many Eyeballs principle can be applied to, and that is open enough that we'll eventually see custom distros of the OS emerging.
Re:kinda scary (Score:4, Insightful)
Then they can remote install some kiddy porn images so they have excuse to raid his house and confiscate all his computer equipment.
Re: (Score:3, Interesting)
Meh, they have that kind of software for almost all phones. http://flexispy.com/ [flexispy.com] and plenty others, I'm sure.
I suppose it might be nefarious that they don't even need physical access to your phone to install it. But the install feature probably asks for user confirmation before receiving a "push" install from your carrier, just like my cheap Samsung dumbphone.
If you really want control, I suppose you could put http://www.cyanogenmod.com/ [cyanogenmod.com] on your Android phone. Is that affected?
Re:kinda scary (Score:5, Interesting)
And besides, it's not like google is targeting you specificaly, they target all phones with that app installed. The purpose of it is to remove a malicious app before it can do any more damage.
Example: I make an app branded as a porn site viewer, it works as one but it also sends information gathered from your sdcard/phone for some nefarious deeds. Removing it from the market would stop the app from spreading, but it has already been installed on thousands of phones, setting a flag on the market for "uninstall from phone NOW" would fix this.
I know google could be more gentle about it and warn the user and ask for the app to be removed, but it's not like they use it on every app that pisses them, only on those that disregard their stated rules. So far google has been following the rules, so articles like this are just spreading FUD.
Re:kinda scary (Score:5, Informative)
@MikeDaSpike
This is not twitter. We can tell that you are replying to MikeDaSpike because you pressed the Reply to This button under his post and so your post shows up in the thread below his.
Re: (Score:2)
"Google already announced
Re: (Score:2)
How does an off-topic reply that misses the point of the topic totally get modded "interesting" ?
Being wrong and being interesting often go together. Look at all the physics crackpots. Or politicians.
Re: (Score:2)
It's the only *true* open source system out there that's open enough that the Many Eyeballs principle can be applied to, and that is open enough that we'll eventually see custom distros of the OS emerging.
Although I get your point, I'd say the Many Eyeballs principle is working with Android, given that this article exists.
Re:kinda scary (Score:4, Insightful)
MeeGo also has the advantage of not reinventing the entire userspace, thus remaining closer to what we generally consider a GNU/Linux system. Android is quite slick in practice but it does upset me that it's so non-standard in every possible way :-(
Re:kinda scary (Score:5, Funny)
Re:kinda scary (Score:5, Informative)
I am working one it. Just one more line of code, almost there.
I like to lick butts!
Re:kinda scary (Score:5, Funny)
Wait! I didn't post that!!
Re: (Score:3, Insightful)
Re: (Score:3, Funny)
Good thing that wasn't Apple (Score:5, Funny)
Slashdot headline would have been:
"Evil Apple Hides Secret Rootkit Installer on All iPhones"
Re:Good thing that wasn't Apple (Score:4, Funny)
Re: (Score:3, Funny)
There, now it's news.
Re:Good thing that wasn't Apple (Score:4, Funny)
Re: (Score:2)
You know there's digital encryption involved and they're monitoring it. If you purposely cover it then you are violating the DMCA and they'll send teh goverments after you.
Re: (Score:2)
"Apple Hides Secret Rootkit Installer on iPhone 4" There, now it's news.
"Gizmodo Informant Arrested for Exposing Secret Apple Rootkit" will be the news two days later.
Re: (Score:2)
Slashdot headline would have been:
"Evil Apple Hides Secret Rootkit Installer on All iPhones"
Any moment now, people will start saying that Google is the New Apple, which is the New Microsoft, which is the New...what? Commodore?
Re:Good thing that wasn't Apple (Score:5, Informative)
Any moment now, people will start saying that Google is the New Apple, which is the New Microsoft, which is the New...what? Commodore?
IBM, grasshopper, Microsoft used to be the new IBM. Learn your history!
Re: (Score:2)
Re: (Score:2)
Any moment now, people will start saying that Google is the New Apple, which is the New Microsoft, which is the New...what? Commodore?
IBM, grasshopper, Microsoft used to be the new IBM. Learn your history!
Microsoft was never the new anything. They basically invented the business model of selling software to hardware vendors, so anyone that replaces them in that capacity is the new Microsoft, but they are the original. This was never IBM's market.
Re: (Score:2)
Well, that's essentially how we are taking this news, right? Same difference, but Android users don't need the more colorful language to comprehend what's going on. The reporting was spot on, and we get it, without alarmism.
