'Godless' Apps, Some Found In Google Play, Root 90% Of Android Phones (arstechnica.com) 87
Dan Goodin, reporting for ArsTechnica:Researchers have detected a family of malicious apps, some that were available in Google Play, that contain malicious code capable of secretly rooting an estimated 90 percent of all Android phones. In a recently published blog post, antivirus provider Trend Micro said that Godless, as the malware family has been dubbed, contains a collection of rooting exploits that works against virtually any device running Android 5.1 or earlier. That accounts for an estimated 90 percent of all Android devices. Members of the family have been found in a variety of app stores, including Google Play, and have been installed on more than 850,000 devices worldwide. Godless has struck hardest at users in India, Indonesia, and Thailand, but so far less than 2 percent of those infected are in the US. Once an app with the malicious code is installed, it has the ability to pull from a vast repository of exploits to root the particular device it's running on. In that respect, the app functions something like the many available exploit kits that cause hacked websites to identify specific vulnerabilities in individual visitors' browsers and serve drive-by exploits.Affected apps that have been spotted in Google Play, Android's marquee app store, are largely flashlight, Wi-Fi apps, as well as copies of popular games.
So does Google actually scan the store or what? (Score:1)
Every time I hear the "virus available from Google Play" I think "boy, if they could find this, wouldn't Google?"
Re:So does Google actually scan the store or what? (Score:5, Informative)
I think this falls under the "victim of their own success" category.
The thing is, once you install an app, that's it, it can then do whatever it wants within the limitations that Google has defined. One of those things is "access the Internet" which means that the app, once installed, can then go out to the web and grab whatever it needs to exploit your device.
I am sure that there are thousands of legit apps that have the same exact "signature" as these malware apps. As in, they do normal stuff like access the Internet, turn on your camera's LED, etc.
If you start blocking apps that access particular URLs, that's all well and good, but what if the malicious party creates an ad that is only malicious when used in conjunction with their app? Will Google block apps that access the ad networks? Nope.
The real fix is to get these devices updated so that they are no longer vulnerable to root kits.
Re: (Score:3, Informative)
Re: (Score:3)
My HTC Evo 4g
That gives me nightmares, that was my first smartphone. I've upgraded twice since then, you should really consider it. When I booted that up to wipe it back to defaults it felt like I had discovered some relic of a bygone era.
Re: (Score:1)
You don't have to wait for Google, because Cyanogen will have you covered too http://www.cyanogenmod.org/ [cyanogenmod.org]
Oh yes, protect against 3rd party exploits by installing a third party OS. Sounds like a GREAT solution!
Re: (Score:3)
Oh yes, protect against 3rd party exploits by installing a third party OS. Sounds like a GREAT solution!
It used to work very well.
I did it when I installed OS/2 on the nineties, and now when I install OpenSUSE.
Re: (Score:1)
Re: (Score:1)
The real fix is to get these devices updated so that they are no longer vulnerable to root kits.
How does that work for a five year old Nexus?
The fix for such an old device is to stop being a cheap-ass and buy a new phone.
E-waste much? (Score:3)
stop being a cheap-ass and buy a new phone.
And put the old phone to what use? Adding to the growing e-waste problem?
Re:E-waste much? (Score:4, Interesting)
Re: (Score:1)
s/admittedly//
Re: (Score:1)
Same here. I have an old HTC One V and an LG Optimus F6 that I paid less than $50 each for. I didn't want to deal with the hassle of selling online for notmuch or finding someplace to drop them off to recycle them, so I re-purposed them as security cameras. They're connected to a WLAN with no internet access and stream to a raspberry pi 1 model b which runs Motion [lavrsen.dk] and does some minor processing and stores them on a rotating basis.
I also use the linked IP Webcam app on the phones--it's the least buggy Androi
Re: E-waste much? (Score:1)
Just like AOL disks: coasters.
Re: (Score:3)
I didn't mean to imply that the onus is on the user to update their device.
