Guys,
I always wondered how harmful could be - in theory - a homebrew app installed on an Interop-unlocked wp7.5 device.
What is considered as a virus, spam or scam app?
The worst it could do is copy my contact list and upload it on its own server? (privacy issue).
Could an app take the whole OS down?
How much do we trust casual developer?
I always install homebrew apps found on the xda with no second thought. But a few days ago I installed an app to browse some *dirty* websites and dunno why, I started thinking about this issue?
Thanks to you all!
K.
Usually, you can trust the guys here on XDA.
However, even a normal app could steal your contacts. And a homebrew app on a b fully unlocked rom can do even more (of course! that's the point ).
But as said, XDA is usually quite OK, and if a big name like cotulla, ultrashot, Heathcliff74 (and all other amazing devs here on xda) is behind it, you're definately safe.
Oh, and what's a virus? That's nood easily defined. Just think of a file manager. It allows you to delete files. Deleting a file is nothing special. So what? Well, what if the app is going to delete random files? You got a virus... (That's why it's so hard to make behaviour analysis....)
LOL, there is no way WP can get a virus with it's locked down UI and isolated storage. WP isn not Windows OS. So don't worry.
Unlocked phones and risks
sinister1 said:
LOL, there is no way WP can get a virus with it's locked down UI and isolated storage. WP isn not Windows OS. So don't worry.
Click to expand...
Click to collapse
Please note that the OP is talking about an Interop-unlocked phone which is quite open compared to a WP7 phone in its normal state (which really does give little reason for worry).
If you ask me, the age of pranks and viruses that delete your files just because they can is over already quite some time. Today people most often try things with malware if there is money to be made.
So you may ask yourself: How could there be monetary profit from the very small base of users with fully-unlocked WP7 phones? Especially factoring in the fact that many of those users being anything than noobs which will get suspicious easily.
If I was a malware author I really would look out for greener pastures
if you don't trust the developer you can easily check the code by decompiling it. ok... this requires some knowledge in c# development and doesn't work for native code.
Well, decompiling native code is entirely possible. It's just more difficult to read the resulting source.
There risk is absolutely there. The way malware would work on WP7 is different from how it would work on a PC, but it's certainly possible (and actually, on a full-unlock ROM you could write malware very similar to how you'd write it for PC). Consider the various kinds of Android malware; WP7 malware (with sufficient permissions) could do things like send SMS to "premium" numbers, track you using the GPS, and other unpleasantries.
This is the reason that, for example, Heathcliff74 made Root Tools require that the user manually mark an app as Trusted before the app receives full permissions. Of course, that requires that you trust Root Tools itself (and it's quite heavily obfuscated, so decompiling it won't do you much good) but as @chabun said, he's one of the "big names" in WP7 homebrew and is considered trustworthy.
For myself, this question is one of the reasons I release the source code to my apps. If you've got the source, you can check it for any malicious or even undesirable behavior, and if you want to you can modify it to suit yourself better.
kevyn82 said:
Guys,
I always wondered how harmful could be - in theory - a homebrew app installed on an Interop-unlocked wp7.5 device.
Click to expand...
Click to collapse
Well, there are quite a few harmful things a malicious homebrew app could do:
spy on you all the time using the built-in cam and mic;
record all your phone and video calls;
copy all your text messages;
track and report all your movements (GPS);
upload all your personal pictures to a third party;
call international or "premium" phone numbers without your knowledge, generating large phone bills;
send "premium" text messages or registering you to premium subscriptions;
sent text messages in your name to influence a TV show vote;
reroute all your phone calls through a "premium carrier", again generating large costs;
transform your phone into an email relay or VoIP for spamming;
record all your usernames, passwords, account numbers or credit cards for financial profit;
make your phone become a BitTorrent relay, eating through your mobile data allowance in a few days;
I am sure that we can find a few more by brainstorming a little bit, or by googling "iOS malware" or "Android malware"...
So the key questions is not what is possible in theory, but how much do you trust the developer of an app, homebrew or not.
Cheers,
Stephen
GoodDayToDie said:
This is the reason that, for example, Heathcliff74 made Root Tools require that the user manually mark an app as Trusted before the app receives full permissions. Of course, that requires that you trust Root Tools itself (and it's quite heavily obfuscated, so decompiling it won't do you much good) but as @chabun said, he's one of the "big names" in WP7 homebrew and is considered trustworthy.
Click to expand...
Click to collapse
Thanks for your answer!
Yes I think some premium dev like yourself, Heathcliff74 etc are deeply trusted on here.
But still I am pretty sure the average user doesn't care about names or source. He or she won't be able to read though the source code or understanding what does require an app access to.
Also, if the app would require "elevated privileges" trough Heathcliff's Root Tool, he wouldn't think twice about granting to it.
Then if something bad would happen, then it would blame the OS, not him- or herself.
Things like requiring user confirmation to call or send a text within an app, from my prospective, never should be avoided.
On iOS for instance a lot of user complained to the carrier (here in Italy), some international sms sent billed in their accounts. It was iMessage first set up to send a txt to the UK (which costs on avg 0.30 Eur, compared to 0.10-0.15 a single sms).
But I am wondering now why jail-broken iPhone aren't subject to malewares like the open Android platform. I'm sure unlocked iOS would be a pretty green garden for them.
rbrunner7 said:
Please note that the OP is talking about an
If you ask me, the age of pranks and viruses that delete your files just because they can is over already quite some time. Today people most often try things with malware if there is money to be made.
Click to expand...
Click to collapse
You're right, just wanted to show that it's not really easy to say what's bad and what's good...
There's been malware for jailbroken iPhones. There was even a worm that spread by infecting people who had enabled an SSH server on their phone but left the default password.
The reason it's less of an issue there than on Android is that malware is typically a business - that is, it's done to make money - and so you target the largest number of people you can. There are fewer iPhones than Android phones, and far fewer jailbroken iPhones than Android phones that can access the market or even install apps from outside the official market (pretty much all of them).
I've noticed sometime last year that local news apps developed by LSN Inc. requires hardware control of the phone camera. I suspect those apps actually snap pictures every time the app is opened.
Can the experts here help me validate this suspicion? Is there a way you can inspect for malicious codes in those apps?
Why suspicious?
sp_1st_timer said:
I've noticed sometime last year that local news apps developed by LSN Inc. requires hardware control of the phone camera. I suspect those apps actually snap pictures every time the app is opened.
Can the experts here help me validate this suspicion? Is there a way you can inspect for malicious codes in those apps?
Click to expand...
Click to collapse
Permission to use the camera is explicity requested. It probably supports a feature for the user to send pictures/videos back to the news station.
