Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Android Cellphones Handhelds Security

Google Finally Uses Remote Kill Switch On Malware 177

Posted by timothy from the you're-going-to-feel-a-little-zapping dept.
Hugh Pickens writes writes "The Google Mobile Team has announced that in addition to removing the 21 malicious applications from Android Market that were downloaded 50,000 times, suspending the associated developer accounts, and contacting law enforcement about the attacks, they are remotely removing the malicious applications from affected devices. 'We are pushing an Android Market security update to all affected devices that undoes the exploits to prevent the attacker(s) from accessing any more information from affected devices,' wrote the team on their blog. 'For affected devices, we believe that the only information the attacker(s) were able to gather was device-specific (IMEI/IMSI, unique codes which are used to identify mobile devices, and the version of Android running on your device).' Google's actions come after numerous complaints in tech publications. "Does Google really want its Android Market to gain the reputation of being a cesspool of malware? 'Certainly not,' wrote Nicholas Deleon in TechCrunch. 'But then part of the allure of the Android Market is that it's open; you don't have to play by Google's rules, per se, to get on there like you do with Apple's App Store.'"
This discussion has been archived. No new comments can be posted.

Google Finally Uses Remote Kill Switch On Malware More

Google Finally Uses Remote Kill Switch On Malware

Comments Filter:

  • GJ GOOGLE (Score:3, Informative)

    by Soilworker ( 795251 ) on Sunday March 06, 2011 @03:05PM (#35399498)

    Good job again google. That's why you're on top.

    • Re:GJ GOOGLE (Score:4, Interesting)

      by Rosyna ( 80334 ) on Sunday March 06, 2011 @04:55PM (#35400332) Homepage

      Good job again google. That's why you're on top.

      So it's a good thing that Google can, has, and will continue to remote remove (remote kill) applications downloaded onto phones.

      Apple has removed apps from their store, but never from the phone itself once the app has been downloaded.

      • This whole thing is hilarious, because iirc there was a story on this very website only a few months ago condemning Google for even HAVING a remote kill switch.

    • Re:GJ GOOGLE (Score:5, Interesting)

      by Deathlizard ( 115856 ) on Sunday March 06, 2011 @05:27PM (#35400622) Homepage Journal

      Except that it's unlikely that this will totally clean the problem.

      This Exploit Rooted phones. That means Google lost control of the phone the second the user installed and run the malicious app. They could remove all of the malicious apps all day long but all that does is remove the Trojan Horse that dropped the rootkit.

      As for the removal tool Google is planning to send. If the virus programmers have any sort of brain the first thing they're going to do is block the removal tool from removing the rootkit by sending a patch to the rootkit. It wouldn't surprise me if the rootkit doesn't phone home soon and download something to either spoof that the rootkit was removed or block the rootkit remover altogether and disable apps (either from Google or a third party) designed to remove the exploit. Google giving them a heads up through the blog post that they got 72 hours to code such a patch just made the virus writers job even easier.

      Now I'm not saying that Google is handling this totally incorrectly. If I was Google, I would have taken many of the steps that they are currently doing, except I would not publicly lay out the plan until after it was executed. I know it would give Google Bad PR by sending apps without user knowledge, but it would have minimized a counterattack time frame from the virus writers and would have been the safer option overall. I just hope that Google has another strategy if this one fails, such as carrier involvement to recover and possibly disable remaining infected phones until it can be cleaned by a carrier tech.

    • Re: (Score:2)

      by siddesu ( 698447 )

      Not quite. It would be a really good job if it asked me for permission before it activated the remote kill feature, not just send me a notification. Google should not totally forget the OS they developed is running on my device.

  • 260,000 infected Android devices (Score:5, Informative)

    by Anonymous Coward on Sunday March 06, 2011 @03:05PM (#35399504)

    Correction: The malware was downloaded 260,000 times, not 50,000 as initially reported. source [techcrunch.com]

  • Slashdot hypocrites.. (Score:4, Insightful)

    by Anonymous Coward on Sunday March 06, 2011 @03:09PM (#35399538)

    If I was to s/Apple/Google/ people would be declaring how this is censorship and true evil and how Apple kills a kitten every time someone jailbreaks an iPhone.

