Android Spyware Can Record Almost Anything on Infected Devices | Hacker News Reader

Android Spyware Can Record Almost Anything on Infected Devices

hackwarenews.com

35 pointshackwarenews12 comments

The phones we carry around freak me out a lot when I think about what they can do. In many ways they really are a worst case scenario when it comes to privacy. I once heard someone use the term "Little Brother" to describe our smartphones and their respective corporate owners.

So yeah, this malware can record almost anything. That's sort of a feature of these devices. They're built to record almost anything.

edit: I fixed a typo

Why is there no open source alternative to Android or iOS?

Android is open source?? You can compile it however you want and dont even have to use Google services.

By that logic so is ChromeOS. Point being, Android without any closed-source/google components is rather useless.

Android is perfectly usable without the Google services. It may not be as polished and of course apps that depend on Google services may not play nice with the drop in replacement but its not like your smart phone suddenly becomes a dumb phone.

While that's true, you are losing one of the most critical components of Android. Not the Play Store but Firebase Cloud Messaging. It's not part of AOSP and so deeply integrated into Android that removing it cripples a lot of apps. Replicating FCM's functionality inside apps leads to a significant increase in battery drain.

Take a look at microg. I use it, it supports FCM. Ok so I'm still using Google to some extent, but the amount of information they get out me is vastly reduced and similar to Apple.

> Replicating FCM's functionality inside apps leads to a significant increase in battery drain.

Are there any tests that can be referenced on this subject?

I've heard a completely different story from people that run Conversations (XMPP client) without FCM. They claim the battery drain is minimal. (it may depend on the messanger usage)

There is, it's called AOSP

On Windows, I can use ProcessExploror + TotalVirus to check every single running app's exe, dll Signatures against 60+ virus scanner's databases.

https://www.youtube.com/watch?v=RnPtuTbqzd4

It is not perfect but give me a lot of comfort about all the running app, .dll files in my system. It helped me easily detect my kid's game machines of some internet drive by download issues before and work very well to remove those apps/files.

I really wish Google can create something similar for Android. Love to see something similar for iOS, OSX also.

Is it odd to others that after decades of Windows security nightmares we seem to have basically replicated the issue on an entirely new platform?

I get that it's a fundamentally hard problem. But I can't shake this feeling that we maybe missed an opportunity to do better with the fresh start that mobile OSes represent.

The scary thing about this is that, while you may have a good "security hygiene" around your devices, you have no control over others who you socialize with.

It's a bit like ending on Facebook even though you have no account: someone posted a picture of you, you got tagged, and now you exist in FB.

All it takes is one person with an infected phone to show up around a table of a private event/conversation and, through no fault of your own, you get recorded.

The moral of the story (that I've been trying to follow for a few years now, quite unsuccessfully I must add), is that if you want a private conversation with someone (or a group of people), you need to keep all devices away.

On the bright side, it has taught me to be very diplomatic in my discussions with others. My default behavior (when I don't slip) is to assume that whatever I say could become public somehow.

Reply on news.ycombinator.com