Really? (Score:5, Interesting)
You mean they can remotely install apps over the air just like every other modern phone on every other carrier I've ever seen?
This is a non-story -- OTA install is pretty much required by every carrier out there so they can force you to upgrade your phone.
Re: (Score:3, Interesting)
Re: (Score:2, Interesting)
A new OS version or patch, sure. An app, not so much. My Android phones doesn't OTA update without prompting me and me approving it. The meat of the article, in my understanding, is that they have a function that will automagically install or remove an app without user interaction. Is that not correct?
As far as I can tell, Yes. One instance I could see/understand is for this is Google provided programs that are included with the phone (Maps, Gmail, Browser, ext) being forced to a newer version.
Re: (Score:2)
Chances are your browser is going to be the most targeted part of any OS and it is an app.
Re: (Score:2)
I would prefer that Google didn't put a browser on my phone that contains a "terrible vulnerability".
Re: (Score:3, Interesting)
Lets face it, the only secure computer is one in a perfectly secure vault, powered off and has the only person know where the vault is killed.
Re: (Score:2)
If it's google software, it's "Perfectly Secure Browser (Beta!)" and will remain so for a good couple years before it reaches v 1.0.
Re:Really? (Score:5, Interesting)
Actually, according to a talk by Rich Cannings, Google's "Android Security Leader", at Usenix Security '09 in Montreal, Google can choose whether or not to have your phone ask you for permission for an OS upgrade. If they think it's important enough, they reserve the "right", and definitely retain the technical capability, to install an upgrade without asking. The carriers can probably also do OTA upgrades on their own initiative; that part wasn't clear to me.
The whole tone of his talk was scary. There was no sign that he could imagine that somebody might not want to trust Google with total control of their phone, or that such distrust could possibly be legitimate if it did exist. His whole attitude reeked of "we know better than you do", and he seemed to think of the phone's owner more as a security threat than as the person who should be setting security policy. And he didn't even mention the possibility that Google might get compromised.
He also seemed to think of the Android open source project as something to push code to as an afterthought, rather less important than the carriers... whose interests he seemed to think were terribly, terribly important.
It was not reassuring.
And, yes, my understanding matches yours. The article says that they can also install apps, in addition to OTA OS upgrades. In fact, as I read the supporting material, the Market application works by pushing an "INSTALL_ASSET" message to your phone... the same message they'd use to spontaneously install an app. So there's no fixing the problem without either disabling the Market entirely or patching the implementing code.
And of course an OS upgrade could contain code to do anything they want, including enabling them to install apps if they weren't already able to do so.
Re:Really? (Score:5, Insightful)
...he seemed to think of the phone's owner more as a security threat than as the person who should be setting security policy.
To be fair, he does have a point, if in fact that was his view. I mean, how many zombified PCs are out there now, DDoSing servers and spamming the planet, just because their owners can't manage (at a bare minimum) to enable Automatic Updates? Millions? Tens of millions?
I know hating Google is in vogue these days, but let's be honest here: so far, they're no Microsoft. They're not a convicted monopoly; they've gone out of their way to invest real resources in opening their services, actually spending money to make it easier for people to migrate away from Gmail and Google Docs; they sponsor and promote open source; and they compete by constantly making their products better, rather than trying to strong-arm people into buying their junk. So yeah, until they show otherwise, I'm going to be cautiously optimistic and give them the benefit of the doubt.
The question is, is there a way for paranoid individuals to turn this capability off if they want to. Let the Joe Sixpacks of the world live in blissful ignorance, and let Google keep them from bringing the cell networks down with their inability to properly patch and protect their phones; just give me the ability to opt out if I know the risks, and choose to take them.
Re: (Score:2)
There shouldn't be, for all the reasons you gave in support of why users really ARE a security threat rather than the ones who should be setting security policy for their phones. If the question is "does Google or the owner know better whether or not something should be installed?" the answer can't be "Google, but they should make a checkbox that says 'lulz just kidding, I'm smarter, turn it off.'" It's
Re: (Score:2)
The question is, is there a way for paranoid individuals to turn this capability off if they want to.
There shouldn't be, for all the reasons you gave in support of why users really ARE a security threat rather than the ones who should be setting security policy for their phones.
There should be, for the reason that only some users are a security threat (as described in GP, the ones whose PCs are DDOS-bots and such) while others are not (those of us who update regularly and don't run untrusted executable downloads or other shifty things).
If the question is "does Google or the owner know better whether or not something should be installed?" the answer can't be "Google, but they should make a checkbox that says 'lulz just kidding, I'm smarter, turn it off.'" It's not logically consistent.
