Related
I think everybody is well aware of the pain that software thieves like DavinciDevelopers and Chris Burchett is putting us through. Until Google cleans up their market policy and starts implementing some basic regulation, these robbers are going to continue stomping upon the intellectual property of the developers here.
As we all know, software thieves almost always exploit a very simple loophole: they delete signatures off the apks and then publish them to the Android market as a paid app under a different name, and everyone will be none the wiser. They make a quick buck from unsuspecting users who chance across the app and purchase it, and thus they profit off the labours of hardworking developers here. It matters little to them whether a thousand or a million users pass by their application page without choosing to install it, because every single user conned into paying for the app is a profit to them.
I strongly recommend that developers who publish their APKs here insert a pop-up into their application that appears on the first boot, stating very clearly that this app is freely published here (insert thread URL) and instructing the user to immediately seek a refund if he has paid for it, and to report the issue to Google.
In other words, probably something along the lines of:
PLEASE TAKE NOTE
This app has been freely published on XDA-Developers, and can be found at .
If you have paid for this app, PLEASE SEEK A REFUND IMMEDIATELY AND REPORT THE SELLER TO GOOGLE.
Click to expand...
Click to collapse
Additionally, you might also want to insert this in the "About" section of the app, if applicable.
Software thieves may be capable of deleting signatures, but they can't remove app elements. With users alerted to these dishonest actions, they will not only distrust them but send a flood of complaints pouring into Google, and sooner or later they'll have to pack up shop and think of actually doing something productive for society.
I'm sorry if this has already been suggested, but given the severity of this issue, I thought that it would be important to highlight this to all developers in here and out there. Not everyone may be aware of the dangers making the dive into application development, and fewer still might actually think of doing something about software pirates and intellectual property thieves.
Remember, this is only a short-term measure to help starve these software thieves of their ill-gotten gains (and perhaps also to create awareness for you and your thread). It does not preclude the usage of other anti-piracy measures, and it could be circumvented by the more tech-savvy of the thieves. In the long haul, we will still need to get Google to overhaul its Android Market policy to respect the intellectual property rights of developers.
Mods, please feel free to delete this or lock this thread if I am repeating what others have already proposed.
Madrenergic said:
Software thieves may be capable of deleting signatures, but they can't remove app elements. With users alerted to these dishonest actions, they will not only distrust them but send a flood of complaints pouring into Google, and sooner or later they'll have to pack up shop and think of actually doing something productive for society.
Click to expand...
Click to collapse
Just wanted to point out that this is not true. I've also seen people say that the package name cannot be changed. That's not true either.
A skilled developer could often easily delete app elements (Using obfuscation like proguard is a good deterrent). A crappy one might still manage, pirates do (Sure they'll add bugs in the process, but they don't care because they don't have to deal with the bug reports, you do).
A non-malicious example of hacking the internals of an app is how I enable long-press of Search on the Droid X/2 in my HomeSmack app (https://market.android.com/details?id=com.teslacoilsw.homesmack). Motorola hard-coded long-press of search to launch com.google.android.voicesearch/com.google.android.voicesearch.RecognitionActivity. So my solution replaces Google's VoiceSearch.apk with a modified one where I renamed Google's RecognitionActivity to RecognitionActivityReal and created my own RecognitionActivity. I kept RecognitionActivityReal functional so VoiceSearch can still be used.
It'd also be possible for the theifs to upload using your app signature. The disadvantage of course is that they can't modify it at all, even in the future.
Introduction
I have not seen much talk about security in XDA, and not at all on Neo Section.
SO here's just one informative link talking about using and developing apps and security risks involved
http://www.technologyreview.com/computing/25921/?mod=related
Any bug in software could potentially be used as a security loophole to gain access to private information, spy on you, get your credit card info(should you do such things on phone).
What is kind of unsettling is that everyone seems fine with modding, tweaking, developing and using those ROMs made in XDA without worrying if there could be that kind of bug in your made or used ROM.
You don't need a malicious app only to have risks. Most people use Windows so they should know that it is OP systems bugs and vulnerabilities that allow for unwanted access to your files, data, etc.
Android itself is having very non-foolproof security system. All apps on unrooted phone are in sandbox. That's no security measure at all. It doesn't limit app from stealing your private info at all, it only cant delete the whole ROM. That's just idiotic security system, for it is the only thing beside encrypting shut off phone on 3.0 and 4.0. So that means Android on it's own has no security measures while it's working. Even Windows has... some... but not too much... so you could pay for antivirus and antispyware software ofc.
It has always been the goal of big corporations to make money from insecurity, be they software developers, arms dealers and you name it. They all benefit from insecurities existing. Same is with Google and it's Android. But the good news is that we the users can modify Android. We could all say "Au revoir security bugs and loopholes!" if we would care about developing ROMs designed to make Android more secure... alas that's not happening yet!
Overview of Linux/Android security issues.
It's a short condensed description just to get you interested in the topic. There's lots of material on net, you only need to search, read, watch videos.
Linux becomes more vulnerable with more applications with different permissions installed. Same is true for Android.
Say your Phone Exporer has root access, that means it has root access to whole Android. To remove unnecessary risks, this app's root access should be limited to only most necessary functions it needs to operate.
Currently for Android there is no such solution. For Linux there is Apparmor.
http://en.wikipedia.org/wiki/AppArmor
Total root access is obvious vulnerability, but it is at least known one. Let's look at possibility of apps having hidden permissions and what that could mean to you.
Blade Buddy from Market.
On market it does not list permission to "Unique Device ID"(IMEI for GSM and MEID; ESN for CDMA) for free nor for paid version.
That means the author of BB has left the code from free version in paid one. This permission is used by ads to track you. It's not necessary code for ads, but it helps the dev know who clicked on the add and generated him some money. To see your money generating zombie empire stretch across the whole globe.... quite a thrill, isn't it?
So it's a latent code, with no benefit to user and an exploit only calling to be abused.
Unique Device ID allows you to be tracked on net and also where you are physically. GPS is just one way to find you, police for example have scanners to locate your devices physical location by the IMEI code. You can count on the "bad guys" having this technology as well, for it's quite a tool for burglars and other criminals.
The risks of your home being marked as the next dungeon to be looted by some raiders, I mean criminals(or perhaps WoW players sleepwalking and sleepraiding?) or getting your ID and bank details stolen by trojan/hacker is random. Yet the threat would not exist without apps having so flagrant hidden permissions.
