News for hackers. Stuff that matters.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by dan-0 on Thursday July 11, 2019 @01:02PM (#20413223)
This seems to be getting a lot of attention, so as an Android Engineer with some security and framework experience let me try to explain.

This is a side effect of Android's initial approach to it's open nature. Android allows a manufacturer to modify its framework for their own use case. Then the manufacturer can allow a specific carrier to input their own system applications and firmware on to the devices well (your bloatware etc).

This can lead to multiple firmware variants for a specific device. It's not uncommon to see over 20 variants of a firmware for a specific Samsung device for example. This can be broken down by carrier, by region, by OS, etc.. for a number of different reasons.

This becomes a problem when Android needs to post an update. That update has to be pushed first to the Android framework, then to the manufacturer who decides if they are going to make modifications for the update, and if the manufacturer decides to make an update, they push it to the carrier who then has to make an update themselves.

This leads to a web with many broken ends, where a specific phone on one carrier may never see an OS upgrade after purchase, but on another carrier, the same phone might get them regularly.

Additionally some manufacturers take a greater degree of liberty in modifying the Android framework, making updates significantly more expensive to implement, so they don't.

The good news is Google over the past couple of years has been making a great effort under Project Trebel to simplify some of the APIs in the Android framework. What this is leading to is less friction when it comes to implementing core updates. Unfortunately not all manufacturers have opted in to adhering to the standards and Project Trebel yet.

This is all in stark contrast to iOS, which doesn't have the restriction of dealing with multiple manufacturers, and makes it harder for carriers to customize the device for their own business cases. This makes security and updates easier to push, but on the cost to the user of being an expensive single stream walled garden. Nothing against iOS in the statement, as a flagship device they're very nice. However, they don't have the adaptability that Android allows, making them prohibitive in some markets.

Sorry for any grammar issues, I'm on my phone (a regularly updated Pixel 3).

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by cstejerean on Thursday July 11, 2019 @01:09PM (#20413286)
This is what I love about Apple. They gave the carriers a big middle finger when it comes to the usual bullshit of bloatware, sticking their logos on things or getting in the middle of updates. That’s because they cared about the end user experience. Google was happy to just grab market share at the expense of the users by allowing carriers to continue with their usual shenanigans. For this reason Apple will have my eternal gratitude, because I remember what a shitshow smartphones (and deploying apps for them) was before Apple flexed their muscles on this.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by michaelcampbell on Thursday July 11, 2019 @01:16PM (#20413369)
> That’s because they cared about the end user experience.

I'm sure 100% of any revenue going to Apple and not shared with anyone had nothing to do with that.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by enraged_camel on Thursday July 11, 2019 @01:26PM (#20413490)
It may have, but I doubt it was the primary motivation. Steve Jobs famously cared a lot about user experience, security and reliability. Remember that Apple under his leadership took a firm stance and loudly and publicly refused to allow Flash on its devices, despite the fact that many websites back then relied on Flash.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by avtar on Thursday July 11, 2019 @03:17PM (#20414632)
> Steve Jobs famously cared a lot about user experience, security and reliability. Remember that Apple under his leadership took a firm stance and loudly and publicly refused to allow Flash on its devices, despite the fact that many websites back then relied on Flash.

A less generous take on that would be that he/Apple also wanted to push their app store. At the time Flash was popular for publishing apps and games on the web. Yes their decision helped move everyone away from Flash but it also meant they would be getting their 30% cut from iOS apps.

Edit: I stand corrected. "While originally developing iPhone prior to its unveiling in 2007, Apple's then-CEO Steve Jobs did not intend to let third-party developers build native apps for iOS, instead directing them to make web applications for the Safari web browser." -- https://en.wikipedia.org/wiki/App_Store_(iOS)#iOS_SDK

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @05:05PM (#20415835)
You mean the same Flash that Adobe said they could have gotten to work on the original iPhone - with 128MB of RAM and a 400Mhz processor but barely worked on Android with minimum requirements of a 1Ghz processor and 1GB of RAM?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by avtar on Thursday July 11, 2019 @09:59PM (#20417496)
I wasn't claiming Flash was ideal in any sense -- just that it was popular back then.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by neotek on Thursday July 11, 2019 @11:23PM (#20417844)
>A less generous take on that would be that he/Apple also wanted to push their app store.