It's not logically consistent only if you assume all users are identical. isn't it more reasonable to say that Google is better at deciding than those users who never figure out where the check box is or never care enough to check it, and Google is
Re: (Score:2, Insightful)
How is that not consistent? For the vast majority of users, a phone is an appliance, just like a PC is an appliance, or a refrigerator, or a car. They don't know what is involved in maintaining that phone, or the security risks associated with using the phone, nor are they particularly inclined to care; they have more important things to do with their lives, like hold down a job, take care of kids, keep up with politics to be a better informed voter, etc. For these sorts of people, whom I suspect makes up a
Re: (Score:3, Interesting)
There was no sign that he could imagine that somebody might not want to trust Google with total control of their phone,
There's no such thing as trusting them with partial control of your phone because if they can push anything to your phone they can probably root it. So either install your own distribution of Android (perhaps CM) and disable this functionality or accept that others will be helping you manage your phone.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
The line between OS version and app is entirely arbitrary, and Google is working to move more of the OS functionality into apps.
From a security standpoint, if Google has access to this, they have access to the OS anyway, installing/removing apps is not a big deal. They already have root on your device (and you don't.)
Re: (Score:2, Interesting)
my old blackberry had a similar feature; which was often exploited by verizon wireless to push icons for new apps and services to my phone without my permission and there was nothing i could do about it...
Re: (Score:2)
Really Really Really? No. (Score:5, Funny)
My "most modern phone", the N900, is not bound to any carrier, and I am quite certain that my carrier does not have the ability or a clue how to install anything on it. I'm root. Not them.
Apple and Android folks: Enjoy being someone else's bitch.
Was this post obnoxious? Yes, in a very nerdy way.
Re: (Score:2)
Re:Really Really Really? No. (Score:5, Informative)
Seriously, this is a worthwhile point. Maemo (OS on the N900) *IS* Linux, not a fancy face on top of it that takes away your control. The default user is not root, but you can become root. The package manager software is setuid root, but you can fix that if you want to make it impossible to install apps without entering a password.
Re: (Score:2)
Which is just about the same as Android, then. Google releases the Android source so you could patch the install mechanism if you wanted to. I'm root on my Nexus 1 - that is basically just a command away.
The thing is, just because I am root and has access to the source code doesn't mean there aren't backdoors that hasn't been detected yet. I don't see how Maemo is different in that regard. Or say, Ubuntu. There COULD be a hidden backdoor somewhere, cleverly obfuscated for when Mark Shuttleworth wants to tak
Re:Really Really Really? No. (Score:5, Informative)
Well the process would be just as hard on Android but he isn't running Android.
His phone has an officially supported root mode. The root mode isn't killed by updates. It doesn't stop the updates from working. Nor does it prevent you using any applications you could use before like the app store. It doesn't void your warranty. It doesn't require a re-flash.
So no, the process of getting root for you wasn't as easy for you as it was for the GP.
Re: (Score:2)
And I am happy with that.
Re: (Score:2)
Re: (Score:2)
Not so terrible (Score:5, Insightful)
While this could be used to push more carrier crapware, I think updates and upgrades of installed apps are more likely to work for more phones and easier for the average user to use.
In all honesty, would you rather be using an outdated version of a browser with security flaws because your phone doesn't support Android 2.75 Double Chocolate Chunk Cookie or just have your browser update to a more secure version OTA?
Re: (Score:2, Insightful)
There is competition now in the phone market, Google doesn't want to screw up anything because I could go to iOS, BlackBerry OS, WinMobile, Symbian, or heck, I c
Re:Not so terrible (Score:4, Insightful)
As the android user base gets more mainstream, the "vocal" nerds will be drowned out by people who just want cute shit.
This crowd will accept what-ever crapware the carriers want them to have, they always have....and Google won't find it so hard to just give in.
Inevitably, the OTA install function will be abused.
Re: (Score:2)
If worse comes to worse I have little doubt in my mind that Google will keep top-tier phones free from crap similar to the Nexus One and t
Re: (Score:2)
Google has just been noted for its push and pull reach. Something that the open source community seems to view as very DRM, Apple, Sony, MS like.
Apple, Sony, MS may talk about open code and have set views on it, but Google actively uses it for the total OS look and feel.
Thats why this is so interesting. Messing with a users phone in both directions, install and removal is something new.