Next app with ludicrous permissions
Brightest Flashlight
It does list many permissions, among them "Hardware controls - take pictures and videos ". No, it does not need a permission to take photos through cameras to operate the flashlight. But it's fun nonetheless for the dev to see his trusty peasants, or maybe he just likes to observe people like some watch fish in aquarium or hamsters in cage( "Look at that dork!", "You're one ugly m...f...er","ummm a couple kissing in dark with ma flashlight, what are they searching?", "what's that you eat, mr Korean, brains?" "hey show me that document again.")
You don't even need to run the app yourself. It can be triggered by hacker on background and take a snapshot of you.
On top of this little needless permission it has following hidden permissions:
1. Unique IMSI, read about here http://en.wikipedia.org/wiki/IMSI
2. MCC+MNC (CDMA)
3. Unique Devide ID
4. Cell Tower Name.
That's a lot of needless permissions for flashlight, these are there just to track you the app user and have nothing to do with your comfortable use of the app.
These are just 2 apps with totally needless permissions for their intended functioning. If you don't want your Windows and Linux have such security holes then why do you want your Android have them?! You don't want, that's the point and these apps would not be so popular if people would really know and care about their phone being secure.
It can be stated for sure that above exemplified permissions not listed on market are more useful for pranksters, criminals or someone plainly looking-down-on-all-the-dumb-sheep and not at all for any legitimate, user or customer friendly purposes.
There are very few tools to check for security and privacy problems in apps. That gives a sense that majority of devs do not want Android to be secure and private, because Android is another revenue generating platform through Google ads business of course. Were people more educated about the matter then Google ads business would shrink down as well. A private and secure Android can't be tracked or annoyed with ads. No ads, no profit. No security therefore means profit. Unfortunately this lack of security can be exploited by anyone with criminal or malignant intentions so very easily.
The most important thing is to read the permissions before installing.
If you had read the article I linked. Those permissions don't matter anything really if stuff developers use doesn't reveal what it does, or developer itself doesn't disclose what the app does.
We can safely say that those permissions asked are just to make ordinary users of Android think that all is under their control.
I use Privacy Blocker app and it keeps finding app permissions that are not listed. Even that app doesn't find those permissions which Cyanogenmod permission manager shows. And I've sanitized all my apps, still I find my phone connecting to some odd servers while using certain paid and seemingly legit apps. I even found shapshots from front camera made by some app... and I am checking all permissions I can, even for those not listed.
What seems harmless but could reveal your IP address and potentially other data about you is... advertisements used by apps.
Ads can be far more than just a little annoyance that slows your device. Any file, picture loaded from some location in internet can be used to locate you.
I had a problem of getting phone call bills for calls lasting 10 to 20 secs that I never made after using a slew of market apps, flashlights, fun stuff, etc.
I paid two months for such calls trying to find out which app did it and still don't know which one it was. Skype(phone app has fake IP of Holland but actual connection goes to Moscow... oh come one what is this? Why such hiding? Like anyone would trust their phone's Skype connection stream through Moscow... no thank you! Then wonder still if the phone gets so slow and Skype call quality is so bad even over wifi while Windows Skype does just fine?), Brighest flashlight, some photo editors, and slew of other garbage I've already forgotten about cause I don't use any of it anymore.
First post updated
How about the new 4.3 update..in includes some security and privacy control..will this thing prevent you had mentioned?
Is there any way to reactivate this post? maybe start working on a security enhanced android ROM? I'm agree, Security does matter!
I wrote this On Xperia Neo General forum but it belongs to here much more.
Original thread at: http://forum.xda-developers.com/showthread.php?t=1447095
Click to expand...
Click to collapse
Introduction
I have not seen much talk about security in XDA.
First, here's just one informative link talking about using and developing apps and security risks involved.
http://www.technologyreview.com/comp...1/?mod=related
Any bug in software could potentially be used as a security loophole to gain access to private information, spy on you, get your credit card info(should you do such things on phone).
What is kind of unsettling is that everyone seems fine with modding, tweaking, developing and using those ROMs made in XDA without worrying if there could be that kind of bug in your made or used ROM.
You don't need a malicious app only to have risks. Most people use Windows so they should know that it is OP systems bugs and vulnerabilities that allow for unwanted access to your files, data, etc.
Android itself is having very non-foolproof security system. All apps on unrooted phone are in sandbox. That's no security measure at all. It doesn't limit app from stealing your private info at all, it only cant delete the whole ROM. That's just idiotic security system, for it is the only thing beside encrypting shut off phone on 3.0 and 4.0. So that means Android on it's own has no security measures while it's working. Even Windows has... some... but not too much... so you could pay for antivirus and antispyware software ofc.
It has always been the goal of big corporations to make money from insecurity, be they software developers, arms dealers and you name it. They all benefit from insecurities existing. Same is with Google and it's Android. But the good news is that we the users can modify Android. We could all say "Au revoir security bugs and loopholes!" if we would care about developing ROMs designed to make Android more secure... alas that's not happening yet!
Overview of Linux/Android security issues.
It's a short condensed description just to get you interested in the topic. There's lots of material on net, you only need to search, read, watch videos.
Linux becomes more vulnerable with more applications with different permissions installed. Same is true for Android.
Say your Phone Exporer has root access, that means it has root access to whole Android. To remove unnecessary risks, this app's root access should be limited to only most necessary functions it needs to operate.
Currently for Android there is no such solution. For Linux there is Apparmor.
http://en.wikipedia.org/wiki/AppArmor
Total root access is obvious vulnerability, but it is at least known one. Let's look at possibility of apps having hidden permissions and what that could mean to you.
Blade Buddy from Market.
On market it does not list permission to "Unique Device ID"(IMEI for GSM and MEID; ESN for CDMA) for free nor for paid version.
That means the author of BB has left the code from free version in paid one. This permission is used by ads to track you. It's not necessary code for ads, but it helps the dev know who clicked on the add and generated him some money. To see your money generating zombie empire stretch across the whole globe.... quite a thrill, isn't it?
So it's a latent code, with no benefit to user and an exploit only calling to be abused.
Unique Device ID allows you to be tracked on net and also where you are physically. GPS is just one way to find you, police for example have scanners to locate your devices physical location by the IMEI code. You can count on the "bad guys" having this technology as well, for it's quite a tool for burglars and other criminals.