I am saying that Google and the carriers need to find some way to get along and keep these devices updated.
At the end of life, when Google no longer wants to support these devices, I think it would be appropriate to block access to the Play Store for those devices.
Re: (Score:1)
I think it would be appropriate to block access to the Play Store for those devices.
I see... So you want to make life even worse... On the other hand, apps that spoof your ID will have a big market.
Re: (Score:2)
No, if you carefully read my statement you will see that I used the word "wants". This is key. If Google WANTS to cut off a revenue stream they can do so.
However, there is another alternative that is good for them AND for users: Fix the bugs and make them available to older devices that they want to continue to make money off of.
It doesn't do Google or users any kind of good to allow their older devices to be abandoned malware platforms.
Re: (Score:1)
Well, that's the problem, isn't it? They don't make money on older devices, so where's the incentive to support them? It only cuts into sales of new devices. But I would hope users don't tolerate blocking and can/will circumvent any attempts to do so.
Re: (Score:2)
The real issue is that apps shouldn't be able to install code without prompting the user. Android should force a window that says something like "app is trying to install this: accept or deny?"
Re: (Score:2)
Yeah but it is going to say it's installing a root kit or is it going to say something else?
Description: Update, Bugfix - Fixes problem in {insert application} that causes application crashes and high cpu utilization.
Would you like to allow this? accept or deny
Re: (Score:2)
it would be something like the OSX dialog that asks for your admin password or maybe something like windows UAC does. The dialog should be entirely up to the OS and the app can't control it or put up descriptions on it.
It should be just a warning that the app wants to modify the system and that it could be dangerous. Maybe a reminder that it isn't an app update at all
Re: (Score:2)
That's the point the app store is essentially a trusted source at least as far as the average user is concerned and an application disguising something as an update to that application would still be appear to be an update.
If I open an application on any operating system and it says would you like to check for an update and then what ever operating system prompt comes up when I attempt to install said update it still looks like an update.
Re: (Score:3)
Victim of their own success? Or a predictable outcome of the security model?
The android security model is what I call "blame the user". Although things have shifted slightly, the original intent was pretty simple: an application could only do things that it was pre-approved to do. This was handled by having declarations and the user would have to agree to those declarations. There are several problems with this model.
1. Users are not generally equipped to properly discriminate and thus are not able to make
Re: (Score:1)
Every time I hear the "virus available from Google Play" I think "boy, if they could find this, wouldn't Google?"
Go Android Security!!!
Re: (Score:2)
Go Stand In Line At The Apple Store!!
Never have; never will.
But I'd rather stand in line at the Apple Store for a few hours than spend two days reentering new CC information and changing passwords in everything, everywhere because my identity was compromised through malware on my smartphone...
Oh, and in case you haven't noticed, changing your name, birthdate and SSN isn't exactly an option for most people not working as "assets" for the CIA...
Re: (Score:2)
So does Google actually scan the store or what?
Due to the Halting Problem [wikipedia.org], reliable automated detection of malware is theoretically impossible. This doesn't mean antivirus software is useless, but it is simply inevitable that it will miss stuff. Human security experts will always need to be involved, but humans are expensive, slow, and make more mistakes compared to machines - so it's inevitable that we'll miss stuff, too.
The best long-term route to increasing computer security for society seems to be limiting the capabilities of a program's execution e
Re:Par for the course with Android (Score:5, Interesting)
I'm not an Apple fanboi or anything, but I'm pretty sure that there are not a bevy of apps in the App Store that can contain malware which can root 90% of iPhones.
Say what you will about the virtues of Android and iOS, that's just silly.
Re: Par for the course with Android (Score:5, Insightful)
Actually the thing with iOS is that it's virtually impossible for anybody but Apple to mass audit apps for malware. There are without a doubt malware apps on Apple's app store, but nobody has found them yet. In fact, in at least a few cases, some malware apps on iOS were only discovered after somebody found it on the Android version and decided to check the iOS version on a hunch.
