Re:How Facebook tracks you on Android [video]
by scarface74 on Sunday December 30, 2018 @06:03PM
(#18791866)
By having the app removed from the store. Which Apple is unable to do because it doesn't allow third party security researchers to scrutinize its app store. This resulted in the massive XCodeGhost infection, which Apple couldn't fully remove from their store for weeks after.
XCodeGhost was first found by Alibaba - a third party.
Re:How Facebook tracks you on Android [video]
by lern_too_spel on Sunday December 30, 2018 @11:04PM
(#18792923)
It was first found by Chinese developers who found it in their own apps. Neither they nor Ali Baba had any idea what other apps were affected. Ali Baba did some additional research to track down how the apps were infected. The malware was disclosed by Chinese iOS developers and analyzed by Alibaba researchers
A much better example is the massive XCodeGhost infection on the app store. Apple relies entirely on users for figuring out if things are misbehaving, while Android also has automated detection and the third party security ecosystem, as I pointed out in the comment you replied to.
> And even if “security researchers” do find an issue with an Android app, how does that information get disseminated to users?
By having the app removed from the store. Which Apple is unable to do because it doesn't allow third party security researchers to scrutinize its app store. This resulted in the massive XCodeGhost infection, which Apple couldn't fully remove from their store for weeks after.
> Even if Google decides to close the hole, Android doesn’t exactly have a great track record of getting updates to users.
The whole point is that it's not a hole. It's an app abusing an API. The correct thing to do is to simply remove the app from the store, which is exactly what happens.