LSN Mobile has a legitimate looking website, including names of the officers
http://www.lsnmobile.com/about_us/our_team.html
... as well names/numbers/email for key contact personnel and physical address of the business:
http://www.lsnmobile.com/contact_us.html
Can I ask what makes you suspicious about these Apps?
Not sure if I should post a paranoid parrot meme, or a conspiracy keanu meme.
First, I can't find in the apps where a user can actually use the camera feature. And when opening the apps, it gives a completely black screen for several seconds before getting to the main interface. It makes me think it snaps an image during the black screen delay.
Why require permission to access the camera when there is no user accessible feature that requires it?
To GermainZ - I have seen you on the Tasker forum and always considered you a knowledgeable and helpful guy. Give this guy a break - he's just asking a question.
sp_1st_timer said:
First, I can't find in the apps where a user can actually use the camera feature. And when opening the apps, it gives a completely black screen for several seconds before getting to the main interface. It makes me think it snaps an image during the black screen delay.
Why require permission to access the camera when there is no user accessible feature that requires it?
Click to expand...
Click to collapse
The software from LSN gets a clean bill of health from mobilesecurity.com
http://appview.mobilesecurity.com/search?q=LSN
I downloaded the Local TV station LSN program to check it out, and I agree with you there is no accessible feature within the software to use the camera within the program that I looked at. Perhaps a capability for users to send pictures/videos is left over from a previous version or reserved for a future version. Perhaps it is a feature built into the general program that needs to be activated by the specific local TV station. At any rate, given the very wide use of this software by a seemingly-legitimate company, I personally wouldn't have a high level of concern about it. Also,perhaps it will help you to know that it can only take pictures when the program is running, not all the time.
There is a feature in the program where you can contact the developer... you might want to try that out to see if they have an explanation that satisfies you (and post any results back here if you do). There is certainly nothing wrong with a cautious and questioning attitude when it comes to permissions.
These posts make my day.
Sent from my cm_tenderloin using xda app-developers app
Electric Pete,
Thanks for not ridiculing my question. Yes, I presume it could only take pictures when the app is on. The are people who likes reading the news or checking the weather forecast while in the bathroom or as they come out of the bathroom. It's up to your imagination.
I'm not sure they would care to answer my question, because when I pointed this out in my user review of the app, my review is made invisible to the public. I actually waited for several days to see if my review would eventually become visible, but never. My reviews on other apps are visible.
If they are not guilty, they should not suppress my "wrong suspicion".
If the review you mentioned is on Google Play, I don't think the developer has any capability to supress that. Google runs the show there.
I do see your point about privacy. Reading the permissions and questioning the ones that don't make sense is good practice in my opinion.
electricpete1 said:
If the review you mentioned is on Google Play, I don't think the developer has any capability to supress that. Google runs the show there...
Click to expand...
Click to collapse
That is interesting. Why would Google suppress my review which can be considered laughable (as indicated by some reactions in this thread).
Anyways, thank you for giving time replying to this thread. If only I got the knowledge to inspect program codes of these apps...
By the way, the local news here where I live switched to different app provider. They listened to my concern.
Bottom line is, you could decompile the apk, edit the manifest and remove the camera permission (you could also check the output; or try a tool that decompiles an apk to java code, which will be much clearer, but it's still in beta if I'm not mistaken).
Monitoring the logcat/using the "ps" shell command might also reveal something useful, but I'm not if taking pics within an app starts a separate camera process ps would show.
Also, the logcat probably won't show anything useful, tho (the same thing applies; and if the app is malicious, it won't output anything malicious-related to the logcat).
Still think it's paranoid, tho. Why not contact the devs?
Ive been through the entire security forum. Must say till a little raw but it will mature hopefully. Still a lot of noobs talking and no serious dev talk. Im not a developer but I have done some research esp on encryption systems and keep myself updated with the loopholes in various apps. Until such time when they do join in I think it would be a good idea (esp if the higher-level know-its) would share their list of apps they use for their everyday functioning and especially how you currently protect yourself best against unwarranted attacks to the types other forums are talking about.
My list is:
K-9 mail : for email. I use APG with that though im still not convinced its worth it cause the keys would be a easy to 'reverse engineer' as you can easily detect the device you use to send the mail and thus an estimate of the computing power essentially showing them the narrow range of prime numbers in which the key could have been generated. But you would need to be a dedicated target for that. Plus its open-source and very popular.
Xprivacy: its good for apps with too many unnecessary permissions but it wont protect you against intruder attacks.
network connections: just switched over to this from wire shark. Still undergoing testing. But it tell you the current internet connections and seem promising. You can block the suspicious IPs using xposed framework called peerblock (look into the xposed mod index). Needless to say but I think blacklisting google would be perhaps make you life considerably old-fashioned esp if your plugging the google 'backdoor' access they provide to 'he-who-shall-not-be-named' organizations.
Browser: im using the native AOSP browser. Firefox would be a better alternative in my opinion to chrome or others. I wish we had chromium for android.
Quickpic: using it instead of the native gallery after i found that it was connecting to the internet.
Calander: using the native AOSP calander but deleted the calander sync cause i try to avoid relying on google too much. selectively Denied internet permission.
ES file manager: a very complete tool. root explorer with checksum built-in. denied internet permissions.
TextSecure : Using this for standard texting because it seems to offer more encryption that any other texting app at the moment. Plus its going to be the default messaging app in Cyanogen ROMs in the future. Offers One-Time-Pad system encryption which is encryption theoretically secure (what that means for the common man is that this encryption is the only one that has stood the test of time to be unbreakable of used properly. All other encryption systems rely on the fact that the decrypting systems used to 'crack' the encryption lag behind the algorithms. Lets hope the devs did implement it properly)
Remove Google from CM10+ ROMs : http://www.xda-developers.com/android/remove-the-google-from-cyanogenmod-with-freecygn/
"Not every user particularly cares for Google’s proprietary bits and its tendency to put them everywhere. As such, XDA Senior Member MaR-V-iN has created a script to clear out Google proprietary binaries from all CM10+ ROMs. Freecyngn disassembles the CyanogenMod settings app and replaces Google Analytics library with the free NoAnalytics. The whole process doesn’t break the Settings app, and turns your device into one that is Google-free"
Click to expand...
Click to collapse
Thanks to @SecUpwN for the site: www.prism-break.org As you will see by visiting this site its not secure but just a list of more open-source projects.
I dont use a lot of google products like gmail or chrome or maps but i would like to minus the uneasiness that i have using it. And i dont use public wifi at all. The great things in life are hardly ever free!
