no list of apps anywhere
this post was submitted on 02 Jun 2024
464 points (100.0% liked)
Technology
69867 readers
2534 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
Jup. It just says that "the malware was disguised as PDF and QR code readers".
Not helpful, Mashable. Not helpful at all.
In fairness to Mashable, this isn't their fault. The people that made the report didn't make the list public.
Then why is this the subtitle:
The apps identified have since been removed from Google Play, but make sure you didn't install one.
Because tech journalism is trash on the best days, and these android malapps articles only ever amount to blogspam to make you nervous. I don't think I've seen more than a handful of these articles that actually warns you about the actual apps instead of just talking about the problem without relevant specifics.
load more comments
(1 replies)
These articles are useless without a damn list
Right
Am I just missing it, or is there no list of of these infected apps on the posted article or the reference the article links to. To me, that is the most important information.
It is about halfway down the article, but you have to dodge a few adds to get to that part.
"The two apps mentioned in the report were called "PDF Reader and File Manager" by Tsarka Watchfaces and "QR Reader and File Manager" by risovanul."
Well, I did miss that, I was skimming for something like a large list or table. That still leaves 86/90+ unlisted.
Agreed. If this article didn’t contain a way to check the apps, that would be irritating
Aren't apps on android hermetically sealed from other apps and malware. How could this be achieved ?
Since the other reply was unhelpful: apps are supposed to have limited privileges and isolation from each other, yes... But the whole point of malware like this is that they figure out ways to break those restrictions and get escalated privileged.
You can get more technical detail from reading the report, in this case it looks like the app does not contain malware, but instead requests an update after install that contains the bad code and then breaks the app limitations and scans for the target banking applications and copies the security certificates.
As a developer this question is hilarious to me
As a curious Android user this comment is useless to me
For a real answer here's the Zscaler blog write up: https://www.zscaler.com/blogs/security-research/technical-analysis-anatsa-campaigns-android-banking-malware-active-google
It looks like they are doing it after app install with a malicious patch. This patch asks for SMS and accessibility access to gain privileges necessary to get into the banking apps. I haven't thoroughly read it but just looking at the attack chain that's what I gleaned.
load more comments
(1 replies)
load more comments
(5 replies)
Why? They're absolutely right. The article doesn't say anything about a root exploit or phishing either so were left wondering...
load more comments
(1 replies)
please enlighten the rest of us
load more comments
(2 replies)
load more comments
(1 replies)
And this right here is why you use open source apps.
This only would work if you check every line of source code, even the dependencies and build chain, and then build it yourself. See xz utils backdoor or heartbleed, etc.
The thing is we only know about these vulnerabilities in such great detail because the projects are open source. God knows what kund of vulnerabilities are hidden in closed source software.
Yes, but we don't know what we don't know. There are many problems like that in open source too, and even if we can look nobody does.
Therefore I find it problematic to say that just because you use open source programs you're safe like the parent tried to.
Yes, important to keep in mind that software being open source doesn't automagically make it secure™.
Still, I think it's important to stress that the benefits of open source outweigh the risks when it comes to security (imho).
load more comments
(1 replies)
Exactly. Neckbeards love to pretend open source magically has no security vulnerabilities, and that the ability to inspect the source means you'll never install anything nefarious.
I expect all of them to have read the source for every single package they've ever installed. Oh and the Linux source too, of course
I have never seen anyone make that claim.
Lots of arguments saying it's an improvement, but never that it magically fixes everything.
Yes, opensource doesn't magically fix all vulnerabilities. But it is for sure way better then closed source, where you don't have a way of auditing the code
load more comments
(2 replies)
check every line ... yourself.
🚩🚩🚩
A very classic lie, disinformation, used to spread anti-libre software. Anti-libre software bans us, not only me but everyone else, from removing malicious source code.
Very disingenuous of you to fight a strawman and proclaim victory by claiming that I said things which I never did. But if that's what floats your boat. But for everyone else, try to find any mention of anti-libre software in the original claim.
load more comments
(3 replies)
Yes, of course. However, when it's open source, at least somebody is capable of checking those things, even if it is not you. Somebody in the community is capable of doing so.
Yes, that is true, but let's not pretend that just because some one is theoretically able to, that all source code is constantly monitored by 3rd parties.
load more comments
(2 replies)
load more comments
(2 replies)
load more comments
(6 replies)
As somebody who occasionally had to develop for android: the churn of improvements to app security was a huge pita. And as a user I know many of the abandoned apps that I liked that lost compatibility was for that reason.
So the fact that in spite of this pain, Android security still allows apps to do horrible crap like that is infuriating.
If you read the original report, it says that it basically just displays a fake banking login page. It also says that it requested accessibility service permissions, which makes me think maybe it brought up the fake login pages "in the right moment" (as in as users opened their banking apps) to make it more convincing, even though the article doesn't specify that.
Either way, IMO the problem here is clearly with the Play Store allowing this app in, and not with Android's security itself. These apps are misusing the accessibility service system, which is obviously necessary for a ton of important use cases (and of course also requires the user to grant very explicit permission). The fact that the accessibility services are a thing doesn't delegitimize Android's security improvements over the years.
load more comments
(2 replies)
The app doesn't contain malware when it's uploaded to the play store. It forced an update after it's installed that contains the malware.
That's not what I mean. I'm not thinking about Play Store security, but Android OS security. Like, your app physically has to ask for permission (or even require the user manually change settings) to do most unsafe things.
load more comments
(1 replies)
load more comments
(1 replies)
load more comments
(1 replies)
From the actual report:
"Over the past few months, we identified and analyzed more than 90 malicious applications uploaded to the Google Play store. These malware-infected applications have collectively garnered over 5.5 million installs.
Recently, we noticed an increase in instances of the Anatsa malware (a.k.a. TeaBot). "
So not 5.5M installs of this specific malware, FWIW
I got many apps installed. I don't keep in my memory what I have. How do I check that I don't have any from those compromised?
Go to Settings and search for Google Play Protect. Tap Scan, and if it results in No harmful apps found, you're safe.
AI probably "wrote" that
Hello EVERYONE here's a list of 50 unbelieveable products that will change your life and grant you immortality:
Anatsa uses advanced techniques to avoid >detection and gain access to banking >information.
Anyone who knows what those advanced techniques are?
I' recommend to just read the report https://www.zscaler.com/blogs/security-research/technical-analysis-anatsa-campaigns-android-banking-malware-active-google
view more: next ›