The App Store didn't exist at that time.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ninkendo on Thursday July 11, 2019 @03:26PM (#20414764)
The original iPhone didn't even have an app store...
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Despegar on Thursday July 11, 2019 @03:26PM (#20414758)
This is like saying that Apple can't collect 30% if you make your app in React Native rather than a purely native iOS app. It doesn't matter what technology you use, they're going to get 30% because they control the store.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by z3t4 on Thursday July 11, 2019 @02:25PM (#20414039)
Apple also planned to sandbox all apps. But developers wanted bare metal performance.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @05:07PM (#20415856)
Sandboxes apps has to do with the permissions not having “metal performance”. iOS apps compile down to ARM native code. Unlike most Android apps that run on top of a VM.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by weaksauce on Thursday July 11, 2019 @03:42PM (#20414997)
the anti-flash stance was mainly there because of the abysmal performance a flash app would have on the device and the device's battery life.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by enraged_camel on Thursday July 11, 2019 @04:51PM (#20415704)
Hence, user experience!
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by azernik on Friday July 12, 2019 @12:02AM (#20418023)
Don't make this about moral superiority of Apple over Google.

Apple did it because they could, because when the iPhone came out it owned the smartphone market; any carrier that didn't play ball would be frozen out (as T-Mobile was initially - AT&T's exclusivity on the iPhone really helped their market share among high-end consumers). Google did not have that luxury.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by filmgirlcw on Friday July 12, 2019 @01:15AM (#20418390)
That’s not an accurate representation of what happened.

When Apple/Steve Jobs went into negotiations with Verizon and AT&T (then known as Cingular), it didn’t have any leverage. In fact, Verizon wouldn’t sign the deal in part because of the control Steve Jobs wanted over the devices. AT&T agreed to get the exclusive.

BlackBerry was King when the iPhone launched and BlackBerry bent over backwards to do whatever the carrier wanted (the book Losing the Signal has great details on this).

Google could have depended on similar provisions with Verizon when the Droid launched in 2009 or with T-Mobile when the G1 launched in 2008. Both carriers wanted an iPhone killer.

But Google didn’t do that. It did force Verizon not to put Bing as the default search engine on some of Verizon’s Android phones (like the Droid series), despite an early 2009 agreement Verizon made to make Bing its default search engine — and it also negotiated to NOT force consumers to pay for Android apps using the carrier stores (something many carriers had required for previous non-Apple App Stores), once paid apps launched.

But it didn’t negotiate the update bit, even though the company had the leverage to do it.

I can only speculate the reasons why, but based on the number of books I’ve read, people I’ve talked to, and and other information, it strikes me that Google decided it was more advantageous to let any phone maker or carrier adopt its OS to gain marketshare, rather than worrying about device fragmentation or security update issues.

And that strategy worked beautifully and Android took over the world. The problem is getting carriers or device makers to update, especially when many have spent lots of time customizing Android as a way of differentiating themselves.

But it’s unfair to claim Google didn’t have the opportunity to make the deal Apple did. Google just didn’t want to do that and wasn’t willing to walk away from a partnership to have that level of control.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by davidgl on Friday July 12, 2019 @05:15AM (#20419363)
Is that because Android was a defensive move against ios to protect the search/advertising income, like Chrome, rather than something they make money from do you think ?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by filmgirlcw on Friday July 12, 2019 @10:51AM (#20421143)
Yes. (Although it was originally a defensive move against Windows Mobile and BlackBerry and Symbian and it then pivoted as soon as they saw the iPhone.)

