Preinstalled Malware Targeting Mobile Users | Hacker News Reader

Preinstalled Malware Targeting Mobile Users

blog.checkpoint.com

If you care at all about security, use an iPhone. Make sure the latest version of iOS is installed. Set up a difficult passcode.

Android security is a joke. Seriously. Don't use an Android phone.

Android security is indeed a joke. That doesn't make me eager to use a different device with a bunch of closed-source software. We really need better choices.

Why don't you enlighten us? Better yet, how about you show us by compromising an up to date Google device?

http://core0.staticworld.net/images/article/2015/05/android_...

There's a picture of their crappy security in practice. It needs much better and more granular controls for me to consider it secure.

Android's network security model is atrocious, with full network access being in the "other" category that all apps get. You don't need to have root on a phone to go rogue and attack/analyze other devices, if the phone already gives your "no permissions" app full access.

The can only be one logical reason for this: to Google AdSense is more important than your privacy.

I can't take things like project zero seriously when the same company works hard to weaken Android privacy.

So you have an issue with Android's permission model? Fair point, it could be more granular. Are permissions more granular on iOS? Because I'd like to block access to the Internet for some apps that display ads. I'm guessing probably not.

Is there a permissions model on Linux, Mac, or Windows? This issue seems kind of unimportant. If a hacker can compromise the device, they can disregard all permissions.

Yes, but isn’t that the problem with Android security updates? OEMs need to (and fail to) deliver closed-source binary blobs to end users. If open source is the real goal, then we* need to be demanding much more openness from OEMs.

* Not me strictly-speaking, because I’m an iOS user for the reasons specified by GP, among others.

Security updates, shovelware / crapware preloads, Google, and a slew of other stuff.

I'm exceedingly disappointed with all current mobile offerings. Holding out distant hope for Ubuntu.

> Holding out distant hope for Ubuntu.

me too! I've recently got one and am eager to get it going. But as it stands now, it's not an alternative.

Yes at the cost of not allowing you do to many things.

In that sense, a prison is safer than being outside, too. Should I live in a prison instead then?

I am not trying to bash iOS here, but it is very clear that security in iOS comes at the cost of freedom and not being able to do a lot of things. For example, you can only install apps through the App Store. You cannot mount USB drives and so on.

Security is always a tradeoff.

>In that sense, a prison is safer than being outside, too. Should I live in a prison instead then?

I mean... I see Android as akin to the situation in The Walking Dead that led to them living in a literal prison, so yes. I've always avoided Mac when possible, but in the mobile space I'd rather use those devices less, and less freely, but more securely. I'll explore my options on my desktop or laptop.

One person's prison is another person's comfortable home. Many people do not perceive iOS as a prison, and would take issue with your choice of words to describe it as such. If you feel that it is, then of course there are alternatives available. You just also know what you're giving up and the risks you're taking.

(and, of course, Android is not so nice either without the magic non-Free bits from Google...)

iPhones are an absolute joke. I am not paying 100s of dollars for the privilege of developing software for my own hardware.

That is not necessary since a while ago (Xcode 7).

Where's the Windows or Linux version of Xcode 7, then? Or a version of OSX licensed to run on the capable hardware that I already own? I suppose I could spend $500 on a Mac Mini, but then we're back to tokenizerrr's question.

Oh? Where do I find the docs and the download link? It has to run on Linux laptop or my Windows desktop, both which have perfectly capable hardware. I am not buying a Mac for the privilege of developing software for an iPhone.

> Where do I find the docs and the download link?

On the Apple developer website, when you make a free dev account.

And yes, it is mac only. But they are a mac company.

I'd gladly run the free developer copy of mac os on my perfectly capable hardware if that is what they desire I use. Something like https://developer.microsoft.com/en-us/microsoft-edge/tools/v...

A Hackintosh is perfectly viable. Assuming you can boot the installer(free from the Mac App Store), it's trivial to set up the necessary bootloader and extensions(certainly easier that making Windows dual boot nicely).

This is legal?

> Android security is a joke. Seriously. Don't use an Android phone.

Can confirm it sucks. Android Security Patch Level on my phone is 2016-01-01. Funny cause on my old different manufacturer phone before this one I had a more recent security patch. I am pretty sure some nasty stuff came out between now and then.

Can't tell if Android is the issue, the phone manufacturer or both.

Does iPhone has a firewall? Or does one have to trust Apple and app developers that they won't collect a single byte of "anonymous" "analytics"?