Re: (Score:2)
It's easy to say malware is there (in the absence of any evidence of widespread malware) by saying it just hasn't been found yet.
Not a terrible position, sir.
Re: (Score:1)
He did say malware apps were discovered on iOS. No citation or anything, but you could at least respond to what he was saying.
Re: (Score:2)
It's easy to say malware is there (in the absence of any evidence of widespread malware)
Actually, there is:
https://nakedsecurity.sophos.c... [sophos.com]
Re: (Score:2)
but I'm pretty sure that there are not a bevy of apps in the App Store that can contain malware which can root 90% of iPhones.
Of course, the response to that is: Not that you know of.
If we have learned anything, it should be:
- Systems are not inherently secure
- Companies are profit driven (they care about you only so much as it affects their bottom line)
- Software is complex
- People make mistakes
This creates an environment where nobody is above reproach. No system can ever be thought of as bulletproof.
Depends on who other than the owner has root (Score:2)
And since when is root "malware"?
Since intruders started using it to give root access to someone other than the phone's owner, such as someone using information stored on the phone for financial crimes.
Re: (Score:2)
FTFY.
Nine things that iDon't (Score:2)
An iPhone may be right for those people who are not interested and will not become interested in any of the following types of applications, which Apple expressly prohibits in the App Store [apple.com]:
Re: (Score:2)
Satire of an identifiable person or organization (real entity rule)
Unless that person is Donald Trump [apple.com], apparently.
Re: (Score:2)
But of course! Trump doesn't count as a real person to anyone on the left, he's subhuman. See, they use the exact same tactics that real, actual racists and bigots use to discredit people they hate, but since he's white and a male it's all A-OK! I used to support Apple, but lately I'm finding out that there isn't a single organization left that I can give my money to and still be able to sleep at night.
By the way, love the signature. I get that feeling often.
Re: (Score:1)
By the way, love the signature. I get that feeling often.
I am about as conservative as they come, but since I also try to apply Christian principles to my thinking, I get accused of being a liberal on occasion. One of the most amusing was when I criticized the repulsive treatment Rush Limbaugh gave Sandra Fluke. Don't get me wrong. I think she's an idiot, but Limbaugh was sickening about it. I guess holding all people to the same standard isn't common among people any kind of politics.
But more often, I
Re: (Score:2)
Re: (Score:2)
Apps for learning to program that allow sharing your work with other users (execute code rule)
Not sure if all of these qualify [infoworld.com]; but at least some of them do. And this list is somewhat old. And a Search of the iOS App Store came up with an impressive list of Programming utilities and IDEs for a wide variety of languages. So, I'm not sure what the problem is.
Launcher replacements for persons with disabilities
I guess Cromulent Labs' "Launcher" [cromulentlabs.com] must be misnamed, then.
WLAN utilities, such as utilities for troubleshooting your wireless network or for contributing to a collaborative map of wireless networks (Apple deems AP enumeration in iOS to be private)
Really, I have a few on my iPhone and iPad. My favorite is "Fing" [apple.com].
Web browsers that implement HTML features that Apple has left out of Safari (WebKit rule)
Not sure what the big deal is: Mobile Safari seems to "Check the Boxes" [mobilehtml5.org] as well as almost any other browser. And it looks
Re: (Score:2)
And a Search of the iOS App Store came up with an impressive list of Programming utilities and IDEs for a wide variety of languages.
Before I spend hundreds on an iPad, keyboard, and app licenses with which to review the functionality of said "impressive list", how can the user import a project into one of these IDEs? Some reviews in the slideshow you linked mention exporting but not importing. Must all projects originate on the device? Or does the editor run locally and the testing run remotely, such as through SSH, X11, VNC, or RDP? If so, my use thereof would require an expensive mobile broadband subscription because city buses don't
Re: (Score:2)
And for a while I thought this would actually be informative rather than the usual breathless content-free fare.