The risks of your home being marked as the next dungeon to be looted by some raiders, I mean criminals(or perhaps WoW players sleepwalking and sleepraiding?) or getting your ID and bank details stolen by trojan/hacker is random. Yet the threat would not exist without apps having so flagrant hidden permissions.
Next app with ludicrous permissions
Brightest Flashlight
It does list many permissions, among them "Hardware controls - take pictures and videos ". No, it does not need a permission to take photos through cameras to operate the flashlight. But it's fun nonetheless for the dev to see his trusty peasants, or maybe he just likes to observe people like some watch fish in aquarium or hamsters in cage( "Look at that dork!", "You're one ugly m...f...er","ummm a couple kissing in dark with ma flashlight, what are they searching?", "what's that you eat, mr Korean, brains?" "hey show me that document again.")
You don't even need to run the app yourself. It can be triggered by hacker on background and take a snapshot of you.
On top of this little needless permission it has following hidden permissions:
1. Unique IMSI, read about here http://en.wikipedia.org/wiki/IMSI
2. MCC+MNC (CDMA)
3. Unique Devide ID
4. Cell Tower Name.
That's a lot of needless permissions for flashlight, these are there just to track you the app user and have nothing to do with your comfortable use of the app.
These are just 2 apps with totally needless permissions for their intended functioning. If you don't want your Windows and Linux have such security holes then why do you want your Android have them?! You don't want, that's the point and these apps would not be so popular if people would really know and care about their phone being secure.
It can be stated for sure that above exemplified permissions not listed on market are more useful for pranksters, criminals or someone plainly looking-down-on-all-the-dumb-sheep and not at all for any legitimate, user or customer friendly purposes.
There are very few tools to check for security and privacy problems in apps. That gives a sense that majority of devs do not want Android to be secure and private, because Android is another revenue generating platform through Google ads business of course. Were people more educated about the matter then Google ads business would shrink down as well. A private and secure Android can't be tracked or annoyed with ads. No ads, no profit. No security therefore means profit. Unfortunately this lack of security can be exploited by anyone with criminal or malignant intentions so very easily.
In my honest opinion. If someone keeps files like ccinfo they have to worry about being jacked then they deserve it. Should it happen. U shouldn't keep things on your phoney don't want the rest if the world to have
Sent from my Cyanocrack using Xparent Blue Tapatalk
You don't need to keep credit card info on phone, your using the credit card via Market or logging in to bank on phones browser is enough to intercept your credit card info. Your browser may show you xxxxxxxxxxxx+"last four digits only" but that doesn't mean the data to and from your device doesn't contain exact credit card number. It's encrypted, but that is merely a minor inconvenience for a hacker.
That is why being rooted is not advised to everyone. Mainly if they don't know what they are doing. Also customs roms are not for everyone. People flash them cause they think its cool and don't understand what they are doing. That is their problem. People should pay attention to the permissions that am app asks for. Common sense is the best protection. Main reason I don't do anything that deals with a bank on my phone.
Raoa said:
I have not seen much talk about security in XDA.
Click to expand...
Click to collapse
There's talk. It's just not on important yet, because the android device is not being marketed like an OS is with a personal computer.
However, the more we do on our phones, the more we'll realize it needs protection like firewalls. We catch a few like CIQ or the Wimax exploit, but it's going to get worse as we advance in our integration. We do need to start now before exploits get worse and stay ahead of the curve.
Until that time, 4G exploits and root kit programs will run freely on our devices that houses a lot of our personal information.
Plus, for some stupid reason, there are a lot of people who think Linux is immuned to viruses and security holes due to it's code transparency. Android is being mainstreamed. It will soon be a continuous target like other existing popular software programs and operating systems.
And that's why iOS is far superior even without widgets or live wallpapers.
Something to think about.thanks for posting.
Sent from my HTC Glacier using XDA App
alex2792 said:
And that's why iOS is far superior even without widgets or live wallpapers.
Click to expand...
Click to collapse
IOS and Mac are just as vulnerable, maybe even more so because of there popularity and the misconception that IOS is secure and does not need AntiVirus protection. Just last week i removed a nasty virus on a brand new Macbook Pro so that is not the way to think. You need to act as if there are security issues and just be really careful at what link you click and what email you open.
mattfox27 said:
IOS and Mac are just as vulnerable, maybe even more so because of there popularity and the misconception that IOS is secure and does not need AntiVirus protection. Just last week i removed a nasty virus on a brand new Macbook Pro so that is not the way to think. You need to act as if there are security issues and just be really careful at what link you click and what email you open.
Click to expand...
Click to collapse
I'll give you OS X,but I've never heard of an iPhone virus while there are loads of malware on Android market.
Sent from my Galaxy Nexus using Tapatalk
I am not an expert on iOS nor do I have any wish to even know or use it, because Apple buys from suppliers that emply child labor and sweatshops.
When Linux started spreading around people also thought it has no viruses.
Same story repeats with every software.
For each different OS it takes merely time before people start to notice that their OS has viruses/trojans/spyware too. That doesn't mean their OS is not targeted. You should expect all sorts of thieves to use any and all opportunities.
Secondly OS does not matter so much as the matter that your device is connected to wifi, data, bluetooth, et or not. IP addresses, MAC, IMEI, etc they all stay the same on every platform. No matter which OS, they all connect to wireless networks, cell network, data, bluetooth, etc which all have set standards.
So someone wanting to track, spy, get your private info simply has to intercept the data your device sends to any network. If you don't use strong encryption to send info via network then it is easy to "wiretap" you.
Why is there so much spam, viruses, spyware in internet today? It's because the software managing internet is not made to be so secure. If it were secure then it would also be more private and safer for people to chat over net.
So not only OS's need to be more secure, but the very internet itself needs to be reformed.
This relates to SOPA and PIPA. Had those two bills been passed the next step would have been logically to make changes to all networks so you'd be more easily trackable, hackable, "wiretappable". It's simply logical, cause SOPA, PIPA were so defunctly worded as if asking/preparing for a third bill to regulate the networks.
So we must make sure that internet will be reformed for the private users and not for greedy corporations. We would not need to buy anti-spyware, anti-virus software if the internet were truly engineered for the welfare of humanity.