Needless to say but i use CM 10.1 since its well developed and open-source. Looking forward to omniROM by chainfire and other great devs. I do believe we need some serious stenographic programs for android because encryption alone is not the way to go. Maybe they will take this more seriously. This remains a work in progress. As always hit thanks if it helps.
CM is now for profit. It's CyanogenMOD Inc. Anyway, this is a pretty naive approach, IMHO. You want to keep something secret you can't tell technology about it. Check out "Schneier on Security."
where did you download "network connections" from?
@aejazhaq: See www.prism-break.org!
runwithme said:
where did you download "network connections" from?
Click to expand...
Click to collapse
I downloaded it when the dev was giving the pro version free for a limited time to XDA members. How ever its available on the play store...https://play.google.com/store/apps/details?id=com.antispycell.connmonitor&hl=en
SecUpwN said:
@aejazhaq: See www.prism-break.org!
Click to expand...
Click to collapse
Yes i cam across that just a week ago. It seems to me as my knowledge progress' that the apps available are just to keep the selective data eg your mails private if you use APG with that. @pan.droid I think anything on your device is still as vulnerable as can be honestly and don't think, at least as of now that you can protect your data on you device with any satisfactory means, at least not yet. I'm interested in stenographic means more now than ever because I think encryption alone wont cut it esp keys generated on the phone; the prime numbers needed for a foreseeable future (3+ yrs) protection are elusive on the phone, perhaps the PC can do a better job, but again with its fallacies esp with emails being stored in the cloud permanently means that there's an expiration date on such material you choose to share. And given it lacks forward secrecy and anyone using PGP in emails is definitely shouting encrypted msgs being transmitted perhaps arousing more suspension and the subsequent package.
Thus I do agree the list is currently very naive but perhaps the best we can do at the moment. Thats why I'll leave people to share their opinions on this because this is perhaps an ongoing discussion.
I'm really interested in a contacts replacement. I hate the new style google version but I don't trust ANYTHING free from the app store. They all download your contacts!
You didn't mention AFWall+, the iptables firewall I consider instrumental in blocking most phone home attempts.
SecUpwN said:
@aejazhaq: See www.prism-break.org!
Click to expand...
Click to collapse
Actually, pretty great site!
pan.droid said:
Actually, pretty great site!
Click to expand...
Click to collapse
You're welcome. If you're interested in security projects, have a look!
I'd totally jump on board with that, but all I have is a WI-FI tablet, ATM. Great activist project for anyone serious about security.
pan.droid said:
I'd totally jump on board with that, but all I have is a WI-FI tablet, ATM. Great activist project for anyone serious about security.
Click to expand...
Click to collapse
Sadly, our project is missing real security enthusiasts and DEVELOPERS. Do you know anyone I should get in touch with?
I use "Keepass2Android Offline" to manage my passwords. This "offline" version removes Internet access permissions which I consider essential for security of my database.
Hello,
I've been doing some research on the many, many different routes I can go with Android development, and I'm hoping someone might be able to help narrow down my choice. My experience is currently web related, PHP/HTML/CSS, with knowledge of intermediate Javascript, etc.
I'd like to create a very similar game to Football Manager, but less ambitious. For those that aren't aware, it's a simulation game where you're the manager of a soccer team.
My ambition is to keep it very simple, dumbed down. No need to watch the games, pretty much all text with simple graphics for some things.
My issue is, trying to find a place to start. There's literally a lot of different routes, and I'm overwhelmed. Do I use HTML5? Java? One of the programs like Unity, Construct? PhoneGap?
For my specific game, and idea, what would be your best suggestion on what to use?
Thanks in advance.
you can try CocoonJS. it's easy.
It's html5 fraemwork.
CocoonJS is a technology that helps HTML5 developers publish their web-based games and apps in the most important mobile and web stores with no code changes and with all the advantages of native development.
Using CocoonJS, a single code base is enough to publish a game or app natively on more than 10 stores. Best of all, with no installations thanks to our cloud-based platform.
HTML5 is finally ready for cross-platform app and game development!
Learn more: http://ludei.com
But now it's in open beta.
All free, but all Extension only for premium users.
Premium account granted for free, if you have nice idia/project.
The answer is "it depends"
A couple of questions...
1. Will it only be for Android? or are you also planning to push it to iPhone?
2. Will the interface be more like a app (eg. gmail, calendar, utility apps) or more like a game (immersive, completely different interface) ?
3. Will there be a lot of interaction? or mainly consuming information?
pyko said:
The answer is "it depends"
A couple of questions...
1. Will it only be for Android? or are you also planning to push it to iPhone?
2. Will the interface be more like a app (eg. gmail, calendar, utility apps) or more like a game (immersive, completely different interface) ?
3. Will there be a lot of interaction? or mainly consuming information?
Click to expand...
Click to collapse
1. Android to start, possibility of iPhone in the future.
2. Straight forward, more like an app, nothing too pretty, more statistical.
3. Mainly consuming information, lots of behind the scenes work.
In that case, I would say go for a mobile friendly web-based app, as opposed to a native app. So this would mean HTML/CSS/JavaScript.
Reasons are:
You want to eventually be on both Android and iPhone. Since you're app is more "app like" if you go native, you'll essentially have to write 2 separate apps to have good user experience (Android and iPhone have vastly different experience guidelines). WIth a mobile-friendly website, you'll satisfy both with one code base
You've already got experience in HTML/CSS/Javascript - definitely a big win!
Since your app will mainly be information consumption, it sounds suitable for a website.
When done correctly, a mobile-friendly website can still be a great experience to use
A couple of things to be aware of...
Don't try and imitate the native UI on the mobile-friendly website. It is a website, not a native app! Users are fine if it doesn't behave like a native app (afterall, they would've just reached your site via the browser). In fact, if you make the website behave sorta like a native app, it might confuse users more. Best direction is to have a good, solid ,easy to use and understand UI. (Be wary of the Uncanny Valley)
Unlike laptops/desktops, mobiles generally are less powerful, so you'll need/want to optimise performance. Make sure the website runs fast & smoothly (ie. optimise resource downloading, minimise/optimise javascript animations etc). Be aware that most phones have a 'click delay' (to detect swipes/drags etc) so you'll want to use something like fastclick to eliminate this.
Remember that on a mobile device your user will be using their fingers (and not a mouse) to click/interact with your website. So make sure tap targets are nice and large.
Finally .... test on a real device! Chrome dev tools etc to simulate phone screens is great for dev, but actually using your website on a mobile will reveal many design decisions that might need to change.
This might sound like a lot to think about, but I think given what you've said about your idea, in the long run, it will be more time efficient. (there is probably a equally long list of things to think about when developing a native app!)
