Hacker News Reader

Comment by ohazi | Hacker News Reader

The Android ecosystem today is like Windows circa 1998-2002, even with the Play store. It's now fairly reasonable to assume that every app has a high likelihood of containing malware.

The safest bet is to avoid installing any software, especially random little games and utilities. You probably don't need them, and they're definitely not worth the risk.

View on HN

You're probably right many apps are not worth the risk, but I use quite of few single-purposes apps, my phone would be semi-useless brick without them and I can buy old school Nokia for just calls and SMS.

Heart rate (from optical sensor), free topo maps for outdoor, various transport apps (checking when buses/trams will go realistically based on their GPS), car navigation, watching BBC news, translate, use a freakin' calculator, browse phone file system, control my A/V receiver over wifi. And so on and on.

For every app removed I would lose an useful functionality that helps me quite often, for some there ain't any good replacement.

I think smarter is to not any sensitive data in the phone, consider it hacked out of factory and act accordingly.

Try Lineage on a phone with F-Droid as your app repo: much more trustable - though not completely, plenty of blobs floating around, the modem OS, and is safe to assume there are non-public bugs out there. Also, none of the crappy preinstalled apps, no google spyware, no touchwizz madness - just a clean, vannila Andoid experience, just as the original developers intended.

I have gotten Lineage going on a couple of older phones for friends, I am skeptical that it and F-droid are inherently much more safe than stock + the Play Store - except that they're less tempting targets for exploitation. Which I suppose is worth something, still.

The Android ecosystem is actually in an even worse situation because most people aren't even able to apply security patches on their devices, even if they are technically inclined to do so.

Maybe they should borrow a page from the certificate industry and have an EV level of code signing certificate. I wouldn't mind being warned if an app I was installing wasn't EV signed, especially for something like a banking app.

The mechanism of this malware wouldn't have been affected by such a change.

An EV cert requirement would make it far more difficult for the malware author to remain anonymous, wouldn't it? The hack may have still happened, but the author could be identified for law enforcement.

I mean that the apps didn't pretend to be banking apps. If you don't mind being warned that non-banking apps don't have EV certs, you wouldn't have minded being warned about these apps and have just installed them.

The more I think about it, the more certain I am that I would like to never install a non-EV cert based app.

There is no difference with the iTunes App Store, which has had more malware infections than the Google Play Store by far. https://researchcenter.paloaltonetworks.com/2015/09/malware-...

Your source doesn't really support your claim.

My source shows hundreds of millions of infected users by one malware instance alone compared to a few thousand per instance on the Play Store. It's hard to miss that the source said this — it's in the headline. This is why Tim Cook shut up about toxic hellstews of vulnerabilities shortly after XCodeGhost came to light.

This article's particular malware requires the user to enable accessibility services for the app, which shows a scary warning and requires the user to manually go into settings (can't be done in a single click). XCodeGhost affected every single user who ran the apps.

Actually, your source supports the premise that iOS is more secure than Android when it comes to their respective app stores. Apple is so restrictive that it's necessary to plant malware on developer machines (the developers submitting apps aren't even aware of the malware), whereas Play will pretty much let you submit anything (where developers are typically a party to the malware).

Nonsense. Nothing in that article says that developers can't implant the malware themselves. Apple would be just as powerless to find it. This article just gives one more source of malware that is unique to Apple caused by the slow speed of obtaining its developer tools.

Worse, Apple left the malware on users devices and didn't remove hundreds more affected apps from the store until third parties reported them, showing that they were incapable of even simple static analysis of the app binaries. Meanwhile, Amazon and Google had been doing automated static and dynamic analysis of apps uploaded to their stores for years.

Reply on news.ycombinator.com