Google Play has been spreading advanced Android malware for years

https://arstechnica.com/information-technology/2020/04/sophisticated-android-backdoors-have-been-populating-google-play-for-years/

by elsewhen • 6 years ago

167 121 6 years ago

arstechnica.com

WrtCdEvrydy2• 6 years ago

Oh yeah, they can spread malware for months, but I submit one fucking app that allows you create signs for your business for COVID-19 and all of a sudden I get a 'Sensitive Events Violation Suspension' and get a ding on my Google Play account.

Google has become Apple except worse because at least Apple is reachable.

realusername5• 6 years ago

Apple is pretty much the same, I've been trying to create a developer account for three entire weeks and it still shows as "pending" without info. I saw on the forums that for some people it can take months. It looks like some bureaucratic government body from the 90s.

I now advise my friends to switch to Android if they want to see the app, there's a limit on what I can put with. These companies should just be broken up in pieces.

armitron• 6 years ago

At least Apple doesn’t serve you malware or harvest your personal data for profit.

techslave• 6 years ago

i learned that you call them and it gets done immediately. submit, wait 24h, call. easy

Karishma1234• 6 years ago

My app got suspended because my self publish ebook reader could be used to search for books one of which had a kid with a nerf gun on its cover.

jimmaswell• 6 years ago

Sad times we live in.

samoa42• 6 years ago

why would anyone need an app to print a text stating their business is closed?

probably someone was just looking for any reason to get rid of this.

WrtCdEvrydy2• 6 years ago

Not closed... it's an app to generate signs from your phone about social distancing and other measures that are the law in some states.

mclightning• 6 years ago

They're not picking on you. You're just easier to identify. Don't take it so personally. That's a very biased view.

cageface• 6 years ago

App stores are a trap. As developers we should be doing everything we can to keep the web alive. Every power you cede to a third party gets abused sooner or later.

innagadadavida• 6 years ago

Does google know which apps were infected and does it plan on letting folks installed know? It’s unfortunate their own project zero didn’t catch this.

notRobot• 6 years ago

The article lists the package names of the infected apps.

AnthonyMouse6• 6 years ago

Let this be another nail in the coffin of the "walled garden" farce.

We learn this lesson again and again. People want someone to trust, but a bureaucracy isn't trustworthy. It has its own agenda and values inconsistent with yours. They take 30% from everybody whether they approve malware or not, and whether they reject legitimate apps or not.

Trust doesn't come from size. If you want someone to vet your apps, it has to be someone whose interests are actually aligned with yours, not just whoever is big enough to force everybody through the tollgate into their store.

Razengan10• 6 years ago

I would still prefer to have to trust just one authority for my platform than a multitude of random developers.

Let this be another nail in the coffin of the "walled garden" farce.

There is no coffin, the walled gardens are not dying, and have long since become the norm, which happened because the people found them to be better than the alternative: getting apps (and manually updating them) from many different sources of varying quality and convenience.

papermachete2• 6 years ago

That's why you have package managers to work with thousands of repos for you.

realusername5• 6 years ago

which happened because the people found them to be better than the alternative

Walled garden only exists because mobile devices make self-install alternatives very difficult or impossible to get on purpose, otherwise they would not be able to compete in any ways.

Case in point, the Mac App Store and the Windows Store are both moderate failures despite a lot of technical & marketing push.

jmiskovic• 6 years ago

You misinterpreted. OP was saying that "Apple has walled garden while Google is open" farce is dying and this another confirmation.

Sadly people in general can't be trusted to make good decisions because of lack of knowledge and preference of short term gratification over long term well-being.

oliwarner• 6 years ago

The authority isn't trustworthy though. They're a direct conduit to malware. That's the point here.

And try not to conflate walled gardens with software repositories. The benefits of the latter are available without the wall. The wall is significant because it stops you making your own trust judgements.

amelius2• 6 years ago

I would still prefer to have to trust just one authority for my platform than a multitude of random developers.

You mean like open source developers?

coribuci2• 6 years ago

I would still prefer to have to trust just one authority for my platform than a multitude of random developers.

Single point of failure.

> Let this be another nail in the coffin of the "walled garden" farce.
There is no coffin, the walled gardens are not dying, and have long since become the norm, which happened because the people found them to be better than the alternative: getting apps (and manually updating them) from many different sources of varying quality and convenience.