Google seems to be doing fine in innovating too wit
Re:Not so terrible (Score:5, Insightful)
Yep, because google's not an advertising company, and would never want to, say, install an app that brings you the "great new feature" of automatically pinging their servers with a GPS coordinate and downloading location-relevant ads right to your phone!
Point is - you aren't offered a choice. Point is - you aren't being asked, "is it okay if we do this?" I don't care what the feature is, I'd take severe issue with someone deciding, "here you need this." And let's be honest - updates aren't always flawless... if Google bricks my phone accidentally, will I be able to recover any important data I might have had on there?
Re: (Score:2)
If you aren't making backups, your data is more vulnerable to a toilet than it is to Google. Google's ads are GPS-sensitive... if you decide to give the browser access to your location information. It's actually pretty well done, and hey, it's open-source. If you don't like it, compile a copy yourself without that stuff. Or get someone else to... there are lots of android hackers out there.
Re: (Score:2)
... if you decide to give the browser access to your location information. It's actually pretty well done, and hey, it's open-source. If you don't like it, compile a copy yourself without that stuff...
Which will work great...UNTIL they remotely force your phone to download an identical version with all the stuff you took out back in, without your knowledge or consent, like this "feature" allows them to do at will. Isn't that the point of this whole discussion?
It's to reinstall malware that they removed... (Score:5, Funny)
...when Slashdot raises a stink about them removing it.
"Oops. Sorry. Here's your keylogger back."
Wow. (Score:2)
We saw this at Google IO 2010 (Score:2, Insightful)
Re: (Score:2)
Someone already commented that the Market app likely pushes such commands to your phone.
If true, then I have to ask - do you get any confirmation popups after clicking the install button? (I don't have an Android phone or device, so I wouldn't know)
Re: (Score:2)
What it means is that it there for use. Good or bad don't enter into it, it's a capability.
Once you realize that the capability is there, you can make an informed decision. (Personally, I've decided that I'm not buying an Android either. I've already made this decision about many other platforms, but I had been thinking about getting an android.)
It's coming up to time to decide on a new phone. It looks like I'll be going with the cheapest one again rather than buying a fancy one. But there are still a
Re: (Score:2)
For the most part, I trust Google, T-Mobile, and even Microsoft. I don't question their intentions, or their desire to keep us and the networks as secure as is reasonably possible. But sometimes things go awry, and capabilities for remotely forced installs could of course theoretically be co-opted by someone with more malicious
Isn't Android Open Source? (Score:5, Interesting)
Re:Isn't Android Open Source? (Score:4, Informative)
Re: (Score:2, Insightful)
Pretty much only the kernel is open source and not the other parts.
The Google apps, the main interface API, and anything relating to the market are well locked down.
The Android is not a phone you should get if you want an open source phone. Try the OpenMokos.
Re:Isn't Android Open Source? (Score:4, Informative)
Pretty much only the kernel is open source and not the other parts.
This is incorrect. Most of android is in AOSP, including the kernel, dalvik, UI, launcher, dialer, all the libs etc. You can build a fully working system from the open source components (that's how cyanogenmod is built).
Only the google-specific applications (Maps, gmail, gtalk, google market, facebook, google voice ) are not open source. Many of them can be replaced with alternatives if one wants to release a system without paying to google: e.g. SlideMe market, one of many different e-mail/gps apps, etc.
You can check the AOSP contents here [kernel.org].
verizon does this to my blackberry (Score:4, Interesting)
one day you look at your phone: hey, there's a bing icon
couple of months later: look at that, a skype icon
it's vaguely unsettling, to be reminded of how raped you are in terms of privacy
This is great news (Score:2, Insightful)
Because Android is still less evil and invasive than iOS.
I'm not trying to troll, but really. if you compare the the two platforms one is mostly open and one is glued shut.
Re:This is great news (Score:4, Insightful)
I'm not trying to troll, but really; if you compare the two platforms one is mostly bought and paid for by the handset purchaser, the other is free to the consumer and OEM but is distributed with the intent of selling mobile eyeballs to advertisers. What could possibly go wrong?
Re: (Score:2)
are you trying to establish some causal relationship? because I don't follow.
Thank you for the exploit, sir. (Score:2)
I know of several countries that will be interested in this.
And I'm already halfway through the security around that code.
This is a cakewalk compared to cracking the PS3 hypervisor.
Re: (Score:3, Interesting)
It's not what Google would do with it... (Score:3, Insightful)
It is what a blackhat would be able to do if they were able to find Google's private key.
Re: (Score:2)
Or what they could do with Windows Update if they were able to find Microsoft's private key.
Or with the iPhone if they were able to find Apple's private key.