You could use any OS, bugged or not and not be afraid of loosing your property or privacy if the internet would stop such acts before they could harm you, the individual who is supposed to truly and freely benefit from the services; either for free or for honest price, but now you are robbed and think it is good to pay the thieves.
Raoa said:
Android itself is having very non-foolproof security system. All apps on unrooted phone are in sandbox. That's no security measure at all. It doesn't limit app from stealing your private info at all, it only cant delete the whole ROM.
Click to expand...
Click to collapse
Please elaborate. The sandbox does prevent one app from reading the data of another, such as the CC info from the Market.
Also, are you sure Market sends the entire CC number? There's no reason for it to send it, the transaction is performed on Google's servers.
alex2792 said:
I'll give you OS X,but I've never heard of an iPhone virus while there are loads of malware on Android market.
Click to expand...
Click to collapse
Are you talking about viruses or malware? Please don't conflate the two.
Malware is easy to take care of - check the apps you're downloading for what permissions they want. It's as simple as that.
alex2792 said:
I'll give you OS X,but I've never heard of an iPhone virus while there are loads of malware on Android market.
Sent from my Galaxy Nexus using Tapatalk
Click to expand...
Click to collapse
Just before xmas an iphone developer admitted to deliberately uploading malware in his ios app to show malware can easily affect iphone.
http://m.intomobile.com/2011/11/08/security-expert-sneaks-malware-into-iphone-app-store/
That was for normal iphones. For jailbroken ones there are more malware apps.
Dave
Sent from my LG P920 using Tapatalk
Raoa, your absolutely right.
I've had the exact same thought recently
Its like the overall view of the Android landscape is ridden from real security apps, for the simple purpose of have the platform as open as possible. And while this is good for developers and users of this and other serious forums, its also open for the "dark" communities as well.
I often ask myself, if the ROM devs onboard have these thoughts themselves, as in, what is my source of this modded apk, is is straight from the Market or from another dubious, (do I dare say chinese forum, just an example)
And how clean is my code really?
And is all mods just legit just cuz they are from here?
I love that we have so many ppl having a desire to mess around with the OS, but I miss, as you say, the talk about having a go on security as well.
I dont know, but I do think that awareness, as you initial post direct us to, should be raised, as a natural step for any serious dev and users in general on XDA, to be more aware, of the code.
Im on my first year as an Android user, and ofcourse did have to gain root on my splendid Sensation. Why?, cuz I needed the security tools requiring root.
Ask again, why? Cuz I came from Winblows 7, and know what a jungle software is, and that is is indeed exploitable, like hell, you might say.
And Im gladd I did gain s-off and root, cuz its really really needed fo youre just a little concerned about your privacy in, mails, sms, location, usage pattern, netbanking, dropobox deposits of your ****, some might even be work related and therefore hold more than just your own privacy.
And then there is what you mentioned, our devices unique ID's, the intent "app install referrer" to "plug" you into admob/google analyzer and so on.
I love one guy here, Treve, who made the HTC tool for scanning for ****, Logging Test Tool, and in version 10, he made it aware of admob/mobclix/analytics, and my god it find a lot...
So Treve, please, if you read this, just go on, as every version you make is getting finer and finer.
We could learn from this guy, and others here that got more code-insight.
What we CAN do as a community at the very least, is to share our knowledge and tips for securing our phones.
HOST filtering, code scanning of apks and so on. using AV's and firewalls and so on.
Right from the start I noticed that Android is not a clean OS, nor is its app market, and I noticed this cuz I have another splendid little Linux system at hand, Smoothwall Express with url filtering and proxy enabled
and My god is Android and its aps LEAKING!
Have a look in your urlfilters on a standalone firewall the step after your wireless android phone, and watch how much **** is going on.
Well, I can tell you for a start that I have added atleast 100 new domains to my custom urlfilter, besides the casual downloadable HOST filters around the net, like the ones found in AdblockPlus and so on. But after android, heh, you need more than just advertising filtering, that much I can say.
Just as an example, like those you mentioned, I have one too, that I was made aware of by Avast on my phone tonight, that ChompSMS was being flagged as malware/trojan.
I thought, **** man, why this crap, Im quite fund of Chomp, really.
So I thought, no, imma let more that Avast on my phone have a go.
So I File Expert dump the full apk, and uploaded it for a scan on virustotal, just for the sake of it. And whatta'ya know, ClamAV, GData, Kaspersky, NOD32, and Sophos flagged it as that same Plankton.G variant as my on-phone Avast.
Great, I thought (sarkasm intended)
I thought a bit further and picked up APK Multi-Tool, had a decompile and a content-scan for just "http" in is readable code.
12 different domains is mentioned so far, and I didnt even poke in all of its xml's, just the smali's
I know android is by a far stretch advertising born, and ofcuz the app devs have a right to earn their money, no doubt about that, and I gladly pay for the good ****, like most ppl here believeably do, but.. 12 different .com's mentioned in its code is a no go for me.
I have earlier used Privacy Blocker, and Privacy Inspector from XEUDOXUS in the market, to make permission scanning, beside using LBE/HOST/Avast, and I like those two aps, the Inspector one is free but only can scan.
The paid Blocker can "repair" as a feature, but its not maintained enuff, so it often fails to make installable apks, so not really worth it for me anymore, but as a free too, it can tell you more about those permissions you mentioned.
But enuff said from me for now, lets just collect and share our tips and tricks, ALSO for security, not just developing ROM and mod's and hacks, as thou they are fine, if not to say, so cool and great, but, we need to be secure too.
Please do not polute the discussion with IOS vs Android and what not, cuz thats not the purpose of it, even thou it definitly concerns (g)A(r)pple products too.
Sincerely, Omnius
alex2792 said:
I'll give you OS X,but I've never heard of an iPhone virus while there are loads of malware on Android market.
Sent from my Galaxy Nexus using Tapatalk
Click to expand...
Click to collapse
Iphones can get viruses they come through SMS's and other sources not as bad as android apple keeps there market much more under control, but everything is vulnerable i work in a security team for a big corp and believe me nothing is safe.
Check these articles out i just found them on google.