No. The people have no alternative. How many people are able to install F-Droid on theyr phone ?

Mindwipe2• 6 years ago

There is no coffin, the walled gardens are not dying, and have long since become the norm, which happened because the people found them to be better than the alternative: getting apps (and manually updating them) from many different sources of varying quality and convenience.

No they haven't. Given a fair choice customers have opted for the alternative the vast majority of the time.

The walled garden models have only worked when companies have engaged in anti-competitive behaviour.

Dragory• 6 years ago

I would still prefer to have to trust just one authority for my platform than a multitude of random developers.

These are not the only two options. What about multiple authorities, but not random individual developers? That's basically how it works with e.g. game stores on PC (though Steam is certainly the largest), or package repositories on Linux.

Like you, I like being able to trust an authority to vet the software I install rather than having to judge the trustworthiness of each individual developer, but I'm not a fan of there only being one authority by design (as it is on e.g. iOS). It introduces a single point of failure and gives that authority full control over all software on that platform - for better or worse. Many package managers specifically deal with the issue of consolidating updates to a single system while not relying on a single authority.

ajconway5• 6 years ago

But security is not binary. They (especially Apple) are doing something to limit the amount of fraudulent apps on their platform.

I would strongly prefer having a free-for-all platform because I have some basic knowledge of information security. Most people don't.

scarface748• 6 years ago

How is your “knowledge” going to help you? Are you capable of vetting every app you install?

gigatexal• 6 years ago

Google play != Apple App Store

virgilp• 6 years ago

Good comment, I was just about to confuse them.

scarface748• 6 years ago

I never here users complain - just developers.

peterwwillis• 6 years ago

Nobody has yet said the words "lock-in device". Everybody moans about lock-in devices when it's convenient for them, but then they throw away the ability to use anything else by committing full-tilt to these mobile platforms where to install "unapproved" apps you have to literally hack your own device.

Apple and Google got rich doing what we would have lambasted Microsoft for, because our judgement is clouded by brands.

_bxg1• 6 years ago

And yet Apple's walled garden is stronger and hasn't had anywhere near the malware problem that Google's has? I don't understand your point.

Privacy is where these companies' interests might not be aligned with users; when it comes to security, they very much are. It's just that for Google that's limited to their own services; they don't care so much when it comes to Android as a broader platform. But even then their interests are not not aligned with users. Just under-incentivized.

UncleMeat2• 6 years ago

This used to be true. But both Google and Apple release badware numbers and independent analysts do as well. Badware rates are similar on both stores and have been for several years. Play used to be considerably worse than the Apple store, but that is no longer the case.

Being late to take security seriously has harmed google though, since this idea is now out there in the wild and keeps getting repeated regardless of the current evidence.

enjoyyourlife• 6 years ago

What about Facebook's API? It is basically at the same level of malware as the apps mentioned in the article

lkrubner• 6 years ago

"a bureaucracy isn't trustworthy"

This kind of rhetoric has been popular in California at least since the 1970s and it has consistently played the same role, which has been to disguise reality. Bureaucracy is expanding because complex societies need complex bureaucracies. This isn't new. You can trace this far back in history. In some sense, the era of bureaucracy began around 3,300 BC when the first Pharaohs wanted to put up the first pyramids and found that they need hundreds of scribes to keep track of all the material, and payments for the material. And bureaucracy has gotten a lot bigger since that time. There are some totally legitimate criticisms that you can make about civilization, especially the way a complex civilization necessarily infringes on some of our basic rights, and the fact that there is a certain kind of inefficiency to bureaucracy. All the same, bureaucracy also has a kind of efficiency to it, especially when organizing things of immense scale. Lazy libertarianism is popular but it is not an accurate guide to the changes happening in our society or our economy.

izacus2• 6 years ago

The wording of the title is interesting - how it puts all the responsibility onto Play store and none of it onto the people actually developing the software.

We truly live in an age where the mass media demands that corporations censor and police everything we see and use.

I wonder when they'll start targeting Linux and Windows for allowing you to download and run malicious programs without any corporation approving them.

panny• 6 years ago

No worries Google fan. arstechnica is a paid Google "news" outlet. In the article, they downplay the damage and reach of the attack. If they titled it "Move along, nothing to see here" their ruse would be too obvious.

izacus2• 6 years ago

If I'd be a Google fan, I wouldn't have problems with them deciding what I'm allowed to download to my phone :(

leppr• 6 years ago

It's not the media, that's the stance Google themselves adopt with Google Play by acting as non-neutral gatekeepers.