    • Really? (Score:5, Insightful)

      by SanityInAnarchy ( 655584 ) <ninja@slaphack.com> on Sunday March 06, 2011 @03:24PM (#35399672) Journal

      How the hell did you get to +5 insightful by implying that we can't tell the difference between preventing people from doing what they want with a device, and preventing developers from taking advantage of users?

      Seriously, this is like implying that when we say "Good job" about putting spammers behind bars, you're surprised we weren't defending their freedom of speech. I know it's tempting to think in soundbites, but this isn't hard.

    • Re:Slashdot hypocrites.. (Score:5, Insightful)

      by phantomfive ( 622387 ) on Sunday March 06, 2011 @03:38PM (#35399776) Journal
      Maybe, or maybe Apple not letting me put things I want on my phone IS annoying, but what Google is doing here is not. There really is a difference between purging malware (which no one wants) and purging stuff people do want. Really.

    • This is the difference between free and proprietary software: Apple's software is proprietary—you have no way to restrict Apple from using their power to "kill" (their term) applications on your computer. If Android is free software—software which respects your freedom to control your computer—it's up to you to make things better by hacking software or getting more knowledgeable people involved. Free software lets you choose to remove the code that grants Google app-killing power (or hav

    • First of all, it would be Apple doing the actual killing. Apple is not a force of nature that is immune to moral codes, or the law for that matter.

      Second, participation in the android app store is optional.

  • More overreaching "sole discretion" terms. (Score:3)

    by Animats ( 122034 ) on Sunday March 06, 2011 @03:16PM (#35399592) Homepage

    These "remote removal" schemes seem to come with a "sole discretion" clause. Not, say, "after confirmation by the US Computer Emergency Response Team".

    • Re: (Score:3)

      by fermion ( 181285 )
      I think it would be much better to have a blacklist of known infected apps. The phone can check against this lis, and, just like other malware detectors, note that it is dangerous, and why, and then prompt the user for removal.

      Of course no one, not even the OHC, believes the user owns the mobile device and as such should have complete control over what happens on it. So, as expected, Google does as it pleases when it pleases, even when here is a genter and equally effective alternative.

      • Re: (Score:2)

        by Firehed ( 942385 )

        I think it would be much better to have a blacklist of known infected apps. The phone can check against this lis, and, just like other malware detectors, note that it is dangerous, and why, and then prompt the user for removal.

        Ehh... while I like your sentiment, it's just not a good idea. People just don't give a crap about security (those not reading /. anyway), and that kind of opt-in prevention will be about as effective as Windows XP pre-SP2, which is to say not at all. Especially if something pops up while the user is in the middle of doing, well, pretty much anything - they're just going to hit the "shut up and go away" (cancel) button.

        I think there should be a published list of deleted apps (they can push an update of thi

  • Openness and Archos (Score:5, Informative)

    by tepples ( 727027 ) <tepples AT gmail DOT com> on Sunday March 06, 2011 @03:18PM (#35399602) Homepage Journal
    Quoth Nicholas Deleon in TechCrunch:

    But then part of the allure of the Android Market is that it's open; you don't have to play by Google's rules, per se, to get on there like you do with Apple's App Store.

    This might be true with respect to application developers but not hardware manufacturers such as Archos. To remain cost-competitive with iPod touch, Archos devices are missing various input and output components not needed in a portable media player, such as a cellular radio, compass, and GPS. However, because certain versions of Google's Android Compatibility Definition Document (CDD) list these components as requirements, Archos hasn't been able to include the Android Market application with the devices. To access the Market (and not the AppsLib that has a far smaller selection), one needs hacks [arctablet.com] that Google could cease-and-desist, just like it cease-and-desisted CyanogenMod for including Google applications [gizmodo.com].