Good luck with your idea
pyko said:
In that case, I would say go for a mobile friendly web-based app, as opposed to a native app. So this would mean HTML/CSS/JavaScript.
Reasons are:
You want to eventually be on both Android and iPhone. Since you're app is more "app like" if you go native, you'll essentially have to write 2 separate apps to have good user experience (Android and iPhone have vastly different experience guidelines). WIth a mobile-friendly website, you'll satisfy both with one code base
You've already got experience in HTML/CSS/Javascript - definitely a big win!
Since your app will mainly be information consumption, it sounds suitable for a website.
When done correctly, a mobile-friendly website can still be a great experience to use
A couple of things to be aware of...
Don't try and imitate the native UI on the mobile-friendly website. It is a website, not a native app! Users are fine if it doesn't behave like a native app (afterall, they would've just reached your site via the browser). In fact, if you make the website behave sorta like a native app, it might confuse users more. Best direction is to have a good, solid ,easy to use and understand UI. (Be wary of the Uncanny Valley)
Unlike laptops/desktops, mobiles generally are less powerful, so you'll need/want to optimise performance. Make sure the website runs fast & smoothly (ie. optimise resource downloading, minimise/optimise javascript animations etc). Be aware that most phones have a 'click delay' (to detect swipes/drags etc) so you'll want to use something like fastclick to eliminate this.
Remember that on a mobile device your user will be using their fingers (and not a mouse) to click/interact with your website. So make sure tap targets are nice and large.
Finally .... test on a real device! Chrome dev tools etc to simulate phone screens is great for dev, but actually using your website on a mobile will reveal many design decisions that might need to change.
This might sound like a lot to think about, but I think given what you've said about your idea, in the long run, it will be more time efficient. (there is probably a equally long list of things to think about when developing a native app!)
Good luck with your idea
Click to expand...
Click to collapse
Thank you very much for your help, I appreciate all the information. One last question on my end.
I'm assuming the development tools would be the same as a usual website (ie. In my case, Dreamweaver?). If you're familiar with Game Dev Tycoon, would a layout /similar style of interaction game b, e capable using only Dreamweaver, or is something else needed?
No worries, more than happy to help
I would actually suggest not using Dreamweaver as for the mobile website, you'll really want to be as lean and minimal as possible. From what I recall, Dreamweaver can add quite a bit of 'cruft' to your code.
I would suggest a standard text editor (recommend: http://www.sublimetext.com/) as that would allow you to have complete control over your code, what you include/exclude, what goes where etc. The mobile site will require that extra attention as you really want to make sure it runs smoothly on the mobile.
In terms of quick dev iteration (making sure the site looks correct) you can use the chrome developer tools (https://developers.google.com/chrome-developer-tools/) which allows you to fake the user agent/screen size etc on your browser. Though nothing beats occasional testing on a real device - just to make sure you're on the right track.
Had a look at Game Dev Tycoon and I would say for something as involved as that (lots of interaction, animations etc) it's better to go down the native route.
pyko said:
No worries, more than happy to help
I would actually suggest not using Dreamweaver as for the mobile website, you'll really want to be as lean and minimal as possible. From what I recall, Dreamweaver can add quite a bit of 'cruft' to your code.
I would suggest a standard text editor (recommend: http://www.sublimetext.com/) as that would allow you to have complete control over your code, what you include/exclude, what goes where etc. The mobile site will require that extra attention as you really want to make sure it runs smoothly on the mobile.
In terms of quick dev iteration (making sure the site looks correct) you can use the chrome developer tools (https://developers.google.com/chrome-developer-tools/) which allows you to fake the user agent/screen size etc on your browser. Though nothing beats occasional testing on a real device - just to make sure you're on the right track.
Had a look at Game Dev Tycoon and I would say for something as involved as that (lots of interaction, animations etc) it's better to go down the native route.
Click to expand...
Click to collapse
Thank you again. I appreciate all your help.
Ladies and Gentlemen,
I am opening this discussion in order to not only receive some high-quality answers on the following questions, but also to learn what everyone does in order to ensure security and integrity of Apps on their phones (especially when working in environments where attacks are likely or possible due to intersting files on the phone or similar).
Here is my question: Let's suppose a phone is ROOTED, is locked with a Pattern, is updated daily, has TitaniumBackup installed, runs Trust as well as an Antivirus App and on top of that, installed Apps are monitored in a regular basis through TitaniumBackup. Is it even possible for law enforcements or hackers to install malware? If so, what would be necessary for them to do so? Physical access? Malformed Apps with matching signature? Other types of attacks (encouraging @He3556 the owner of Smartphone Attack Vector to chime in)?
Second question (hope @jcase can answer this): What would be the best way of preventing attacks of afforementioned groups and alike? What do YOU personally do?
SecUpwN said:
Ladies and Gentlemen,
I am opening this discussion in order to not only receive some high-quality answers on the following questions, but also to learn what everyone does in order to ensure security and integrity of Apps on their phones (especially when working in environments where attacks are likely or possible due to intersting files on the phone or similar).
Here is my question: Let's suppose a phone is ROOTED, is locked with a Pattern, is updated daily, has TitaniumBackup installed, runs Trust as well as an Antivirus App and on top of that, installed Apps are monitored in a regular basis through TitaniumBackup. Is it even possible for law enforcements or hackers to install malware? If so, what would be necessary for them to do so? Physical access? Malformed Apps with matching signature? Other types of attacks (encouraging @He3556 the owner of Smartphone Attack Vector to chime in)?
Second question (hope @jcase can answer this): What would be the best way of preventing attacks of afforementioned groups and alike? What do YOU personally do?
Click to expand...
Click to collapse
Pe rooted, with common rooted apps installed? Would be easy to compromise that phone, as you have already done it for them.
Use a stock firmware, chose a vendor with a recent history of good security (Samsung, nexus, motorola in that order imo), keep it up to date, reduce the number of apps you run, don't root it. Disabled usb debugging.
jcase said:
Pe rooted, with common rooted apps installed? Would be easy to compromise that phone, as you have already done it for them.
Use a stock firmware, chose a vendor with a recent history of good security (Samsung, nexus, motorola in that order imo), keep it up to date, reduce the number of apps you run, don't root it. Disabled usb debugging.
Click to expand...
Click to collapse
Thanks for answering. So that means, in short words, buy a phone and only update official stuff. How boring, I wouldn't be here on XDA then! But I get your point. I'm especially interested in the question of detection. If such agencies have installed anything that would leak data (and I'm sure it's fairly easy to do for them), how would they hide that specific App from the list of TitaniumBackup? Also, how would they trick the Trust Even Logger created by @Dark3n to not show any installation?