Few people lack the intuitive understanding of the difference between free platforms and controlled ones. People don't blame Google Search for linking to Stormfront, but they would blame Facebook for hosting it. People don't blame Linux and Windows for allowing you to install malicious apps, because these allow you to install any apps.

dTal2• 6 years ago

People don't blame Linux and Windows for allowing you to install malicious apps, because these allow you to install any apps.

Ah you've really put your finger on something there. The entire concept of an app store, gatekept through a series of hoops to jump through and from which the company takes n% of profit where n is some shockingly large percentage, is a highly costly departure from the traditional model of "obtain software from third party, install". The justification for this mafia-like intercession between vendor and customer has always been "for your protection". If they don't provide any protection, why do we tolerate this racket at all?

dunnevens• 6 years ago

Google advertises their store has "Google Play Protect" which promises to ensure no malware in the apps you download from them. Of course Google is going to get the blame when they make promises like that.

bzb32• 6 years ago

It doesn't say anywhere that it's infallible. https://support.google.com/android/answer/2812853?hl=en

amelius2• 6 years ago

The wording of the title is interesting - how it puts all the responsibility onto Play store and none of it onto the people actually developing the software.

But this is how app stores advertise their only benefit over traditional sales channels.

dathinab4• 6 years ago

Besides what other comments noted there is the problem that sometimes Google knowingly tolerates software incompatible with their AGBs and through this endangering the privacy of users.

If I remember correctly TickTock was such a case.

KingOfCoders• 6 years ago

Tin foil hat on. We had these iOS zero days and now conveniently we get something about Android security.

wccrawford• 6 years ago

There's no tinfoil hat needed. It's pretty common for people who get their feelings hurt to lash out against "the enemy" with whatever they have. It doesn't matter how old the news is when they can just post it again and people will upvote it like it's new.

And it doesn't even necessarily have anything to do with Apple themselves. They don't need to spearhead this movement because fanatics will defend them like this anyhow.

The same goes for Google fanatics, and every other kind out there.

freehunter• 6 years ago

If you think this is the only news article that has ever talked negatively about Android security, I'd recommend reading the news more often.

xorfish• 6 years ago

Why haven't antitrust lawsuits made it mandatory that you can chose your app store after first use like it happened with browsers?

Leherenn• 6 years ago

There's no monopoly in the phone market like there was with Microsoft.

jedimastert• 6 years ago

I currently have F-Droid installed on my stock phone and Google did nothing to stop me other than a single "unknown app" warning.

Also, that's not how it works with browsers. You have one browser installed. I don't think I've ever seen windows or mac (or any linux distro I've tried) ask which browser should be installed. There's just the default one and the choice to install anything else.

Mindwipe2• 6 years ago

They likely will eventually, but the browser verdict took a long time.

It's also unhelpful that many politicians have realised in retrospect that they quite like having single choke points that can be used to enact legislative control over the public.

javajosh• 6 years ago

It's emotionally difficult to find out about flaws in something you trust. I think humans really like black and white thinking, and crave association with people and institutions with blemish-free reputations. But the truth is that nothing and no-one is blemish free, especially if you zoom in on them enough. If you let it, then this truth can make you feel like you can't trust anything or anyone.

But its not true. You can trust. Although blemishes are universal, the scale of the blemishes are not. The key to trusting again in a world of flaws and faults is perspective. Is the flaw large or small? Does the agent accept it and want to fix it, or do they deny it exists (a much worse problem!)?

Everything has flaws, everyone makes mistakes, often people behave badly. That is never going to change. The thing we have to judge is whether the self-corrective systems in place are doing their jobs to acknowledge and repair the damage. IOW, making a mistake shouldn't determine trust, but failing to address the mistake should. One might call it "second-order trust". If you accept that, then the missing piece of this story is Google's response -- although they removed the offending malware from the Play Store, the journalist didn't apparently contact Google for anything else, like what steps they are taking (if any) to prevent this sort of thing from happening again. Ars didn't say anything about contacting Google, so I'd say that is an indication of lazy journalism, itself a sad but endemic problem in a world where we all have another false belief, that useful screens should be free (as in beer).

Google Play has been spreading advanced Android malware for years

Related Stories