    • Re:Openness and Archos (Score:4, Informative)

      by teh31337one ( 1590023 ) on Sunday March 06, 2011 @03:55PM (#35399886)
      Oh come on. The google apps are their own proprietary apps, and manufacturers pay to have them - that's why CM couldn't include them. Market place is controlled by Google, and they can remove malicious applications if needed. Device manufacturers have to meet the minimum spec to have market access.

      • "minimum spec"? Hmmmsounds like someone else (not the developer) is setting standards that the developers have to live with if they want to participate in Google's sand box. Doesn't Apple get spanked here for doing that?

        • It's stuff like: having a camera, GPS, access to the internet, a touch screen etc.

          • And your point is? I know what the minimum specs are. However, isn't point of open systems that I can put up whatever I want –including hardware and software? Who is Google to be telling anyone that there system on the open market doesn't meet minimum specs? Who died and made them Apple to make such decisions?

            • They're not mandating it on anyone. These min specs are for having access to the android market on your device. Android market is proprietary - Google get a 30% cut from app sales, and they have specs that OEMs have to meet to gain access to the market.
              • Then why has Google required GPS even to be able to download applications that do not use the GPS, a compass even to be able to download applications that do not use a compass, telephony even to be able to download applications that do not use telephony, etc.? Can you recommend a product that A. runs Android, B. costs $200 to $300 like an iPod touch without a telephone service commitment, C. meets the min specs for access to the platform's largest app market, and D. is sold in the United States, which is my home country and Slashdot's? Unlocked phones tended to fail B last time I checked, Archos 43 fails C, and Samsung Galaxy Player failed D last time I checked.

            • And your point is? I know what the minimum specs are. However, isn't point of open systems that I can put up whatever I want –including hardware and software? Who is Google to be telling anyone that there system on the open market doesn't meet minimum specs? Who died and made them Apple to make such decisions?

              No one is forcing you to use Android Market, but if you do, it is owned by Google so they can set whatever rules they want.

              The whole idea that Android is an open system is ridiculous, Google are better than the Apple walled torture palace, but they're not exactly the GNU Foundation.

              • No one is forcing you to use Apple's store either. Just jailbreak your iPhone and have at it. Overall I agree with your sentiment, except that Google is better than Apple. My experience with both has led me to prefer Apple and its ecosystem. However, I am glad we have the choice. Now we just need a few more players to get serious so we can have just a bit more choice to keep Google and Apple honest (wellas honest as they can be).

      • Device manufacturers have to meet the minimum spec to have market access.

        But if Google doesn't set a minimum spec that's realistic for a PDA, then Google is handing the PDA market to Apple with its iPod touch. Microsoft had already left the PDA platform market after discontinuing Windows Mobile Classic (formerly Pocket PC) in favor of Windows Phone 7.

        • The min spec was created with phones in mind. If Archos want official access to the android market, they have to add in the camera, GPS etc like Samsung have done. And there is no PDA market. There's a phone market, and a market for PMP style multi media devices.

          • If Archos want official access to the android market, they have to add in the camera, GPS etc like Samsung have done.

            Is it possible to add such components and still come in close to the $249 price point?

            And there is no PDA market. There's a phone market, and a market for PMP style multi media devices.

            Then please allow me to rephrase: If Google doesn't set a minimum spec that's realistic for a PMP-that-runs-apps, then Google is handing the PMP-that-runs-apps market to Apple with its iPod touch.

    • This connection between 'openness' and Google messing up and letting a virus get through is a bunch of crap.

      You can have an App Store that is 'open' but still blocks all virus and malware, and that is what Google is attempting to do - they just blew it this time.

      Open can have many meaning, but in this case it includes stuff like allowing free competition - not blocking apps just because they go against the interests of the platform's sponsor or their buddies.

      It does NOT mean that every single app posted to

  • Android is safer than iPhone.. (Score:5, Insightful)

    by WarwickRyan ( 780794 ) on Sunday March 06, 2011 @03:26PM (#35399700)

    Angy Birds, for example, collects a heck of a lot of personal information on the iPhone. Why? Because the user isn't warned about it. Their Android application has so far been much cleaner, mostly because Android asks the user to give the app permission to access certain data.