Most importantly though, is there some way of detecting such installations or manipulations afterwards?
There is growing so called "Zero-Day-Exploit" Industry, with names like vupen or FinFisher , the one who are working for the German Gov. but also for countries like Saudia Arabia and Iran. They know how to find exploits, nobody knows about (zero-day) and program trojans for all kinds of platforms. So antivirus software can't help here. And it is easy to bypass security if you know one of the bugs - and we know there are many of them in firmware, operating systems, plugins, frameworks and so on... Beside this "white" marked there is also a grey and black marked. So if you need to track your woman or steal information from other companies, you will find somebody with a tool for that, i suppose.
You would need a "Intrusion Detection Software" - sorry but this won't work for Smartphones, because there is a lot of calculation, data and energy needed - you find this special hardware in big data centers.
Do not root and do not install Apps you don't really need is still a good advice, specially when people don't know so much about all this.
Another way to sneak in is to compromise the users pc, that is (maybe) connected to the phone sometimes (work with iphone sync but also with android to change DNS and get SMS with e-tan's - you will find more info it in the media)
Or if you have the "power" you can can use the cloud services (iOS, Google, Windows or other 3rd party services) to steal user data (sms, pictures, GPS history...) or just let it sync the malware to the phone. So you don't have to break in directly.
What would be the best way of preventing attacks of afforementioned groups and alike?
Click to expand...
Click to collapse
tomorrow i will have time, there are to many possibilities
Thanks for clarifying, @He3556!
Now I know that phones in general are hard to lock down for such agencies. Time to quote myself:
SecUpwN said:
Most importantly though, is there some way of detecting such installations or manipulations afterwards?
Click to expand...
Click to collapse
Hey @He3556, if you've been following security news the past weeks, this topic here is becoming more relevant with each revelation. Since the trojan-coding company FinFisher has highly likely been hacked and some cool whisteblowers are publishing very sensitve data like price lists and handbooks on their Twitter account GammaGroupPR, more details of their secret software FinSpy Mobile is being revealed. And this is exactly the type of software that I am talking about here in this thread. I want to know how users can protect themselves from crap like that. According to the video that has been leaked, It is being installed through a fake update, or even through messages via E-Mail to "please" install this "very important update":
And just to make everyone more curious, FinSpy Mobile has been leaked on Twitter! It obviously works for all operating systems, including Android, Blackberry, Windows Mobile, and Symbian. Another trophy is source code of FinFly Web, which found its way the code hosting platform GitHub. It is designed to provide remote and covert infection of a Target System by using a wide range of web-based attacks. FinFly Web provides a point-and-click interface, enabling the Agent to easily create a custom infection code according to selected modules. Target Systems visiting a prepared website with the implemented infection code will be covertly infected with the configured software. Regarding FinSpy Mobile and similar software: How would law enforcements possibly attack a cautious member of XDA (or any other site)? I mean, people that have been in the field of flashing new ROMs, updating their firmware and recovery themselves, not installing strange APKs sent via E-Mail and controlling installed Apps through TitaniumBackup should be somewhat immune to such type of attacks, right?
It appears to me as if their software might work for the general masses, but highly-likely not on people like @jcase or other Android security-gurus. Since I linked you, I'd be very happy if you could expand on that a little. I am sure such companies might even have the possibility of messing with the baseband of a target phone through only knowing the phone number of a target. But I am really curious what their "standard procedure" is if they face a target with thorough Android knowledge, maybe even a security-enthusiastic Android developer. Wouldn't their only option be to manually manipulate the handset?
There are two methods to keep away all kinds of trojan and malware...
1. use a SIM with data connections only: There are SIM cards on the marked you can use in a USB Stick for Notebooks or tablets.
You won't have a cell phone number and can't receive SMS. You won't be able to use the circuit switched (GSM & UMTS-cs) part of your cell phone. For communication you have to use a VoIP provider - with Secure SIP and SRTP.
2. Web browser, Apps, e-mail client and all other connection must be use VPN.
But there is one more stepp to take.
The virtualization of all services and Apps you are using. This works like Team Viewer on a PC. The App is running on a cloud server while you only see the desktop of the remote controlled application. This technique is already used when you want to use flash with iOS device (photon, cloudbrowse, puffin and so on..)
More details about this you can find here: http://itwatch.info/Products/ReCAppS
But i am sure there are more projects about this out there...
He3556 said:
There are two methods to keep away all kinds of trojan and malware...
1. use a SIM with data connections only: There are SIM cards on the marked you can use in a USB Stick for Notebooks or tablets.
You won't have a cell phone number and can't receive SMS. You won't be able to use the circuit switched (GSM & UMTS-cs) part of your cell phone. For communication you have to use a VoIP provider - with Secure SIP and SRTP.
Click to expand...
Click to collapse
I know this works, but the only guy who is so insane and is already doing that is probably @InvaderX.
Honestly, what's the purpose of a phone if I can't receive SMS and call anyone without internet connection?
He3556 said:
2. Web browser, Apps, e-mail client and all other connection must be use VPN.
But there is one more stepp to take.
The virtualization of all services and Apps you are using. This works like Team Viewer on a PC. The App is running on a cloud server while you only see the desktop of the remote controlled application. This technique is already used when you want to use flash with iOS device (photon, cloudbrowse, puffin and so on..)
More details about this you can find here: http://itwatch.info/Products/ReCAppS
But i am sure there are more projects about this out there...
Click to expand...
Click to collapse
Better yet: Living under a rock should solve all these problems. Seriously though, can such law enforcement agencies silently update stuff on my phone (possibly baseband) that goes unnoticed even when using TitaniumBackup and flashing a fresh ROM every month? From the things you mentioned as for protection, I highly doubt that I'll move that way. And no matter how hard I try, the bad guys (or, to put it in the wording of those companies: the agencies that are "protecting our freedom") will likely always find a way in - even if that means tapping the phone through listining in on my calls or deploying an IMSI-Catcher. But talking about this makes me wonder: It seems as if the probability is high that most of the time they are selling a fake update to the target. Is there a convenient way of knowing that stuff like FinSpy Mobile has been installed, where such agencies can't possibly tinker with any records of what was happening on the phone? I especially check the Trust - Event Logger by @Dark3n very often. Could they change such records? Is there a better App to warn about unauthorizes access or (hidden) App installation?
Trust is not a security app!
If an attacker has root, you can just alter the database of apps like Trust, which would be the easiest way.
There are probably also ways to alter the system so it does not broadcast certain events(which is how Trust monitors most things).