The big draw for Android for OEMs was that unlike Windows Mobile or Symbian, there was no licensing fee for the devices. HTC, which made the first Android phone, was a Windows Mobile device maker (fun fact, the XDA from XDA Developers, was an OG Windows Mobile forum — XDA was the name of an early series of Windows Mobile devices) — Samsung and LG and Motorola made Windows Mobile phones, Sony used Symbian and so on. Android was free and customizable, which made it enticing for OEMs and carriers to embrace. And unlike BlackBerry, carriers didn’t have to give a portion of the data charge (which was like $20 or $40 a month per BlackBerry device) to BlackBerry, they got to keep all the data fees to themselves.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by codedokode on Thursday July 11, 2019 @03:26PM (#20414762)
But Apple software is proprietary, not friendly to open soure developers and you never know what that software is doing. Maybe they are streaming your data directly to "cloud" operated by NSA. Or iPhone doesn't upload anything to cloud?
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by w1nst0nsm1th on Thursday July 11, 2019 @04:00PM (#20415206)
Most of the function users care about in their phone, if not implemented by third party, are proprietary apps from google.

Without the app store and the google ecosystem, android experience is poor at best.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by darkpuma on Thursday July 11, 2019 @04:15PM (#20415351)
The Google ecosystem can drown in bleach for all I care. F-Droid is not bad at all. Downloading apps from the Google store is an awful experience because on that store it's the norm for damn near every application to spy on you to the fullest extent possible. On f-droid, applications the typical application is a good citizen. It's a lower stress experience and a better appstore than either Google or Apple, unless you desire specific closed source software in which case it's no longer an option.

Try this: On Google's Appstore, find a flashlight app that doesn't upload your contacts. Now on F-droid, try to find one that does. This is not an easy challenge!

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by wildduck on Thursday July 11, 2019 @07:30PM (#20416832)
Or we can also try this: https://www.replicant.us
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @05:02PM (#20415808)
And what makes Android what it is to most consumers - Google Play Services is also proprietary as well as all of the drivers. Not to mention whatever the OEMs and the carriers add.

Even if you have a completely “open” operating system on your phone, your communications is still going through a carrier that could be “operated by the NSA”.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by throwaway2048 on Thursday July 11, 2019 @04:09PM (#20415279)
All of the data collection functionality in Google Apps is closed source too.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Jerry2 on Thursday July 11, 2019 @07:09PM (#20416724)
Huawei incident has taught that Android is proprietary too. Any country that's at odds with the US will eventually find out that Android will be blocked to their companies too.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by NegativeLatency on Thursday July 11, 2019 @04:45PM (#20415652)
The Google Play Store and related APIs are similarly locked down. Not that you couldn't distribute through something like fdroid.

I take your point but android is similar in some respects (Google probably has less interest in your privacy than Apple does).

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by davidw on Thursday July 11, 2019 @03:28PM (#20414791)
Having a closed ecosystem has costs too, though, especially in terms of user freedom and choice.
[dead]
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by codebje on Thursday July 11, 2019 @06:19PM (#20416418)
I buy unlocked Nexus devices to avoid mftr and carrier bloatware and update delays.

Never again for a Samsung device, they churn through models absurdly quickly, delay updates for months, and shovel tons of crap on.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by navigatesol on Friday July 12, 2019 @06:29AM (#20419598)
>I buy unlocked Nexus devices to avoid mftr and carrier bloatware and update delays.

Exactly. There is a whole series of phones offering bloat-less Android, from a variety of manufacturers:

https://www.android.com/one/

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by snarf21 on Thursday July 11, 2019 @01:16PM (#20413368)
This is also solvable by Android taking a slightly different approach. Isolating the OS and security framework so that it can always just be updated. The carriers and and manufacturers are still free to install whatever bloatware they want and do what ever logo nonsense they want.

