In case you missed it: Bank info-stealing malware found in 90+ Android apps with 5.5M installs
In case you missed it: Bank info-stealing malware found in 90+ Android apps with 5.5M installs
The apps identified have since been removed from Google Play, but make sure you didn't install one.
You're viewing a single thread.
As somebody who occasionally had to develop for android: the churn of improvements to app security was a huge pita. And as a user I know many of the abandoned apps that I liked that lost compatibility was for that reason.
So the fact that in spite of this pain, Android security still allows apps to do horrible crap like that is infuriating.
If you read the original report, it says that it basically just displays a fake banking login page. It also says that it requested accessibility service permissions, which makes me think maybe it brought up the fake login pages "in the right moment" (as in as users opened their banking apps) to make it more convincing, even though the article doesn't specify that.
Either way, IMO the problem here is clearly with the Play Store allowing this app in, and not with Android's security itself. These apps are misusing the accessibility service system, which is obviously necessary for a ton of important use cases (and of course also requires the user to grant very explicit permission). The fact that the accessibility services are a thing doesn't delegitimize Android's security improvements over the years.
If a user can open their baking app, and this app can sense that and open instead, then that is 100% an Android issue. That behaviour shouldn’t be possible.
"Accessibility service permissions" is a higher level of permissions than most apps get and Android will be all like "bro, are you sure you want to grant this app that kind of access and control? You really sure?" I've got a few apps on my phone with that level of permissions including one written by Google. They'd simply be unable to do their job without that level of access, jobs which have been straight-up good for my physical health. Ultimately there's a balance between security and letting the user do what they want.
The app doesn't contain malware when it's uploaded to the play store. It forced an update after it's installed that contains the malware.
That's not what I mean. I'm not thinking about Play Store security, but Android OS security. Like, your app physically has to ask for permission (or even require the user manually change settings) to do most unsafe things.
Physically? So the dev has to come ask you in person?
By mail, even
It does, you have a full screen scary warning when an app asks for these accessibility permissions. Clearly many people just give it to a random QR code reader app for some reason.
So I could write an app that is okay on the Google store, then change it to steal people's information? Hmmm 🤔 that gives me an idea....hahh! Too many projects at the moment.
According to the report, the app just displays a fake login page. I don't see a good way to prevent this.