Cloak and dagger – a new kind of attacks for Android

Re:Cloak and dagger – a new kind of attacks for Android by devinl on Wednesday May 24, 2017 @07:05PM (#14414136)

One thing that is kind of unique about this vulnerability is that users can actually prevent attacks from happening by checking the permissions on an untrustworthy app because google has permissions controls built in for the features that are being abused here.

The heart of this vulnerability is more in that these settings aren't clear on their implications and there are bad defaults. Disclosing to users seems to be a responsible thing to do since users can prevent an attack on their own device (especially given google's response of "working as intended").

[ Parent | on HN ]

Re:Cloak and dagger – a new kind of attacks for Android by etjossem on Wednesday May 24, 2017 @07:08PM (#14414151)

This is insightful, thanks. In this specific case, you're absolutely right that users themselves can take steps to mitigate the risk. If users come to understand the real meaning of granting permissions as a result of this disclosure, that's better for everyone.

Definitely a factor to take into account, particularly when deciding how the information will be publicized.

[ Parent | on HN ]