It is just not build to withstand such attacks.
SecUpwN said:
Seriously though, can such law enforcement agencies silently update stuff on my phone (possibly baseband) that goes unnoticed
Click to expand...
Click to collapse
Maybe? But there are much easier ways if it is not desired to target specific persons.
I'll brain storm a bit for you:
I would divide the attack vectors into those that work with root and those that don't.
Without root apps can still do plenty of malicious actions, including tracking your position or uploading all files on your sdcard (INTERNET;SDCARD;LOCATION permissions) etc.
If an attacker gains root permission he could install rootkits, modify existing apps, inject malicious code into dex files of installed apps etc.
Basicly do what the hell he wants.
While not using a rooted device would certainly make it more difficult to do malicious things, it's doesn't prevent it.
A normal app you install could still root your phone through vulnerabilities. It works the same way apps such as TowelRoot or ZergRush root your phone.
Downloading new apps that request root is also very dangerous ofc, once you pressed "grant", it's too late, anything could have been done. So be wary when trying out new root apps of devs you don't know/trust?
Abusing trust in existing apps is probably the biggest danger.
The most obvious danger here is downloading apps you usually trust but from unknown sources.
Sure there could be signature issues when updating over your current app, but what if you don't have it installed? I could also think about a few ways to inject malicious code without altering the signature (did not try, just a thought, might be impossible).
The issue is that you probably wouldn't even notice, as the compromised app retains it's original functionality.
Want a botnet?
Inject malicious code into a popular root up that is paid, crack it and upload it somewhere.
While this more dangerous (or worth for an attacker) with root apps, it's still viable for non root apps, just pick one that already aquires many permissions.
It's way too easy, people constantly underestimate the danger of this. It's not all about piracy it's bad, it's a barn door sized security hole.
A bit more difficult variant would be abusing known security holes in existing apps that can be root or nonroot apps, such as modifying files the other apps uses, such that it executes your malicious code for you, so some type of code injection. First thought would be looking for root apps that use scripts or binary files and then check the permissions on those files to see whether they are writeable.
Now those are all ways to target a broad mass of users.
If a single user is the target, it would be more difficult, but there are still plenty of options:
- MITM attacks at public hotspots,
- Pressuring developers of apps you use. What dev wouldn't implement a security hole into an app of his, if a guy in a black suit comes up and points a gun to his head? Well that escalated quickly... But with "secret courts" and all the **** that happens secretly sanctioned or is just done by some agencies because they are above the law, is it really such an impossible scenario? The ends justify the means? Do they?
- My favorite plan yet, making a popular app themselves that they know you will try
It is usually never impossible, just a matter of resources and whether its unfeasible to spend so many resources on that goal.
edit: So the best course of action? Don't install anything you don't trust. Don't trust the manufactor either? Install a custom ROM, but as those often use binary blobs for certain parts of the software, it's not really a 100% solution... There could also be compromising hardware built in, but now I'm really climing up the tinfoil tree, but as recents new story suggest that the NSA is intercepting hardware packets from manufactors such as cisco to modify them, what's really impossible?
TL;DR Best course of action that is feasible to adhere to is probably to just not install stuff one doesn't know or trust.
edit2: More specific answers to your questions.
You might be able to monitor files changes on an a system level, but if your attacker gains highlevel priviledges, what keeps him from changing the monitoring system?
SecUpwN said:
Seriously though, can such law enforcement agencies silently update stuff on my phone (possibly baseband) that goes unnoticed even when using TitaniumBackup and flashing a fresh ROM every month?
Click to expand...
Click to collapse
How does TiBu help prevent such injection? Flashing a new ROM would probably undo such changes, but what prevents "them" from just doing it again.
SecUpwN said:
And no matter how hard I try, the bad guys (or, to put it in the wording of those companies: the agencies that are "protecting our freedom") will likely always find a way in - even if that means tapping the phone through listining in on my calls or deploying an IMSI-Catcher.
Click to expand...
Click to collapse
This is the thing, with enough resources, there is always a way.
SecUpwN said:
It seems as if the probability is high that most of the time they are selling a fake update to the target.
Click to expand...
Click to collapse
Exactly disguising as something legit is the cheapest way, "trojan horse".
SecUpwN said:
Is there a convenient way of knowing that stuff like FinSpy Mobile has been installed, where such agencies can't possibly tinker with any records of what was happening on the phone? I especially check the Trust - Event Logger by @Dark3n very often. Could they change such records? Is there a better App to warn about unauthorizes access or (hidden) App installation?
Click to expand...
Click to collapse
I don't know any surefire way to detect this. The issue is that with enough priviledges (which can be gained without authorization, zero day exploits are worth a lot money to "agencies" as well as criminal organisations, though I'm no longer sure where the difference is), you can just clean up your track of malicious behavior.
Whoa, this has to be the longest answer I've received since registering here. Huge thanks! Grab a coffee..
Dark3n said:
Trust is not a security app!
If an attacker has root, you can just alter the database of apps like Trust, which would be the easiest way.
There are probably also ways to alter the system so it does not broadcast certain events(which is how Trust monitors most things).
It is just not build to withstand such attacks.
Click to expand...
Click to collapse
Ok, fair. Will keep it anyhow.
Dark3n said:
Maybe? But there are much easier ways if it is not desired to target specific persons.
I'll brain storm a bit for you:
I would divide the attack vectors into those that work with root and those that don't.
Click to expand...
Click to collapse
Just to mention it here: An awesome site to see which attack vectors and vulnerabilities exist is Smartphone Attack Vektor by @He3556.
Dark3n said:
Without root apps can still do plenty of malicious actions, including tracking your position or uploading all files on your sdcard (INTERNET;SDCARD;LOCATION permissions) etc.
If an attacker gains root permission he could install rootkits, modify existing apps, inject malicious code into dex files of installed apps etc.
Basicly do what the hell he wants.
Click to expand...
Click to collapse
Ok, I get the point. Also like @jcase already pointed out: If we root, we pwn ourselves. And if we don't, too.
Dark3n said:
While not using a rooted device would certainly make it more difficult to do malicious things, it's doesn't prevent it.
A normal app you install could still root your phone through vulnerabilities. It works the same way apps such as TowelRoot or ZergRush root your phone.
Downloading new apps that request root is also very dangerous ofc, once you pressed "grant", it's too late, anything could have been done. So be wary when trying out new root apps of devs you don't know/trust?
Click to expand...
Click to collapse
I only install trusted Applications.
Dark3n said:
Abusing trust in existing apps is probably the biggest danger.
The most obvious danger here is downloading apps you usually trust but from unknown sources.
