Hacker News Reader

Comment by barbazoo | Hacker News Reader

> ThreatFabric detailed how the crooks behind Anatsa will purchase older, abandoned file managing apps, or create their own and let the apps build up a considerable user base before updating them with malicious components.

Maybe it's time to turn off auto update for apps. Auto update is important from a security perspective but if the actor is bad, it might be better to wait and update on demand to catch up with missing fratures and by that time hopefully the malicious app has been removed from the app store. Of course this would only work for standalone apps.

Similar to how we often have intermediate package managers that pin packages to a particular version to not get malware injected one day.

View on HN

> Maybe it's time to turn off auto update for apps.

It's very frustrating that I cannot specifically exclude certain apps from auto-updates.

Android forces me to either permit blanket auto-updates, or to click through a big list of pending updated, where a single mis-tap will permanently update the wrong app with no easy way to undo or downgrade.

Why do you need to use auto updates? I am on manual and go through the list of pending updates every few weeks. Takes 2 min. I can't believe how vendors have gaslit people into "auto updates are the only way"

Release notes is MUCH bigger problem. App stores should show a history of every update issued since your current version. Also, ban devs who just write useless two word "Bug fixed" release notes.

You most definitely can exclude specific apps from auto update on the Play Store. Go to the app's Play listing page and tap on the overflow menu in the top right (vertical ellipses) and uncheck "Enable auto update".

> Android forces me to

It does no such thing.

Google does.

Auto-updating should be tied to audits by reputable third parties, to sign off on a release. At least two. Why isn’t this fone?

Not doing that is cheaper and there's no regulation that forces companies to do those audits to get things released. We live in capitalism where cheaper wins.

Forget government force, I am talking about industry standards and defaults. People have RedHat, Apple and others for distributing stable app and service versions with operating systems. Same principle should apply to package managers. How can a low-level package break or poison 40,000 other repos overnight?

This culture of Tweeting at 5 am to 5 million people before the truth has a chance to get its pants on is defended in the name of “freedom of speech”, but I much prefer the peer review gated approach of science. Not one monopoly gatekeeper but at least 2 reputable ones, before your OS or package manager allows the download (but users can override it if they insist). I think rpm and yum do that..

Supply chain attacks are a thing in Linux too. Some activist clown tried to brick devices with Russian or Belarusian IPs in the same manner. This system is compromised.

Yes, just audit a 1M LoC app every 2 weeks!

Or just use iOS and text, take photos, and use big name apps only like IG.

I used to be into phones. These days I use $150-200 used iPhone SE (2020). Don’t care if I drop it or break it. And it takes decent photos (not amazing, not terrible). And it’s small.

Just because this article references Android doesn't mean iOS is without its own security issues.[1] The "just use iOS" portion of your advice may be a bit optimistic.

1: https://www.wired.com/story/kaspersky-apple-ios-zero-day-int...

This sort of things happens on iOS also. The big difference is that Google is open while Apple tries to hide it.

The Xcode ghost incident for example affected half a billion installs and 100M users: https://www.intego.com/mac-security-blog/xcodeghost-malware-...

Regarding big name apps... Well, WhatsApp on iOS has been the main attack vector for state actors for a few years now.