    Link: http://www.observer.com/2010/media/angry-birds-and-other-must-have-apps-collect-more-personal-data-you-think [observer.com]

  • Android security (Score:4, Interesting)

    by Anonymous Coward on Sunday March 06, 2011 @03:32PM (#35399742)
    Is this the way Android security will be handled (after-the-fact cleanup via the marketplace)? It just seems to me that since the manufacturers don't seem to be too keen on supporting their handsets for longer than it takes them to get the next model out the door, and since the service providers like to sit on updates or block them altogether the actual vulnerabilities are unlikely to be fixed.

    I was stupid enough myself to buy a Sony-Ericsson Android device only for them to basically drop it a month later, so presumably it will always be vulnerable to the holes used by this round of malware?

  • Certification (Score:3)

    by Midnight Thunder ( 17205 ) on Sunday March 06, 2011 @04:35PM (#35400168) Homepage Journal

    What would be nice, is even if the market place is left open, there would be an option to pay Google to certify your application. The idea being that people can then choose between "certified" apps or uncertified ones. This would help give users some sort of reassurance, but still leave the choice option open.

    As to the kill switch, does Google print a list of applications to which it was applied?

    • Forgot to say that the certification process would include a set of API usage tests and behavior tests. No application developer would be forced to go through the process, but if the fee is low and on a yearly basis, then I imagine many develops would want to reassure the customer base.

    • Exactly my thoughts

      Hopefully someone from Google is reading this thread; keep it open but allow those willing to pay a little extra security.

      It won't work because many people will go for anything that is "free" or "cheaper", but at least you have an option.

    • This would be a good compromise.

  • Seems like a good standard (Score:5, Insightful)

    by gman003 ( 1693318 ) on Sunday March 06, 2011 @04:55PM (#35400338)
    One of the things I noticed was "and contacting law enforcement about the attacks". I think that could be a pretty good standard to follow for using a remote-deactivation capability, to prevent it from being abused. "If it's serious enough to use a kill switch, it's serious enough that someone will be filing a lawsuit, and we're sure enough of it that we're reporting it to police (under threat of perjury)."

    This is probably the best compromise. Obviously, some people would prefer no kill switch at all, while others would like the kill switch to be used on practically anything they don't like. If "serious enough and sure enough to sue" is the standard being used, it won't affect free speech (since, if you would be sued over it already, we've already lost that battle), and it makes accidents much less likely. Now, requiring that lawsuit to be won would make it even safer, but you run into the problem of it continuing to do damage for the years it takes to finally settle the suit.

    Overall, I would like to see that standard officially written and adopted, even if it isn't made legally binding. It would make me feel a lot better about the existence of a kill switch, knowing that it will only be used in truly serious cases.

    • A compromise is not necessary. At least not for situations like this one.

      Consider something more like SSL's certificate revocation list. I know little about Android, but assuming it uses a software management system similar to Debian's dpkg, each software installation has a signature. For each repository (app store) the device uses, it would subscribe to an application revocation list. When an application is listed for removal the device could CHOOSE to remove the app OR NOT. I'm emphasizing choice, be

      • While that is probably a better solution, freedom-wise, it also ignores one simple truth:

        User-friendliness.

        Android, although based on Linux, is not Linux, and is not made for the type of person who uses Linux. It is made for the type of person who uses a cell phone. Most of them, on seeing a "The application 'AnnaKournikovaPics' has been disabled for security reasons", is more likely to click "Re-enable anyways" than "Why was this disabled?". Thus, the malware would not be removed; in the case of some