Sure there could be signature issues when updating over your current app, but what if you don't have it installed? I could also think about a few ways to inject malicious code without altering the signature (did not try, just a thought, might be impossible).
The issue is that you probably wouldn't even notice, as the compromised app retains it's original functionality.
Click to expand...
Click to collapse
Guess if I use the F-Droid Store I should be pretty safe, right? But don't worry, I don't rely on it - as for me, smartphones are huge bugs with touchscreens. That is why I also built a phone signal blocking pouch for myself and friends. Further good recommendations can be found on the bottom of my GitHub.
Dark3n said:
Want a botnet?
Inject malicious code into a popular root up that is paid, crack it and upload it somewhere.
While this more dangerous (or worth for an attacker) with root apps, it's still viable for non root apps, just pick one that already aquires many permissions.
It's way too easy, people constantly underestimate the danger of this. It's not all about piracy it's bad, it's a barn door sized security hole.
Click to expand...
Click to collapse
Actually, no. I already have two or three. Or maybe even four?
Dark3n said:
A bit more difficult variant would be abusing known security holes in existing apps that can be root or nonroot apps, such as modifying files the other apps uses, such that it executes your malicious code for you, so some type of code injection. First thought would be looking for root apps that use scripts or binary files and then check the permissions on those files to see whether they are writeable.
Now those are all ways to target a broad mass of users.
Click to expand...
Click to collapse
Good to know we've come to an end here. Reading all this makes me want to throw my phone out of the window.
Dark3n said:
If a single user is the target, it would be more difficult, but there are still plenty of options:
- MITM attacks at public hotspots,
Click to expand...
Click to collapse
I DON'T use public hotspots. Why? Because you can be almost certain that stuff will be logged and analyzed once you use that. Over here in my town, we've got a HUGE Apple Store. And guess what - FREE WIFI for everyone! Yeyyy... not.
- Pressuring developers of apps you use. What dev wouldn't implement a security hole into an app of his, if a guy in a black suit comes up and points a gun to his head? Well that escalated quickly... But with "secret courts" and all the **** that happens secretly sanctioned or is just done by some agencies because they are above the law, is it really such an impossible scenario? The ends justify the means? Do they?
You are right, threats against family, friends and relatives are a no-go. If I remember correctly, something similar had happened to my beloved XDA developer @idcrisis who invented CrossBreeder. He left development of his toolset because starnge things occured in his life which he linked to his development. Shortly after leaving his project, he proposed a new license: The Aware License. Hope this guy is still living a happy life, though. Added to the above security-issues: Trust NOONE! How come? Well, just read this stunning story I discovered yesterday where a US critical infrastructure company last year revealed that its star developer had outsourced his own job to a Chinese subcontractor and was spending all his work time playing around on the internet adn surfing cat videos. ^^
Dark3n said:
- My favorite plan yet, making a popular app themselves that they know you will try
Click to expand...
Click to collapse
I don't quite get what you meanb by that. Please clarify, it sounds interesting.
Dark3n said:
It is usually never impossible, just a matter of resources and whether its unfeasible to spend so many resources on that goal.
Click to expand...
Click to collapse
The way I see it: The only thing that we have no real access to, is the baseband. I am sure that these are full of backdoors and switches for agencies that they just need to trigger - just like the Samsung Galaxy Backdoor discovered by Replicant.
Dark3n said:
edit: So the best course of action? Don't install anything you don't trust. Don't trust the manufactor either? Install a custom ROM, but as those often use binary blobs for certain parts of the software, it's not really a 100% solution...
Click to expand...
Click to collapse
Nope, I don't trust the manufacturer either. And I am SICK of bloatware! hence, I am a happy user of AOKP since several years - but regarding the binary blobs, I would certainly love to try out Replicant (sadly not yet available for the HTC One).
Dark3n said:
There could also be compromising hardware built in, but now I'm really climing up the tinfoil tree, but as recents new story suggest that the NSA is intercepting hardware packets from manufactors such as cisco to modify them, what's really impossible?
Click to expand...
Click to collapse
Nothing is impossible, everything can be done. A wise man once said: Everything you can imagine, will happen.
Dark3n said:
TL;DR Best course of action that is feasible to adhere to is probably to just not install stuff one doesn't know or trust.
Click to expand...
Click to collapse
Good advice, I already do follow that one. As already said, if I were a spy company, I'd just team up with manufacturers of basebands..
Dark3n said:
You might be able to monitor files changes on an a system level, but if your attacker gains highlevel priviledges, what keeps him from changing the monitoring system?
Click to expand...
Click to collapse
Highly-likely nothing. I already know that there is not much I can do to prevent them to get in, but at least I do want to detect them - and having such a detection mechanism raises the bar in disguising their actions even further - and who knows, maybe they're not interested anymore then?
Dark3n said:
How does TiBu help prevent such injection? Flashing a new ROM would probably undo such changes, but what prevents "them" from just doing it again.
Click to expand...
Click to collapse
Not much.
Dark3n said:
This is the thing, with enough resources, there is always a way.
Exactly disguising as something legit is the cheapest way, "trojan horse".
Click to expand...
Click to collapse
Absolutely right. But what I am really curious of: How do people from the security-community really protect their phones? Do you have friends that are using their phones to just communicate via VPN and VOIP, not sending SMS and never calling people? Perfect place for @InvaderX to chime in, he told me before to really do a combination of that approach.
Dark3n said:
I don't know any surefire way to detect this. The issue is that with enough priviledges (which can be gained without authorization, zero day exploits are worth a lot money to "agencies" as well as criminal organisations, though I'm no longer sure where the difference is), you can just clean up your track of malicious behavior.
Click to expand...
Click to collapse
Sigh.. mobile phones are a total threat to humanity, I get it..
At least I am not the only one paranoid about this kind of thing. LOL
lostangelintx said:
At least I am not the only one paranoid about this kind of thing. LOL
Click to expand...
Click to collapse
It doesn't have much to do with "Paranoia". The very reason you started to care about this, is because phones are in fact very insecure devices - most people just don't realize or care about it. Another very interesting thread I found lately: Android Security for Conscious Mind.
a tool against 0-day exploits
don't freak out to early - this tool is only for windows desktops.
But at least it shows how it could work for mobile devices, too.
It is called Enhanced Mitigation Experience Toolkit (EMET 5.0) ...is a utility that helps prevent vulnerabilities in software from being successfully exploited.
These technologies function as special protections and obstacles that an exploit author must defeat to exploit software vulnerabilities. These security mitigation technologies do not guarantee that vulnerabilities cannot be exploited. However, they work to make exploitation as difficult as possible to perform.