No, there is no built-in firewall for outgoing connections on iOS, and I don't know of a way to install one without using an external device like a router with a filtering proxy.

The OS limits an app's access to data that belongs to that app, so an app can't gather information you do not give it access too. (e.g. you have to give explicit permission for it to access photos or GPS location). But you do not have any control over other analytics the app may gather and upload, e.g. frequency of app use or info you enter.

Now what? Will there be more action than a blog post? This is a major criminal operation. If this has been found on multiple phones, tracing back the supply chain should reveal the common insertion point. That's a routine law enforcement job. The FBI has a "Cyber Division", and once in a while they catch somebody.

"To protect themselves from regular and pre-installed malware, users should implement advanced security measures capable of identifying and blocking any abnormality in the device’s behavior.". Aside from reflashing the device before first use, and I suppose on a reasonably regular basis, are there any other suggestions for implementing this suggestion?

"Why yes! The authors just happen to work at a company that provides excellent products that do just that!"

Not saying this isn't an important finding, but that part was a bit self-serving.

Well, let's say they provide products. Let's not say they provide 'excellent products'. After all, Check Point is one of those companies that suggests to do SSL MITM 'to provide security'. They sniff your SNI to make sure you don't look at XKCD. They randomly cut your connection if you try to download the SHAttered pdf's over http. They are what makes corporate life tiring.

Indifference is my mobile protective strategy. Anything I have that's worth anything is located elsewhere and encrypted, so I have the luxury of not caring.

Edit: I guess I never fully drank the mobile kool aid anyway... It's been what 10 years, the gee-whiz-bang effect has worn off, and they're revealed to be little more than a leash/tracking device for humans, with a small shitty interface on which you can't use more than 1 or 2 digits (fingers, son). So that's the foundation of indifference the above indifference comes from.

tl;dr: Don't by used Android phones from third party resellers.

Every one of these was bought used from a third party that installed malware prior to reselling. If you buy a new phone from a manufacturer, major retailer, or major carrier, this doesn't apply to you. If you buy a used phone from a trustworthy friend or family member and reset it for use, you're probably cool. If you buy a used phone from someone you don't know/trust online or off, flash it back to factory condition before you use it.

Your handwavy fix is almost completely unrelated to the research. These were large companies. They generally always buy phones through third parties. And when work gives you a phone how will you figure out who touched it?

Rather than giving people a lengthy and arbitrary list of purchase caveats, why not ask why it's so difficult to secure an android phone through the supply chain? And what, if anything, are other phone manufacturers doing that might be making the problem much more secure?

Android phones can have adware preinstalled, especially the cheap ones from chinese noname brands.

"The malicious apps weren't part of the official ROM firmware supplied by the phone manufacturers but were added later somewhere along the supply chain."

I'm not sure how they consider that 'pre-installed'.

They were installed before they opened the box. I think that counts.

The article makes no mention of the phones being received in the original boxes, or in any boxes at all.

A more appropriate headline might be 'wholesalers install malware on phones before sale'.

That's exactly what "preinstalled" means.

> That's exactly what "preinstalled" means.

Eh, "preinstalled" isn't specific enough. I interpreted it similarly to some of the other folks in the thread, that it meant installed by my mfgs. But whether "preinstalled" is that specific or not is mostly a moot point, since it's apparent that the wording of the title isn't sufficiently precise.

Christ, the pedantry is reaching unprecedented levels.

The wording of the title is just fine. This is just a case of someone trying to show how smart they are by nitpicking on insignificant details and feigning non-comprehension.

In doing so, the discussion is no longer on the substance of the article, but rather on insignificant semantics.

I originally took it to imply "manufacturer-preinstalled". Skimming the article clarified the meaning.

No they weren't. Do you really think a Nexus 5 or Nexus 5X would contain those malware apps? The Nexus 5 isn't even being manufactured anymore. In fact, half of those phones aren't even made anymore.

This presents a completely new kind of threat. I wonder how the industry would respond to this. When you do a fresh install, perform some kind of checksumming to verify the integrity of the OS with all its installed software. This cannot possibly be implemented by Google because each manufacturer has its own bloatware that it needs to pre-install. I wonder if Samsung and LG will wake up to this and create a security module?

Or... have users reflash the devices before first use?

This sounds like a great solution for the 99% of mobile phone users who don't even know what NVRAM means.

It's not news that the indifferent, the ignorant, and the uninformed are screwed, or that some things are difficult to solve without individual knowledge and action.