I remember a while ago maybe a year or so there was a huge security hole in IOS5 and Mac waited a long time to tell the public and release a patch. The one major problem with Apple is when there are security threats they really try to keep it hush...Iphone's OS is tight but not totally secure. Its not viruses either its moslty just malware that charges you tons of money in texting i saw once an iphone that turned into a bot and at midnight it would dial a 900 number and just sit there all night at like $20 bucks a minunte then disconnect when it felt the phone move.
http://www.mactrast.com/2010/07/iphone-virus-discovered-be-vigilant-and-seek-advice/
http://techfragments.com/news/982/Software/Apple_iPhone_Virus_Spreads_By_SMS_Messages.html
I'm going to fanboy MIUI for a second.
When you install an app you are presented with a screen (separate from the market) that allows you to toggle all the permissions an app ask for between Allowed/Ask/Disabled.
More roms should adopt this.
NB: I haven't checked CM9 so it might be a CM9 feature that MIUI has polished or it might be native to MIUI.
weedy2887 said:
I'm going to fanboy MIUI for a second.
When you install an app you are presented with a screen (separate from the market) that allows you to toggle all the permissions an app ask for between Allowed/Ask/Disabled.
More roms should adopt this.
NB: I haven't checked CM9 so it might be a CM9 feature that MIUI has polished or it might be native to MIUI.
Click to expand...
Click to collapse
I wouldn't be so fast to praise MIUI.
weedy2887 said:
I'm going to fanboy MIUI for a second.
When you install an app you are presented with a screen (separate from the market) that allows you to toggle all the permissions an app ask for between Allowed/Ask/Disabled.
More roms should adopt this.
NB: I haven't checked CM9 so it might be a CM9 feature that MIUI has polished or it might be native to MIUI.
Click to expand...
Click to collapse
The problem is the "Average Joe" doesn't even look at those or doesn't know what they mean. I see so many viruses/malware/open security holes just because of user error its insane. Almost 90% of security breaches or problems originate from the end users not paying attention or just not knowing or caring. Also another thing i see so much when new clients call me with there servers melting down and all there banking info being stolen is they haven't installed any updates on there servers since they were set up 2-5 years ago. I worked for a large industrial supply company and all there servers running MS Server 2008 no updates had been installed and they were using AVG free on there main SQL server...INSANE LOL
Then theirs the users, "my computer was fine until my friend on facebook wanted my SS# and mothers maiden name and insisted i open his email attachment, now its acting weird what do you think is wrong?"
Brutal
what is the 4g exploit that you are talking about? And is it only with wimax or is lte part of it as well?
Oneiricl said:
Malware is easy to take care of - check the apps you're downloading for what permissions they want. It's as simple as that.
Click to expand...
Click to collapse
It's absolutely amazing that people are willing to put up with something so ridiculous.
Sent from my SGH-I897
Hi!
Tried finding the answer for this. both in Marketplace privacy terms, development guidelines etc. No luck other then very vague descriptions and guidelines.
So, hoping there might be som WP developers here, I'm wondering this:
Lets say I download and install a smart dialing app.
It has the permissions for Data services, Phone and Owner identity aswell as accessing the contacts.
Now, what stops this app from uploading all my contacts to unwanted destinations?
For example stealing information in purpose of spamming or marketing.
Is there any review of apps, behaviour or code when publishing to Marketplace?
Can I be as convinced that my privacy is respected by app developers?
All apps are reviewed (by real people, as well as by automated tools) before they are accepted to the marketplace. It's basically the same thing that Apple does, and although the list of what is and is not permitted varies a little, you can be sure that the kind of spyware you describe is firmly in the "not permitted" camp.
That said, mistakes can be made in reviewing, or things can be missed. Malware certainly could sneak past the Marketplace reviewers sometimes. Overall, though, it's rare.
Thanks for the reply! I suspected this and it's nice knowing that there are protections in place.
Of course, when one thinks twice, distribution of mal- and spyware through Marketplace would be very contraproductive to the plattform and harm it.
At the same time it would be nice finding some official info how this is enforced...
Hello guys, this is a small article cum question thread. After reading please give me your views.
When we buy a phone and we start with our gmail id.
They forcefully sync all data, even the gallery (picasa).
I mean why is Google entering in our life so much..
They have every single detail. Contact , location, whereabouts, preferences, taste, when we get up/ sleep...
Every single data is with Google.
Now Google glass... Its too much interference...
I feel like being spy by a person name Google. Prove me wrong, I will be glad.
Before Android, I had Nokia phone. I never felt being spy every time.
I have spend lots of money on my Android phone but im feeling insecured every moment.
Why Google force all to sync the data/ why Google wants to enter in everyon's life?
Are we purchasing Android phones for being monitored 24x7?
Let me know your views too..
Thank you.
Disclaimer:
I am not an apple fan. I have shared experience and beyond this I don't have intension to degrade the goodwill of gaint Google.
Supporting links for this thread
http://m.firstpost.com/tech/how-to-stop-googlefbspyingyou-220138.html?page=1
http://m.youtube.com/#/watch?v=imbkac40t38&desktop_uri=/watch?v=imbkac40t38
Endless....
We've all heard about the "big brother". Before the TV reality shows there was only books and stories about it, there were wars for power and world dominance. May be my words are too strong, but think about it - there are strong arguments in DBZo07's post, don't you think?
Google may be one of the reasons for the next World War. I am sure that there will be one - all of the major civilizations before us have disappeared for various reasons, most of them connected with war and the will of dominance. We will wipe ourselfs too or will become "human androids".
I think that we should think about what will be the next kind of terrorism? I doubt it will be for petrol, gold, money... it will be about information, communication, privacy - and Google are getting even more and more into our life, as DBZo07 have observed. It was only 8 years ago when for most of us smartphones were a joke and look now - hybrids, phonepads, padphones, tablets, docking stations, virtual HDD's (cloud storage)... Now can you leave without Viber, skype, facebook, gmail? No, you can't and if you could you will be searching for better replacements.
When you put all of the things it really seems too much. What if someone uses the information we share virtually each day? What if someone wants more than just money to share or store our information or to communicate with each other? Now they want our money, but tomorrow?
May be someone will want more from us tomorrow... may be we will start to sync our dreams for more efficient sleep time.
Or probably my arguments are nonsense and no one will let these thing happen. I hope so and I believe so - you should believe too
Yes it is bad, but just do like everybody disliking this state, deactivate all you can that allow google to "follow" you.
At the end, androïd is not linux, androïd is "google is watching you OS", so make all you can to hide yourself.
Maybe one day, we'll have a "pure" linux system for smartphones.