We ran into nonsense issues creating a cross platform development toolchain when HTC phones just didn't implement certain functions of the WebView. We were then stuck trying to create workarounds for no reason. Android could have been the best of both worlds but they just punted it and left their users holding the bag.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ansible on Thursday July 11, 2019 @08:54PM (#20417235)
> This is also solvable by Android taking a slightly different approach. Isolating the OS and security framework so that it can always just be updated.

I think that is the plan with Fuchsia.

The core of the OS is small. The drivers can be separated out more easily, and with a (hopefully) stable driver API, they may not need to get updated ever (baring security bugs in the driver code itself).

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by panpanna on Friday July 12, 2019 @03:42AM (#20418998)
Not to sound like a Google apologist, but all you ask is already in there.

And Google's extensive compatibility requirements aside, webview is now directly updated from the store.

Android Q will extend this to most system components via apex.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by dredmorbius on Thursday July 11, 2019 @06:31PM (#20416488)
As I've commented elsewhere on this thread: my 2015 purchased-new Android tablet has never to my knowledge seen a vendor OS update -- it's running 5.0.2, not even the most recent version at the time, as 5.1.1 was released over six months before the unit was sold.

None of this information was available to me at the time, and the 5.1.1 history I've only just learnt whilst composing this comment. I'd purchased the device under sharp time, budget, and information constraints whilst travelling. Budget and other limitations, as well as a market void of credible alternatives (Purism have my eye) have prevented replacement, though I loathe this device.

Google have considerable monopoly leverage, and yet have not used this to require obligations for (and permit forward use of) Android and related ecosystem services in the form of upgrade timeliness SLAs and minimum EoL requirements: this device was obsolete at time of sale, though I was completely unaware of this at the time. Instead Google have sought to perpetuate their own monopoly and interests:

https://www.theverge.com/2018/7/18/17580694/google-android-e...

It is also not capable of being re-ROMed, another fact of which I was unaware.

I'm beyond disgusted and will not and do not recommend Android to anyone.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by alexis_fr on Thursday July 11, 2019 @07:53PM (#20416966)
And up to version 6, Android was not disk-encrypted. If you lose a phone, they don’t need your pw, they can just take the SD card out and read it. All your stored passwords, all your stored cookies, they can read them all...

Never again will I ever trust Android anymore if they can’t even get the basics right.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @01:09PM (#20413293)
Sounds like an excuse for poor engineering on the part of Android. Microsoft also sells Windows to multiple OEMs and has done so for decades. OEMs also are free to add bloatware as well as the retailers (ie Best Buy adds its own bloat), but Microsoft doesn’t have this problem.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by blablabla123 on Thursday July 11, 2019 @03:00PM (#20414391)
Yeah but Windows was created for existing hardware, in fact at first even running on an existing OS. IBM PC compatibles were a thing since the 80s on which DOS flavour from various vendor were running which in turn ran on x86.

Microsoft actually waited really long until they combined normal end user Windows with NT which was it's own OS since early 90s but also had a lot of restrictions when it came to drivers, end user Apps, Games in particular.

Google bootstrapped it all at once, that's quite an effort. That said, some phones like those of OnePlus or FairPhone have really long support times.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @03:12PM (#20414559)
The whole idea behind WinHEC early on was that Microsoft was guiding hardware manufacturers to the plug and play standard.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by blablabla123 on Thursday July 11, 2019 @03:19PM (#20414657)
I guess in that sense Microsoft really did their homework. Apart from niche usage, good Hardware support seems everything for an OS...
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by diroussel on Thursday July 11, 2019 @01:52PM (#20413738)
It’s quite different as windows is closed source. The OEMs don’t build their own flavour of windows from source.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by MiddleEndian on Thursday July 11, 2019 @07:54PM (#20416967)
Seems like the open source-ness of Android is of little use. It helps manufacturers rather than users.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by scarface74 on Thursday July 11, 2019 @01:58PM (#20413776)
And almost everything that makes Android what it is outside of China is also closed source - Google Play Services and the drivers.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by rightbyte on Thursday July 11, 2019 @01:39PM (#20413598)
Ye. Patching system libs should be just pulling those as long as they are backwards compatible. Maybe some key parts that the OEMs fiddle with are not behind abstractions properly.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by jamespo on Thursday July 11, 2019 @01:12PM (#20413321)
probably cost you more money than you'd make writing malware for windows phones
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by ry4nolson on Thursday July 11, 2019 @03:03PM (#20414441)
no one is talking about windows phones. they're talking about windows.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by nradov on Thursday July 11, 2019 @05:44PM (#20416170)
That's just making excuses for poor software architecture without clearly defined layers and stable, documented APIs between them. MS Windows has a hardware abstraction layer. There's no reason Android couldn't have the same, except that it wasn't a priority.

