"Millions caught up in Android botnet"

[Grall]

According to ZDNet, the oddly named but capable malware Android.counterclank can be found in at least 13 free games on Google's official marketplace.

Counterclank is reportedly able to communicate with central command and control servers, steal personal data off the phone and also displaying ads on the user's phone.

Now, most of these titles have very odd Engrishy-like titles which a person like me probably would not be likely to download; for example, "Heart Live Wallpaper" doesn't sound like my kind of game, but there's a LOT of people out there these days with Android phones, kids (and adults, for that matter) who don't know much English anyway - or don't care - they're just downloading random free stuff in hopes of finding something fun enough to play. Only they're getting bonus material also.

It doesn't say in the article if deleting the game also deletes the malware off the phone, but it also doesn't say that Google has removed the offending titles from its marketplace and purged them off users' phones (as they're capable of on at least unrooted units), so I guess they haven't done either - yet, anyway.

This is exactly the reason I don't own an Android phone, and probably never will. You'll simply never will be safe - at all - with the kind of security model Google's using. Not that Apple's or MS's are completely infallible of course, nothing ever is, but Google's is from what I can tell pretty much non-existant (at least until after shit has already hit the fan anyway) so most ANYTHING other than theirs is better. And if you use a 3rd-party marketplace, then Grud help you because nobody else will...

 

[pcchen]

Well, at least smartphones (regardless the OS) are already much safer than Windows PC or other desktop OS

Personally I think this "walled garden" model is a much better way and desktop OS should go this way as well. There is no reason for applications to "share" data which don't need to be shared. Therefore, the OS should always make distinction between "shared" and "non-shared" data for all applications.

Of course, security is always a trade off, between cost, usability, and security. You can't have all. Finding a good balance is always the most difficult job for a secure system design.

 

[Silent_Buddha]

Of course, security is always a trade off, between cost, usability, and security. You can't have all. Finding a good balance is always the most difficult job for a secure system design.

How true. And for consumer desktops it's mostly about the trade off between user friendliness and security. Apple has really benefit for the longest time via security through obscurity in the desktop space and being until recently a far less lucrative target to exploit. Allowing them to focus more on user friendliness.

I think this is a general direction that MS is trying to go with Metro on the desktop. And forced Metro only on tablets that OEMs opt into. Not a bad thing IMO, as most tablet users don't need full desktop capabilities.

Myself, I'll be happy as long as things like that remain optional on the desktop and on some tablets.

Regards,
SB

 

[fuboi]

I'm surprised "classical" botnets aren't more widespread on android. Devices with direct access to your wallet (operator billing), horrible update policies (many phones are on 6+ months old kernels with known vulnerabilities) and always-on un-firewalled cellular connections are a dangerous combination.
There's the issue of the perpetrators being tracked down because they are the registrars of the $6/minute number in Estonia your phone called at 4AM, but I'm sure creativity will find a way.

 

[swaaye]

horrible update policies (many phones are on 6+ months old kernels with known vulnerabilities)

interesting point. Most products have only seen a handful of updates thru their "lifetime". It's also often a major bitch for the homebrew people to do it themselves because of driver binaries or out of date source.