Or Ubuntu with Canonical's.
And so on.
Umm, updates? (Score:2)
How is this different from automatic updates? Is it initiated by the phone (pull), or by a remote entity (push)? Is it usable by 3rd parties?
My response (Score:4, Funny)
I cast "root device" then "alter /etc/hosts".
No (Score:4, Insightful)
I'm sure someone could create a honeypot wifi network that forces all Android devices that connect to it to install a particular app.
Not unless they manage to compromise SSL in order to make the phone think it's talking to Google when it really isn't. If someone manages to do that, we have much bigger things to worry about than a malicious phone app.
Re:No (Score:4, Interesting)
Such flaws are why professional developers do not put in random features that can be exploited. Sure it might be fun toi say that our application has a thousand more features than the competition, but to those that are savvy it is just a thousand more way to be put at risk.
Re:No (Score:5, Insightful)
Actually, this moves android from "my next phone" to a "definite maybe".
I do NOT like back doors. This makes the SSL Cert that would be used to prove one is google a very valuable target indeed. It really makes me wonder if it is a question of "if" or "when". On top of that, why should I trust google with this? If something needs to be installed, on MY PHONE, I want to be, at least, asked.
-Steve
Re:No (Score:5, Funny)
-Steve
Woz, doesn't Apple give you Iphones anyway?
Re: (Score:3, Informative)
Re:No (Score:4, Interesting)
Re: (Score:2, Interesting)
My suggestion is that you rely on a land line phone then (were I that worried over it I would go with a vintage rotary phone too - no computer to futz with). All cell phones I know of can add or remove features without your permission. Some may choose not to do so, some may regularly do it, but they all do. Even worse an iPhone, Blackberry, or an Android are *not* phones, they are handheld computers that just so happen to have a cellular device attached to them. You LG flip phone that has no apps other than
Re: (Score:3, Insightful)
Actually, this moves android from "my next phone" to a "definite maybe".
I do NOT like back doors.
You always have the option to root your phone and install a third-party build of Android that doesn't have this feature. (Unlike a certain other company, Google doesn't claim that you'd be breaking the law by doing so.)
This makes the SSL Cert that would be used to prove one is google a very valuable target indeed.
As if it isn't already? If you can impersonate Google, you can access everyone's Gmail, AdSense, AdWords, Docs, etc.
Re: (Score:3, Insightful)
Re: (Score:2)
Look, if you don't want people connecting to your wi-fi network hide the SSD and encrypt it securely
Encrypt it with what, WEP? That would help just as much as not broadcasting your ssid (and, for that matter, as much as MAC filtering). Honestly, these three approaches to "security" won't stop anyone who knows how to book a BackTrack liveCD.
Re: (Score:2, Informative)
Re: (Score:2)
Re:Drive-by installing (Score:5, Informative)
You're just flat wrong. WPA isn't compromised in any way even remotely as badly as WEP was/is.
WPA:TKIP can, in certain cases with certain AP's allow one to inject packets into the network. Packets won't come back to the attacker.
Perhaps one can use that as a way to leverage some additional resources to attack a network. Certainly, I wouldn't feel good with someone being able to inject packets - but it's not a game-over exploit like WEP was.
WPA-AES: There's simply no known attack against the cypher. You might be able to brute-force the key - but that's an issue of any shared-secret system - it doesn't have anything to do with the crypto in WPA:AES. The solution is to use a large key-space (all ascii characters, not just uppercase alpha's for example.) and long-ish. 10 chars or more. Bonus points for more random and less guessable secrets.
So, IMO, to claim "...it's not that much more secure than WEP was when it was introduced." is really a massive overstatement due to ignorance, at best or just plain falsehoods at worst.
Re: (Score:2)
Lets face it, chances are your neighbors aren't 1337 h@x0rz who are just looking to get into your router and redirect all requests to Goatse, the guy out in his car just wants fre
Re: (Score:2)
... or $50 to spend 5 minutes clicking "next" buttons.
That's only $50 dollars an hour, you insensitive clod! Here's the breakdown:
5 minutes of clicking next buttons
55 minutes of WoW (or Minesweeper, Tetris, Facebook, Slashdot, what-have-you).
This so obviously merits $50/hour!
Re:Call me clueless (Score:5, Interesting)
GPLv2 to bait you in, Apache 2.0 to close you down if needed.
You write the 'free' apps, hunt bugs, preach about the 'freedoms', Google tracks, sells ads, data mines, a push and profit with a sting in the tail it seems.
Re: (Score:2)