this post was submitted on 02 Jun 2024
407 points (89.7% liked)
Technology
59152 readers
2306 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Aren't apps on android hermetically sealed from other apps and malware. How could this be achieved ?
Since the other reply was unhelpful: apps are supposed to have limited privileges and isolation from each other, yes... But the whole point of malware like this is that they figure out ways to break those restrictions and get escalated privileged.
You can get more technical detail from reading the report, in this case it looks like the app does not contain malware, but instead requests an update after install that contains the bad code and then breaks the app limitations and scans for the target banking applications and copies the security certificates.
Yes, the app doesn't steal any information from other apps. The report says the malware just displays a fake bank login page, in the hope the user gives it their details willingly.
As a developer this question is hilarious to me
As a curious Android user this comment is useless to me
For a real answer here's the Zscaler blog write up: https://www.zscaler.com/blogs/security-research/technical-analysis-anatsa-campaigns-android-banking-malware-active-google
It looks like they are doing it after app install with a malicious patch. This patch asks for SMS and accessibility access to gain privileges necessary to get into the banking apps. I haven't thoroughly read it but just looking at the attack chain that's what I gleaned.
Ugh, TIL zscaler actually does more than just send my PII to the USA without my consent.
As an Android developer that comment makes me sad. Then I remind myself that Lemmy is full of people who migrated from Reddit.
We each have our specialties, and it would be unreasonable to ask that everyone share yours.
Dude, do you not want people on this platform? Reddit migrants come with baggage yes but I'd rather that than the husk that was Lemmy before.
I'm not gonna scream back at you,.... I'm just going to walk back.... very...... very..... slowly.....errrrrrrr
Hey don't pretend that you didn't migrate as well.
Why? They're absolutely right. The article doesn't say anything about a root exploit or phishing either so were left wondering...
He's being condescending because he believes as a developer nothing is actually fully secure. If I spend 100 hours building and securing something, that's not going to stack up very favorably vs the 1,000's or even 1,000,000's of hours attackers and communities can spend trying to break my security layers.
Basically, he's a dick in how he answered the question, but the truth every software engineer learns, is that there is no fully secure system. There's always an angle/attack vector you didn't think of and secure.
Of course there are (or there can be) fully secure systems. The problems come when you assume something is.
Hey but that wouldn't make money to companies like google ot samsung.
Your smartphone is itself a security hole. It has 10+ sensors on it nowadays and who knows how many apps lying about their privacy promises.
Hey I was just trying to make a joke.. but looks like I didn't consider the wording too carefully.
They actual report does say it just displays a fake login page. It's just phishing.
please enlighten the rest of us
and one day you'll say why, right?
Android as a system has too many moving parts. You not only have to worry about various device manufacturers compiling their own versions of AOSP, you have to worry about how manufacturers package unremovable apps like facebook, candy crush, etc.
The backdoor is actually the front door.. and it is app vendors who are actually the customers... not the phone owners.
The main reason smartphones took off is that business people were salivating at an always on, always listening device with 10+ sensors collecting data on this whole world. And we pay for the privilege.
Android has to be designed to collect data and show you ads. Is it really surprising that security here is just security against free access to this data from outsiders.. and not caring about your security?
Explain yourself
There's no such thing as perfect security.. unless your application is trivial and doesn't do very much. Android is designed to collect data from the dozen plus sensors on your phone in order to get money from app vendors to push ads.