  • Google's responsibility (Score:3)

    by krizoitz ( 1856864 ) on Sunday March 06, 2011 @05:02PM (#35400396)
    If smartphones were only owned/used by tech savvy people like most of us commenting/reading here, then their hands off approach to the Android Marketplace wouldn't be such a big deal, but thats not the case. Google and the carriers are marketing Android as an OS not just for the nerds but for everyone, because of that I think Google bears responsibility for what happened. Their hands off policy in the Android Marketplace pu users at significant risk for this malware in the first place, and does nothing to prevent it from happening again. Openness has its advantages, but those advantages are primarily useful to a select few. MOST users want a smartphone that is easy to use and lets them do things like browse the internet, check e-mail, consume media and play some games. MOST users are not tech savvy, and therefore MOST users aren't even going to know what to look for to try and avoid malware like this. Whats worse is that MOST users think Google is a trustworthy company so they will assume that the official Android Marketplace that ships on their phones and is provided by Google is a safe place to obtain apps. As we have found out recently, that is far from the truth. Google's free-for-all marketplace approach is harmful to average users. I'm not saying that the answer is to lock down Android to he same extent that Apple and Microsoft have done, but the totally open Android Marketplace should be an alternative, not the primary source. As the provider of the experience Google needs to set up a trusted marketplace where they put more scrutiny and oversight into apps and make THAT the default experience for the user. From within that marketplace Google could offer access to the untamed wilds that currently exist today, but MOST users wouldn't need to venture into that space, and would therefore be at far less risk than they are now.

  • within minutes? (Score:5, Interesting)

    by Bram Stolk ( 24781 ) on Sunday March 06, 2011 @05:12PM (#35400472) Homepage

    Google:
    Within minutes of becoming aware, we identified and removed the malicious applications.

    But from the comments in the blog post, we can read that:
    This is where the problem is. You became aware because someone had a contact inside Google who alerted to right people.
    According to one of the developers of the hijacked applications, he had tried for almost a week to get in contact with someone through the normal channels to correct the situation.
    I am sorry if I sounds harsh, but Google are a master of data processing, and surely you should be able to pick up a distress call from a developer within hours instead of a week.

    • Re:within minutes? (Score:5, Insightful)

      by Tacvek ( 948259 ) on Sunday March 06, 2011 @11:47PM (#35402692) Journal

      Google's biggest weakness is that they have virtually no support channels. They have a small number of email addresses/forms that can be used for that sort of thing, but the huge number of messages they get means those have huge backlogs. They have Groups for some topics, but my understanding is that many have nobody who is tasked with reading them, so messages only get read sporadically. (Like Dianne Hackborn is known to respond to messages on the Android Groups, but she is busy enough with Android development that she probably does not manage to read all or even most of he messages posted.)

  • Did they ask first? (Score:3)

    by Kittenman ( 971447 ) on Sunday March 06, 2011 @05:34PM (#35400678)
    Just wondering ... if Google remotely trashed people's appns without checking, then what we have here is not ownership of the phone, but a licence-to-use. It's up to people to do what they want with the phones, surely... even if they want to download "malware" (purposefully in quotes).

    Of course if it's in the terms-and-conditions of connecting to the provider, that's something different. But otherwise ... heck, if I want to doodle on my copy of 'The Brief history of time', that's my affair. Not the publishers, or Hawk's.

  • Welcome in the brave new world, where devices you bought don't belong to you anymore. Amazon remotely deletes bought books, Sony sues hackers that modifying their own PS3s, Microsoft threats to sue everyone who tries to use their Kinec with not approved means, and now Google remotely deletes applications and installs new ones.

    Is that the future of computing?

  • *Only* Information (Score:3, Insightful)

    by healyp ( 1260440 ) on Sunday March 06, 2011 @06:15PM (#35401000)
    FTFS: "we believe that the only information the attacker(s) were able to gather was device-specific (IMEI/IMSI..."

    Only the IMEI/IMSI!? You know only the things that uniquely identify YOUR phone among millions, and two pieces of information that are necessary required to clone a phone or SIM.

    The attackers only got those, they weren't able to get anything important like facebook logins or anything...

  • As if we were all waiting on them to do this? You do understand a) this is the second time they've done this and b) all previous malware "threats" were theoretical attacks and demonstration apps -- not "in the wild" maliciously-intended exploits? The last time they did it was to remove an app created by a security researcher that could theoretically do all sorts of malicious things just to see if people would install it despite the warnings.

    Where does "finally", figure into this -- except by way of yellow

Slashdot Top Deals

Trying to be happy is like trying to build a machine for which the only specification is that it should run noiselessly.

Close