@mutha88 : that's what , we are forced to believe Google like God. Turning off auto sync may ease our mind. But still who knows about which data is being snatched with our data plan on all times in the very owned OS of Google. I still can appreciate Microsoft Windows, which is carring on from years after years still there is sense of personal private life being secured.
No doubt Google is an award winning innovative company but why getting personal to the extent of choking privacy.
On other hand, consumers are least concern about privacy now a days. Very trusted Microsoft is trying hard to penetrate phones and data stealer Google is having large pie of market share. It is we who made Google survive and in return we have loss of privacy.
@BombinBasta : yeah, but for development of any OS needs finance. Linux is free open source, hardly people donate. And Microsoft has enough money to carry on their development. Apple already charges too high for thier devices. Whereas Google... makes money from phones, market, various products and who knows what they make from every details of their users.
Seriously, as i heard from childgood that evil ends when they cross thier limits... will there be end of Google anyways!!! I wonder.
May be I'm wrong but their are no proper justifications from Google for interference.
Sent from my GT-I9082 using Tapatalk HD
u cant be free of data collection by google...
even if u never sync ur data and use internet on ur android(even if it a vanila AOSP android ) there is code in that to give the data to google.
in todays age of information technology....information/data is everything...WHO HOLDS THE DATA...HOLDS THE POWER TO RULE THE WORLD...
DBZo07 said:
@mutha88 : that's what , we are forced to believe Google like God. Turning off auto sync may ease our mind. But still who knows about which data is being snatched with our data plan on all times in the very owned OS of Google. I still can appreciate Microsoft Windows, which is carring on from years after years still there is sense of personal private life being secured.
No doubt Google is an award winning innovative company but why getting personal to the extent of choking privacy.
On other hand, consumers are least concern about privacy now a days. Very trusted Microsoft is trying hard to penetrate phones and data stealer Google is having large pie of market share. It is we who made Google survive and in return we have loss of privacy.
@BombinBasta : yeah, but for development of any OS needs finance. Linux is free open source, hardly people donate. And Microsoft has enough money to carry on their development. Apple already charges too high for thier devices. Whereas Google... makes money from phones, market, various products and who knows what they make from every details of their users.
Seriously, as i heard from childgood that evil ends when they cross thier limits... will there be end of Google anyways!!! I wonder.
May be I'm wrong but their are no proper justifications from Google for interference.
Sent from my GT-I9082 using Tapatalk HD
Click to expand...
Click to collapse
You act like Microsoft doesnt do the same thing. When ever you use any of their programs it is the same. Privacy is a moot point if you use the internet for anything. You would be amazed how many times your personal info is used. Use a Shopping card to get discounts? Tracked. Use a CC for anything? Tracked. Buy anything on line? Tracked. Use any social networks? Yup tracked again.
It is not just Google. If you trust MS so much then why not get a WP?
k2wl said:
u cant be free of data collection by google...
even if u never sync ur data and use internet on ur android(even if it a vanila AOSP android ) there is code in that to give the data to google.
in todays age of information technology....information/data is everything...WHO HOLDS THE DATA...HOLDS THE POWER TO RULE THE WORLD...
Click to expand...
Click to collapse
This information again shocking.. will there be a respect for privacy is a big question..
Is there any way that code being blocked ...
zelendel said:
You act like Microsoft doesnt do the same thing. When ever you use any of their programs it is the same. Privacy is a moot point if you use the internet for anything. You would be amazed how many times your personal info is used. Use a Shopping card to get discounts? Tracked. Use a CC for anything? Tracked. Buy anything on line? Tracked. Use any social networks? Yup tracked again.
It is not just Google. If you trust MS so much then why not get a WP?
Click to expand...
Click to collapse
My bad.. Microsoft still a good sided. I'm not promoting Microsoft but everybody have used Windows and this hunger for data wasn't found, maybe Microsoft is too smart to do silently but there is a chance that it may or may not be true. Google openly does all stealing I mean who is going to held them!! We the users are just watching being used all time.
When I took Android , i wasn't aware of Google's hunger for information..
In the end, everyone is happy without Google's justifications...
Sent from my GT-I9082 using Tapatalk HD
I would like to point out that you are under no compulsion to connect an android phone to a Google account. You only need to connect your account if you want to avail of their services such as Play Store, syncing contacts, etc. If you can do without them, then by all means you can disconnect your Google account.
Sent from my Nexus 10 using Tapatalk HD
sidthegreatest said:
I would like to point out that you are under no compulsion to connect an android phone to a Google account. You only need to connect your account if you want to avail of their services such as Play Store, syncing contacts, etc. If you can do without them, then by all means you can disconnect your Google account.
Sent from my Nexus 10 using Tapatalk HD
Click to expand...
Click to collapse
I completely agree...
As for me I don't like Google's spying so I uninstalled all their apps, including network location and Google framework service, and I use alternative apps for gtalk or Google play. And recently I even made a new email at Yahoo's. I know Yahoo spies as well, but since android is Google at least I don't put all my eggs in the same basket.
If like me you are very privacy concerned there are ways to cut the abusive permissions most apps use.
You need to be rooted, and then use apps like appsettings (in conjunction with xposer app), permissions denied, rom toolbox, greenify, privacy blocker, and the best (but unfortunately not available for all roms) : pdroid and its variants like open pdroid and the like.
For example, recently I downloaded the Yahoo app. Before to start using it I put it through privacy blocker and then changed the imei value and other nosy informations with fake values (thank you privacy blocker and respect to xeudoxus its developer). Then I opened appsettings and blocked other unwanted permissions (thank you rovo and tungstwenty, respect). Finally I started to use it, and when I'm done checking my mails I greenify (thank you oasisfeng and respect) the app to avoid background usage.
Of course when one does such things one doesn't get notifications as soon as a new message arrives, but as for me I don't care since I don't need, and don't want, to be connected and hence spied, 24 hours a day.
It's relatively easy to get rid of the spying, but of course you will loose 2-3 features.
It's up to you...
I did the same with my browsers (opera mini and dolphin), privacy blocker+ appsettings+greenify, and with Mozilla I use an add-on called self destructing cookies.
Another thing is that not only Google spies on us, actually everyone does.
Just have a look at the permissions used by your system (default) applications, it's insane moreover that when one blocks those abusive permissions the apps still work. Don't think that it would be any better with a custom room, it's exactly the same story with cyanogen mode or aosp or pa etc.