You must be new here.
potential 'capability' is not actual installation (Score:2)
these malware "contain malicious code capable secretly rooting an estimated 90 percent of all Android phones"
well there are malware/viruses/etc that are "capable" of doing damage to lot more percentage of variety of computing devices running variety of software.
but they need to get installed/infected/whatever.
but these seems not be all that successful, in that crucial step, even with apps in google store
so don't get too excited.
public warnings are ok, and beneficial . but screaming is too much.
Re: (Score:2)
public warnings are ok, and beneficial . but screaming is too much.
I didn't see/hear any "screaming"; but I would say, if there were malware in the iOS App Store that could root 90% of iPhones in use, I'd want Slashdot to be right on it!
Re:Awesome! (Score:5, Insightful)
I see. Verizon and Samsung won't let me root my phone, but Russian and Chinese hackers can. Thanks Verizon and Samsung.
Came here to say just this. "Rooting" your phone should be a setting in a menu somewhere saying "Allow me to access my own device"; it shouldn't require searching the internet for the least-sketchy app to flip a bit somewhere.
Re:Awesome! (Score:4, Insightful)
I'd also add that I'd be fine with this being turned off by default (i.e. your device isn't rooted by default). Most people won't need root access for what they use their phones/tablets for. But if I want to root my phone/tablet, I can turn this on (perhaps click OK on a "this can wreck havoc with your device if you don't know what you're doing" warning) and then have root access.
Want to make it a little less likely that someone would turn on root by mistake? Do what they did with USB debugging. To turn this on, you need to go to Settings, About Phone, and tap the Build number 7 times just to get the option to display. Make it so "Enable Root Access" doesn't display unless you tap some other section like this. It would prevent casual users from accidentally getting root access while making it much easier for the rest of us to do this.
Re: (Score:2)
Godless? (Score:5, Funny)
Re: (Score:2)
+1 Insightful
That was pretty witty.
Re: (Score:2)
Wish I had mod points - my hat's off to you sir!
Re: (Score:2)
Came here thinking exactly this. I need an app like this for my phone. Think we can get these guys to update their package for the lastest versions? I could use an easy root.
Google never adopted a security first principle (Score:1)
1) The security model is broken by design.
Android barely restricted apps from taking over your entire phone with an agree box until only fairly recently with Marshmallow.
2) The updating model is broken by design
Carriers don't care if your phone OS is out of date. Manufacturers don't care if your phone OS is out of date.
Bottom line constraint from the supply side - They both want to sell you a new phone or contract.
Bottom line constraint from the developer side - No major punitive incentives from Google to f
Godless is actually a family of malware (Score:2)
Some variants are just the bare bones needed to install a payload which then waits for remote C&C instructions. [smartphonevirus.com]
Which apps contain this malware (Score:2)
I really hate it when articles go on and on about how certain malware was found in unspecified apps on the play store. I assume that Google took them down as soon as they were notified. But let's name the apps and the publishers, please. What specific apps contained this malware?
Re: (Score:2)
Interestingly the summary also makes no mention whatsoever of any malware, only a tool that roots your device. That would be a good thing, not a bad thing.
Now obviously they're implying that the app also does something evil once it has root, but they rely should say so.
The way this is written is as if to imply that having any control over the hardware that you own is a horrible thing.
Godless (Score:2)
We're all in deep shit unless we get right with God.
https://youtu.be/i_9aTfGgF0c [youtu.be]
Flashlight app? (Score:2)
Re: (Score:2)
Well, lucky for me... (Score:2)
... I haven't been able to access the Google Play store since the Android update I got back in April 2015.
List of apps... (Score:2)
We would list the apps affected, but then we couldn't get into your phone anymore.
Dangit! I wish it was that easy ... (Score:2)
to root my Android 6.0 phone. I should never have upgraded. I really miss my old rooted phoned.
Hold on... (Score:2)
Godless malware roots Android .. (Score:1)
AT&T, Samsung Note, OS update (Score:2)
That probably explains why AT&T pushed out an update to 6.0.1 this week. They are usually a few versions behind, so this seemed like a pretty quick update...