SSL/TLS certificate pinning - This feature is intended to detect (and stop, with EMET 5.0) man-in-the-middle attacks that are leveraging the public key infrastructure (PKI).
Ok, they do not guarantee 100% security - but who could? Even this software comes from Microsoft, it's still a good solution and closes the gap between anti-virus, firewall and keeping your software updated.
Here is a test from 2010 (EMET 2.0) http://www.rationallyparanoid.com/articles/emet-testing.html
And one of 2014 http://www.offensive-security.com/vulndev/disarming-enhanced-mitigation-experience-toolkit-emet/
Does anybody know a APP for Android, iOS, WP8 or BB?
Just a small side note:
In regard to device security vs. rooting.
There are essentially 2 schools of thought. On the one side we have those who believe we should trust the device manufacturers experience and knowledge to keep malware out of AOS, and you phone from spilling your data when stolen, which also means keeping users from rooting their devices, simply because they know security better, than the average user. (I think @jcase may be one of those, but he'd have to answer for himself.) On the other hand we have people like me, who firmly believe that the best way to keep your device secure is by being rooted, since we cannot trust anyone, especially large companies who scream "TRUST US". For us, we own the device and everything it does, and that your phone should not be able to send a single photon of radiation, without your permission. Then at least we have the choice to provide our own security by Firewalls, open source baseband, and encrypted phone calls etc. So no, this is not part of the majority of phone owners. But we think it should be. So who's right? Well, we're both right of course. What we need is to be able to make this choice at the time of purchase, and independent of the device you like. To be able to choose if you have a fully open device that you can secure on your own or if you like one that is claimed as secure, but you will never be able to check or control on your own. But unfortunately, this is not possible in most circumstances.
I trust neither the ODMs, nor the custom roms. However I KNOW the average custom rom is just as if not MORE vulnerable than current stock roms, add su into the mix and it is without a doubt more vulnerable. Show me a custom rom dev that claims he ships a secure firmware, and I'll show you someone ignorant of the facts. Ask most of them what CTS is, and they will look at you like you are referencing 18th century medical terms.
That is my stance. In regards to root making a device more vulnerable, I can back that statement time and time again. From key compromises of the superuser apps, to vulnerabilities in the app, to vulns in the su binaries, to vulns in apps that typical make su requests, to stupid users who will grant it to anyone. Having any access point to "root" makes turning a small vuln to a complete compromise relatively easy.
E:V:A said:
Just a small side note:
In regard to device security vs. rooting.
There are essentially 2 schools of thought. On the one side we have those who believe we should trust the device manufacturers experience and knowledge to keep malware out of AOS, and you phone from spilling your data when stolen, which also means keeping users from rooting their devices, simply because they know security better, than the average user. (I think @jcase may be one of those, but he'd have to answer for himself.) On the other hand we have people like me, who firmly believe that the best way to keep your device secure is by being rooted, since we cannot trust anyone, especially large companies who scream "TRUST US". For us, we own the device and everything it does, and that your phone should not be able to send a single photon of radiation, without your permission. Then at least we have the choice to provide our own security by Firewalls, open source baseband, and encrypted phone calls etc. So no, this is not part of the majority of phone owners. But we think it should be. So who's right? Well, we're both right of course. What we need is to be able to make this choice at the time of purchase, and independent of the device you like. To be able to choose if you have a fully open device that you can secure on your own or if you like one that is claimed as secure, but you will never be able to check or control on your own. But unfortunately, this is not possible in most circumstances.
Click to expand...
Click to collapse
@jcase : So I think we agree on that what you say, but from another perspective, we can ask ourselves whether or not a stupid user with root, can possibly endanger a smart user with root? I think this is not generally possible, apart from some automated DDOS attack, which would ultimately originate from a smart user with root, using the stupid user as a transport.
To what extent should ODM's be able to decide who is a smart root user and stupid root user? (And regardless their decision, why should we believe them?) There may not be an answer here, but the discussion is interesting also from a political point of view. How much should the "government" be responsible for a certain individual's action, regardless of their intelligence? Personally I think they're not, and should only provide security to prevent individuals from directly hurting each other, and not preventing them from hurting themselves, if they choose to do so.
Reading all this, it makes me wonder if the antivirus apps help at all..
stefeman said:
Reading all this, it makes me wonder if the antivirus apps help at all..
Click to expand...
Click to collapse
Let's put it this way.
In 6 years of heavy 24/7 PC use, my anti-virus have prevented me from a "possible" remote exploit exactly once, while having annoyed me with lengthy uninterruptible scans and ignoring my ignore settings about a 1000 times, due to adware and various other false positives. Then only god knows how many different countries governments are already present in my PC. Go figure. And yes, I have tweaked every possible setting and tried multiple well know AV's.
Forget AV's and get a good FW and with a well tuned host file, and well tuned common sense.
E:V:A said:
@jcase : So I think we agree on that what you say, but from another perspective, we can ask ourselves whether or not a stupid user with root, can possibly endanger a smart user with root? I think this is not generally possible, apart from some automated DDOS attack, which would ultimately originate from a smart user with root, using the stupid user as a transport.
To what extent should ODM's be able to decide who is a smart root user and stupid root user? (And regardless their decision, why should we believe them?) There may not be an answer here, but the discussion is interesting also from a political point of view. How much should the "government" be responsible for a certain individual's action, regardless of their intelligence? Personally I think they're not, and should only provide security to prevent individuals from directly hurting each other, and not preventing them from hurting themselves, if they choose to do so.
Click to expand...
Click to collapse
Really, I dont want to do this again, this conversation.
Most stupid people don't realize they are stupid, they assume they are smart. (We are all stupid in some regards).
I think I could endanger a user from root, pretty sure I can either screw the phone up, or possibly catch it on fire. If it had a sim in it, and was on the network I am certain I could make them regret ever rooting their device.
Here is a question, how many of you understand how these unlocks/exploits work?
I sometimes leave messages hidden in mine, and have only had ONE person reply to the hidden message, out of 100,000s of runs. People don't even know what they are running to gain root, let alone any idea what these "rom devs" do.
Open source is the answer right? Everyone can read the code, and everyone does! Thats why no backdoors or vulns have ever been in open source projects. Every open source project gets a line by line audit by a team of security professionals.</sarcasm>
I'll join back in when someone shows me a custom rom/open device that has the same or better security precautions taken by leading ODMs. Until then, it is generally just as easy or (generally) easier to abuse and exploit one of these custom roms floating around.
stefeman said:
Reading all this, it makes me wonder if the antivirus apps help at all..
Click to expand...
Click to collapse
Won't help a lick for anything originating from a government.