What I do is that I remove most system apps (keeping like 10 for my tab, and 20 something on my phone, which means that I uninstall over 100 system apps, exactly 160 on my tab's recent jb upgrade) and replace them with third party apps that are easier to control and whose permissions are easier to block. And of course I block everything I can, system and user apps alike.
One of these days when I have time I'll write a more precise guide on these matters...
unclefab said:
I completely agree...
As for me I don't like Google's spying so I uninstalled all their apps, including network location and Google framework service, and I use alternative apps for gtalk or Google play. And recently I even made a new email at Yahoo's. I know Yahoo spies as well, but since android is Google at least I don't put all my eggs in the same basket.
If like me you are very privacy concerned there are ways to cut the abusive permissions most apps use.
...........
One of these days when I have time I'll write a more precise guide on these matters...
Click to expand...
Click to collapse
Sir, this is what I wanted to know. Thank you very much for your valuable time and experience shared here. I know this is serious concern and people like us need a way to be have a sound sleep without virtual spies.
About permissions, Google chrome takes permission to use camera and mic without and command by user.. I mean why Google needs it...again another why...
Your reply was very helpful, thank you...
keep updated me here when you can...
Stay blessed..
DBZo07 said:
Sir, this is what I wanted to know. Thank you very much for your valuable time and experience shared here. I know this is serious concern and people like us need a way to be have a sound sleep without virtual spies.
About permissions, Google chrome takes permission to use camera and mic without and command by user.. I mean why Google needs it...again another why...
Your reply was very helpful, thank you...
keep updated me here when you can...
Stay blessed..
Click to expand...
Click to collapse
My pleasure, I'm happy if I could help you...
Google chrome is one of the worst browser when it comes to privacy. If you want to keep on using it try to block the unwanted permissions like camera and mike with appsettings. The problem is that sometimes apps crash after having their perms blocked, and in this case what I do is just uninstalling and looking for another one that does the same job, fortunately there is no shortage of apps on the web
If you can't manage to tame Google chrome just use Mozilla. It has some abusive perms as well but they can be disabled for sure (I use it). Not with appsettings though but with permissions denied (another privacy app, quite powerful but one has to use it with care).
Just get the apps I recommended in my first post (some are paid but they are well worth the money) and start playing with them, in no time you will regain your privacy.
And uninstall as many system apps as you can...
Good luck!
Oh, I nearly forgot! Read my post in the following link, it tells which apps are safe to remove for the galaxy grand:
http://forum.xda-developers.com/showthread.php?p=39395506
They anonymize all of the usage data as much as possible. If you don't like using Google services but still want to be able to download apps from the Play Store, go into Settings -> Accounts -> your Google account(s) -> uncheck all of the boxes for syncing various services.
Every company collects information on usage in order to better their products and find out how people are using them. They're not reading all of your emails (yes, their computers scan them to show you relevant text ads, but that's all) or coming to your house to film you while you're in the shower. You guys are overreacting. There is not one company who doesn't collect usage data. And if they don't, then they're doing it wrong, because they're developing their products and services blindly. Google is pretty clear about their data collection policies.
unclefab said:
My pleasure, I'm happy if I could help you...
Google chrome is one of the worst browser when it comes to privacy. If you want to keep on using it try to block the unwanted permissions like camera and mike with appsettings. The problem is that sometimes apps crash after having their perms blocked, and in this case what I do is just uninstalling and looking for another one that does the same job, fortunately there is no shortage of apps on the web
Click to expand...
Click to collapse
You do realize that Chrome has the Microphone permission so that it can hear you when you use voice search, among other things, right? Your computer browser can also access your webcam and microphone...
I care about privacy as well, but you guys are wearing tinfoil hats. Google does not care about you. They just want to know how to further develop their products.
Product F(RED) said:
You do realize that Chrome has the Microphone permission so that it can hear you when you use voice search, among other things, right? Your computer browser can also access your webcam and microphone...
I care about privacy as well, but you guys are wearing tinfoil hats. Google does not care about you. They just want to know how to further develop their products.
Click to expand...
Click to collapse
Of course I know that this perm is for the voice search, an app that I don't use either.
And I know that in 2013 it's not such a big deal if those big companies collect data about us, apart from spamming us with advs.
But I don't know how it will be in 10 our 20 years, and when I see the way our "democracies" go I rather understand now how to make myself invisible, better to prevent than to cure.
Imagine if Hitler had had this technology...
Those days are gone? I don't think so, the Yankees had Bush for eight years, the French had Sarkozy for five years, they were not modern Hitler but they were going in the same direction, cutting rough in the people's freedom.
They didn't go as far as Hitler but who knows what will happen in the next decades. I'm 44 and since the 90 ies I've seen a worrying drift towards less and less freedom, and it won't get any better for sure, it will only get worse.
Anyway, it's not only about this, it's about those apps using my data plan without asking, depleting my phone's battery and slowing my ram. If Google wants infos he has to pay for it, and I have to agree to sell him those infos.
Cuz my phone didn't come for free, I had to pay for it and I don't see why I should use my data plan to help big Google and co...
unclefab said:
Of course I know that this perm is for the voice search, an app that I don't use either.
And I know that in 2013 it's not such a big deal if those big companies collect data about us, apart from spamming us with advs.
But I don't know how it will be in 10 our 20 years, and when I see the way our "democracies" go I rather understand now how to make myself invisible, better to prevent than to cure.
Imagine if Hitler had had this technology...
Those days are gone? I don't think so, the Yankees had Bush for eight years, the French had Sarkozy for five years, they were not modern Hitler but they were going in the same direction, cutting rough in the people's freedom.
They didn't go as far as Hitler but who knows what will happen in the next decades. I'm 44 and since the 90 ies I've seen a worrying drift towards less and less freedom, and it won't get any better for sure, it will only get worse.
Anyway, it's not only about this, it's about those apps using my data plan without asking, depleting my phone's battery and slowing my ram. If Google wants infos he has to pay for it, and I have to agree to sell him those infos.
Cuz my phone didn't come for free, I had to pay for it and I don't see why I should use my data plan to help big Google and co...
Click to expand...
Click to collapse
It's more like, "by using the software on this phone, you agree to Google's data collection policies." Either create your own ROM that doesn't include the code, or don't use the phone. You could go to Apple and use an iPhone, but they do the same thing. Microsoft does the same thing with Windows Phone. Palm did the same with WebOS. Seriously, there's nowhere you can go where anonymous data isn't collected to develop products.
