Hacker News Reader

Comment by ignoramous | Hacker News Reader

> (apkmirror) We're especially concerned about security, given how dangerous downloading apps from third-party sources can be, so we go out of our way to manually review and vet every APK that hits the site.

Kudos. I wonder why PlayProtect didn't catch this? On one hand project-zero does stupendously well and on the other a project like PlayProtect fails at checks that an untrusted third-party routinely does. It can't be incompetence? It can't be blind reliance on AI?

Android has a 2B install base, and security will quickly turn into an unprecedented nightmare as more and more people get exposed to scamware, spyware, scareware, malware for the first time. This is not even factoring privacy encroaching viral apps like Helo, ShareChat et al that have in some cases 100M+ installs.

View on HN

GPZ has some of the very best whitehats in the entire world and they are evaluated based on what they find, not what they fail to find. They have the time to review code in depth. They are also usually investigating vulnerable code rather than malicious code, which doesn't seek to hide from investigation.

PlayProtect needs to be able to evaluate every app in existence (millions of apps on the Play store, ??? off the play store, and dozens or hundreds of versions of each of these apps). Malware authors are incentivized to perform all manner of tricks to avoid detection (code obfuscation to prevent static analysis, environment detection to prevent dynamic analysis, etc). It needs to do so in a (presumably) fully automated fashion since there are so many apps. It also gets little credit for when it works and instead only makes the news when it fails.

So 100% of the coverage of GPZ is positive and 100% of the coverage of PlayProtect is negative.

I get your point but my intention was not to highlight the different areas of security GPZ and PlayProtect tackle, but the gulf in class in competence and level of execution between those groups (if I may say so from the armchair I'm sitting on).

That said, the last bit abt a 100% coverage rings true. The signature check; however, seems like one of the important things to do (of course, there are lot of edge cases to be taken care of)? It can't be any more expensive than the AI they run on millions of apps.

"It isn't that hard" isn't always a good reason to implement something. I don't know the details, but it could be entirely reasonable that at every prioritization step people have decided that something else was higher impact.

Add to this the fact that signing keys are often shared in weird ways (usually with OEMs) and maybe it doesn't make too much sense to use "this is signed weirdly" as sufficient evidence to remove from Play.

APKMirror is a great resource but there's no way they 'manually' review each APK that hits the site.

I expect that they do so for the high profile apps, since the negative press from a compromised Facebook/Snapchat download would probably kill the site outright.

but they discovered random 3rd party apps signing with the facebook key. apps with a package name like com.testmusicapp

so to detect this manually, they'd have to be checking every single app! more likely, they've an automated system that detects new APKs signed with prominent keys.

Yeah, that's what I would expect - global automated testing, and specific manual testing.

Although it's very possible that the thing you mentioned is a fluke and somebody decided to ask the question "We should probably keep all the Facebook apps definitely-safe, so which ones are signed with this key?"

does PlayProtect flag anything actually?

Well, they do publish a yearly report on Potentially-Harmful Applications that they do flag and remove: https://android-developers.googleblog.com/2018/11/combating-...

Reply on news.ycombinator.com