Actually, the signature checks would have to be done by an external hardware component, or maybe through something like ARM TrustZone. Otherwise, the attacker could disable or manipulate the checks when installing the malware.

So it's up to the phone manufacturers to implement; Google would never be able to implement this in a truly secure fashion, even if they knew all the software installed on the phone a priori.

On a related note, I know that Cisco wants something like this for their hardware, but at runtime instead of just on-boot.

If the ROM isn't signed by the manufacturer, or is unlocked and modified, display a warning on each boot. Chrome book does this, as does my moto x.

You can change whatever you like, but if it's not stock there's a clear warning. I'm fine with that.

My question then becomes: where is the manufacturer's certificate stored on the phone/laptop? Because if it isn't stored in a secure manner, an attacker could still modify the ROM and replace the certificate, and you would be none the wiser ;)

In literal ROM, as in read-only burn once memory.

You are aware that e.g. Android ROM is flashable? So it's not a ROM in the literal sense -- probably EEPROM or something. I'd imagine an actual ROM (non-erasable) would only contain the bootloader and/or BIOS. So the manfacturer could sign those and check them, but everything afterwards would be modifiable.

Let's assume that the manufacturer places its cert in ROM so nobody can change it. Great! We are totally secure! Actually, not at all. Where does the signature check take place? In software? Then an attacker could man-in-the-middle and feed the signature check function with a malicious cert. Even if this was not a problem somehow, how would the manufacturer handle key revocation? The cert is burned in, so if their key is compromised, every single device out there is broken.

In summary, unless every single step of the signature check is performed in an isolated environment (e.g., TPM), an attacker will always be able to circumvent the process. Solid crypto is not enough; you need to also ensure that the crypto implementation is tamper-resistant!

>You are aware that e.g. Android ROM is flashable?

Yes, I was poking fun at the name :)

Apparently moto messages can be deleted http://www.droidviews.com/remove-unlocked-bootloader-warning... so it's not handled in read only memory.

Chromebooks do this properly, though. See http://dhanus.mit.edu/docs/ChromeOSSecurity.pdf. Section 3.1.1 talks about the specifics, root keys, etc.

> Yes, I was poking fun at the name :)

You got me haha :P

> Chromebooks do this properly, though. See http://dhanus.mit.edu/docs/ChromeOSSecurity.pdf. Section 3.1.1 talks about the specifics, root keys, etc.

Looks interesting, I'll check it out.

Only problem with chromebooks is that the default action is to wipe the system instead of booting. You have to press ctrl d to boot, which the UI does not tell you about.

This is clearly just an ad post. Can we stop allowing this stuff on HN? This is like Burger King posting an article "Hunger affecting 100% of living people up to several times a day has only one solution."

From my perspective there's been a drastic rise in these kinds of ad posts appearing on the HN front page lately. I dunno if it's vote manipulation via paid viral marketing or something else but it sucks.

The HN guidelines say that you should just flag the post and avoid comments like this:

"Please don't submit comments complaining that a submission is inappropriate for the site"

Dude come on. Don't quote the guidelines at people unless they're new users who might not actually be aware.

I think it's pretty clear from my comment why I'm saying something; it's not just about this one article, there's been a rise in these obvious ads on the site in general (from my point of view), and I feel something needs to be done about it. I've obviously flagged every one of them but that's not enough.

The point of me making a comment about it is to see if other people feel the same way. If you don't agree, you can reply and say "I don't agree, I think these ads are good / I don't see many of them / whatever."

Replying and quoting the guidelines like that is trying to just shut down the discussion and/or just being pedantic.

If you look at the list of phones you'll quickly notice that 1/2 of the phones aren't even manufactured anymore. There is even a Nexus 5 in that list. What does this tell us? These 2 companies purchased these phones from a re-seller that clearly modified the phones by installing malware on them.

If you care about security, use iPhone or Google Android phone (pixel). They're not bullet proof, but they're 5x more secure by virtue of being able to react to issues like this immediately. Third party integrations like rest of Android phones are messy by design security wise.

So, it's an ad for their product/services/whatever. I'd be a lot more interested in a discussion of practical things that phone owners can do to detect malware, avoid infection, etc on their own.

If I were a spy, I'd certainly make my "malware" look like a common adnet or ransomware app.

Surprised this possibility wasn't discussed in the article.

Tell you what else is plaguing mobile users: the staunchly non-responsive design of the linked article's page. Is it a mobile article aimed at desktop users?

Reply on news.ycombinator.com