Some of this is (or was) a fundamental design limitation of the Linux kernel. But there are other kernels.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by zaroth on Thursday July 11, 2019 @04:44PM (#20415648)
Arguably, it should not be legal to sell a device and not provide security updates for some guaranteed period of time, as a violation of the implied warranty for fitness for a particular use, or as an unfair or deceptive trade practice.

I wonder if the FTC has ever pushed this particular angle?

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by Marsymars on Thursday July 11, 2019 @07:31PM (#20416839)
That explains why we ended up in a bad place, but it's still an absurd situation.

From my perspective, Essential pushes a monthly security update for the PH-1 like clockwork. However, my carrier (Telus) delays it for some random (between ~0-90 days since the PH-1 launch, currently on ~70 days) amount of time. In that entire time, there's never once been an update that's been delayed for any actual changes from the stock update. In fact, if I don't want to wait for the update, I can just swap in any random non-Telus SIM, and the update is no longer blocked. The user experience is better with any carrier in the world other than the one I bought the phone from in the first place!

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by mr_toad on Thursday July 11, 2019 @09:24PM (#20417350)
If Google put their foot down the manufacturers and carriers would tow the line.

Trying to sell a (non-Apple) smartphone without Android in 2019 would be like trying to sell a PC without Windows. Your market share could be counted on one hand.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by dredmorbius on Friday July 12, 2019 @03:29PM (#20423645)
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by panpanna on Friday July 12, 2019 @03:37AM (#20418961)
> This can lead to multiple firmware variants for a specific device. It's not uncommon to see over 20 variants of a firmware for a specific Samsung device for example. This can be broken down by carrier, by region, by OS, etc.. for a number of different reasons.

You forgot to mention this was fixed about 2 years ago when Google pushed mandatory changes in the way customisation are added to the firmware image.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by sammorrowdrums on Friday July 12, 2019 @02:10AM (#20418642)
While not a perfect solution, I've been buying phones from manufacturer since my HTC desire was ruined by bloatware (you could put many apps on SD card but not Facebook as it was included bloatware, which got huge over time and literally meant I couldn't install updates or would have to delete other apps etc.)

It has helped the frequency and speed of updates a bit. Not a fan of carrier customisation.

Re:Malicious apps infect 25M Android devices with 'Agent Smi... by vinayan3 on Thursday July 11, 2019 @09:39PM (#20417405)
Sounds like getting phones with stock Android is the best option. I rarely see in the stores Android One being a major feature / selling point: https://www.android.com/one/
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by PeterStuer on Friday July 12, 2019 @01:17AM (#20418399)
Thanks for the info. Is there a place where one might find the data on brand/carrier responsiveness to security updates? I'm thinking e.g. Google publishing a dashboard on this might make it to the radar of the marketing departments of the involved partners.
Re:Malicious apps infect 25M Android devices with 'Agent Smi... by kilolima on Thursday July 11, 2019 @08:12PM (#20417055)
And yet someone can discover a security vulnerability in a software package and it gets put out to every Linux distro as an update in less than a week, usually by volunteers...