I am glad that there are few more people who take their privacy seriously and knowledgeable enough to know what happening inside phones.
I strongly believe that this topic needs mass exposure. Millions of innocent people don't know what's happening and the risks. Take this topic to social networks and spread. For my part I will post this thread link on Facebook, Twitter and WhatsApp.
I would also wish that some of our great developers would come forward and help in this matter.
Thanks for starting this thread.
I knew people will feel thus topic as paranoid. But that's preference.
No problem, speak against topic or support this topic, you will help other members have clear picture of what I want to say. After all critics have role to play too. So thanks to all.
@unclefab thank you for your comment which helped me get my words meaningful.
@silentvisitor that's what I had planned to get the topic wide exposure. Hope, there will be respect for privacy oneday.
Revolutionary changes are required and that can be just hoped.
The only hope I can see is that when the country itself recognises this as an issue than it can impact on world... more and more country joins the cause the stronger will be the impact.
These are just hopes and how future will play that God knows.
Sent from my GT-I9082 using Tapatalk HD
Product F(RED) said:
It's more like, "by using the software on this phone, you agree to Google's data collection policies." Either create your own ROM that doesn't include the code, or don't use the phone. You could go to Apple and use an iPhone, but they do the same thing. Microsoft does the same thing with Windows Phone. Palm did the same with WebOS. Seriously, there's nowhere you can go where anonymous data isn't collected to develop products.
Click to expand...
Click to collapse
Yep, true, and actually Apple is worse.
What I don't like, beside the fact that they hijack my connection, my battery and my ram (and I mean, not only Google but most apps), is that they create files about us. It's ok as long as we have a democracy but as I previously said I'm not very optimistic about democracy in the future, remember the infamous patriot act in the States...
For example, Google knows that mister uncle fab has a gmail account. It knows as well that uncle fab goes on this and that website and reads this or that page, buys this and that online, has this and that app on his phone, goes here or there (thank you GPS and Google now) and stops here or there, listens to this or that kind of music, watches this or that movie, takes this and that picture and so on.
Eventually they have a file about uncle fab, and know a lot about his life and his taste.
Suppose now that uncle fab is a commie and someone who disagrees with the invasion of Iraq and Afghanistan, and that he's a muslim who has traveled to some of the so called axe of evil countries (which I did by the way, that's why I take this example, but fear not for I'm no terrorist )
What would happen? If uncle fab lives in the States he may be in serious trouble and get invited to a nice all included stay in Guantanamo, eventhough he's not a terrorist.
Well that's just an example but seriously, what happens with all those files they gather about people? Not to mention facebook, you know what I mean, their data base is huge and includes pictures.
What will they do with those files in the event of the government turning fascist or half fascist?
I'm not a terrorist but I have some convictions and some ideas that would make me a bad guy for a fascist regime and that would bring me to jail.
Don't get me wrong, I'm not a bad guy
But, amongst others, I seriously dislike the State's foreign policy and sincerely think that the wars in Iraq and Afghanistan are crimes against mankind that should bring their authors (Bush and his friends) in front of the international court. I do think as well that endeavors like wikileaks are very good ones and that their informants shouldn't be trialled.
I do think other things as well, it's my right, but under the Bush administration I would have been called a bad American and if they had caught me I would have won a free stay in Guantanamo.
During the Mac Carthy area I would have been called a commie because of my anti capitalistic ideas and would have been sent to jail.
Etc, etc...
So eventhough I'm not a bad guy I rather stay as invisible as I can, no-one knows what will happen in the future but from my point of view it looks pretty grim to say the last.
Regarding your remark about building my own Rom I agree, it's on my list of to do things.
But let's see first how the Mozilla os goes, and if the devs behind the Linux on android project manage to make it work properly for a daily use.
At the end of the day it's a matter of choice as you said, if someone doesn't like Google one can uninstall its apps.
You know, I spent hours playing with the apps I mentioned in my previous posts and I can say that no app knows my imei or my location, and that the only apps I allowed to connect with the internet are my browsers and the Yahoo app whose abusive perms I blocked.
Of course the browsers know my ip but that's all they know and I don't care about it, and if one day I did then I would use a vpn app or tor/orbot.
So I don't see how anyone could squeeze any data from me...
Oh, I just found this on the forum, give it a read:
http://www.xda-developers.com/android/say-sayonara-to-the-play-store-part-1/
If you want privacy, go move to a rainforest in South America or something. Get rid of your phone, computer, internet connection, etc. What you guys are asking for is ridiculous. You want free products handed to you on a silver platter. These companies need something in return. At the very least, they need the information they collect to understand their userbase. I'm a marketing major and computer science minor. Really, I understand that privacy is pivotal to you guys, but you're demanding something pretty ridiculous. This is ANONYMOUS usage data.
Sent from my Galaxy Note 2
Product F(RED) said:
If you want privacy, go move to a rainforest in South America or something. Get rid of your phone, computer, internet connection, etc. What you guys are asking for is ridiculous. You want free products handed to you on a silver platter. These companies need something in return. At the very least, they need the information they collect to understand their userbase. I'm a marketing major and computer science minor. Really, I understand that privacy is pivotal to you guys, but you're demanding something pretty ridiculous. This is ANONYMOUS usage data.
Sent from my Galaxy Note 2
Click to expand...
Click to collapse
You sound very straight forward. Your comments are brainwashing. You have better way of critical thinking, its appreciable. As a marketing guy you know user have different preferences and taste.
Rarely people are concern about privacy which is not letting this being called as an issue.
Data is used anonymously, is this justified?
Even Facebook says this, than why it has photos and name in their database?
How come Facebook/Google recognize face with exact name if data is anonymous..
Can any of data stealers come forward and give just a short justification and proof about how data is being used?
Sent from my GT-I9082 using Tapatalk HD
As Fred as stated, everything you do is tracked and monitored. This is nothing new really, been going on for years. There is only one way around it. That is to remove yourself from all things as stated above. You would be amazed how many times your personal info changes hands on a daily basis. Even utility companies track your usage. Your cell carrier does the same thing. Now I understand wanting privacy but total privacy is a myth that in this day and age is not an option. Now I dont trust the Gov in any way shape or form, to the point of not buying any device that has the fema chip installed. Which is 99% of the devices in the US.