Yes at the cost of not allowing you do to many things.
In that sense, a prison is safer than being outside, too. Should I live in a prison instead then?
I am not trying to bash iOS here, but it is very clear that security in iOS comes at the cost of freedom and not being able to do a lot of things. For example, you can only install apps through the App Store. You cannot mount USB drives and so on.
One person's prison is another person's comfortable home. Many people do not perceive iOS as a prison, and would take issue with your choice of words to describe it as such. If you feel that it is, then of course there are alternatives available. You just also know what you're giving up and the risks you're taking.
(and, of course, Android is not so nice either without the magic non-Free bits from Google...)
>In that sense, a prison is safer than being outside, too. Should I live in a prison instead then?
I mean... I see Android as akin to the situation in The Walking Dead that led to them living in a literal prison, so yes. I've always avoided Mac when possible, but in the mobile space I'd rather use those devices less, and less freely, but more securely. I'll explore my options on my desktop or laptop.
Android security is indeed a joke. That doesn't make me eager to use a different device with a bunch of closed-source software. We really need better choices.
Yes, but isn’t that the problem with Android security updates? OEMs need to (and fail to) deliver closed-source binary blobs to end users. If open source is the real goal, then we* need to be demanding much more openness from OEMs.
* Not me strictly-speaking, because I’m an iOS user for the reasons specified by GP, among others.
Android's network security model is atrocious, with full network access being in the "other" category that all apps get. You don't need to have root on a phone to go rogue and attack/analyze other devices, if the phone already gives your "no permissions" app full access.
So you have an issue with Android's permission model? Fair point, it could be more granular. Are permissions more granular on iOS? Because I'd like to block access to the Internet for some apps that display ads. I'm guessing probably not.
Is there a permissions model on Linux, Mac, or Windows? This issue seems kind of unimportant. If a hacker can compromise the device, they can disregard all permissions.
No, there is no built-in firewall for outgoing connections on iOS, and I don't know of a way to install one without using an external device like a router with a filtering proxy.
The OS limits an app's access to data that belongs to that app, so an app can't gather information you do not give it access too. (e.g. you have to give explicit permission for it to access photos or GPS location). But you do not have any control over other analytics the app may gather and upload, e.g. frequency of app use or info you enter.
> Android security is a joke. Seriously. Don't use an Android phone.
Can confirm it sucks. Android Security Patch Level on my phone is 2016-01-01. Funny cause on my old different manufacturer phone before this one I had a more recent security patch. I am pretty sure some nasty stuff came out between now and then.
Can't tell if Android is the issue, the phone manufacturer or both.
Please edit that kind of name-calling out of your comments here. I realize it started upthread, but this crosses into incivility and tarnishes your otherwise fine comment.
To add to that, in China people have bought what they thought was a genuine iPhone (in an "Apple store" no less) but turned out to be a clone full of crapware. These are extremely well made clones, people have used them for years without understanding what they were.
What does that tell us about iPhone security? Nothing.
Where's the Windows or Linux version of Xcode 7, then? Or a version of OSX licensed to run on the capable hardware that I already own? I suppose I could spend $500 on a Mac Mini, but then we're back to tokenizerrr's question.
Oh? Where do I find the docs and the download link? It has to run on Linux laptop or my Windows desktop, both which have perfectly capable hardware. I am not buying a Mac for the privilege of developing software for an iPhone.
A Hackintosh is perfectly viable. Assuming you can boot the installer(free from the Mac App Store), it's trivial to set up the necessary bootloader and extensions(certainly easier that making Windows dual boot nicely).
Now what? Will there be more action than a blog post? This is a major criminal operation. If this has been found on multiple phones, tracing back the supply chain should reveal the common insertion point. That's a routine law enforcement job. The FBI has a "Cyber Division", and once in a while they catch somebody.
"To protect themselves from regular and pre-installed malware, users should implement advanced security measures capable of identifying and blocking any abnormality in the device’s behavior.". Aside from reflashing the device before first use, and I suppose on a reasonably regular basis, are there any other suggestions for implementing this suggestion?
Well, let's say they provide products. Let's not say they provide 'excellent products'. After all, Check Point is one of those companies that suggests to do SSL MITM 'to provide security'. They sniff your SNI to make sure you don't look at XKCD. They randomly cut your connection if you try to download the SHAttered pdf's over http. They are what makes corporate life tiring.
Indifference is my mobile protective strategy. Anything I have that's worth anything is located elsewhere and encrypted, so I have the luxury of not caring.
Edit: I guess I never fully drank the mobile kool aid anyway... It's been what 10 years, the gee-whiz-bang effect has worn off, and they're revealed to be little more than a leash/tracking device for humans, with a small shitty interface on which you can't use more than 1 or 2 digits (fingers, son). So that's the foundation of indifference the above indifference comes from.
tl;dr: Don't by used Android phones from third party resellers.
Every one of these was bought used from a third party that installed malware prior to reselling. If you buy a new phone from a manufacturer, major retailer, or major carrier, this doesn't apply to you. If you buy a used phone from a trustworthy friend or family member and reset it for use, you're probably cool. If you buy a used phone from someone you don't know/trust online or off, flash it back to factory condition before you use it.
Your handwavy fix is almost completely unrelated to the research. These were large companies. They generally always buy phones through third parties. And when work gives you a phone how will you figure out who touched it?
Rather than giving people a lengthy and arbitrary list of purchase caveats, why not ask why it's so difficult to secure an android phone through the supply chain? And what, if anything, are other phone manufacturers doing that might be making the problem much more secure?
"The malicious apps weren't part of the official ROM firmware supplied by the phone manufacturers but were added later somewhere along the supply chain."
I'm not sure how they consider that 'pre-installed'.
Eh, "preinstalled" isn't specific enough. I interpreted it similarly to some of the other folks in the thread, that it meant installed by my mfgs. But whether "preinstalled" is that specific or not is mostly a moot point, since it's apparent that the wording of the title isn't sufficiently precise.
Christ, the pedantry is reaching unprecedented levels.
The wording of the title is just fine. This is just a case of someone trying to show how smart they are by nitpicking on insignificant details and feigning non-comprehension.
In doing so, the discussion is no longer on the substance of the article, but rather on insignificant semantics.
No they weren't. Do you really think a Nexus 5 or Nexus 5X would contain those malware apps? The Nexus 5 isn't even being manufactured anymore. In fact, half of those phones aren't even made anymore.
This presents a completely new kind of threat. I wonder how the industry would respond to this. When you do a fresh install, perform some kind of checksumming to verify the integrity of the OS with all its installed software. This cannot possibly be implemented by Google because each manufacturer has its own bloatware that it needs to pre-install. I wonder if Samsung and LG will wake up to this and create a security module?
Actually, the signature checks would have to be done by an external hardware component, or maybe through something like ARM TrustZone. Otherwise, the attacker could disable or manipulate the checks when installing the malware.
So it's up to the phone manufacturers to implement; Google would never be able to implement this in a truly secure fashion, even if they knew all the software installed on the phone a priori.
On a related note, I know that Cisco wants something like this for their hardware, but at runtime instead of just on-boot.
Only problem with chromebooks is that the default action is to wipe the system instead of booting. You have to press ctrl d to boot, which the UI does not tell you about.
My question then becomes: where is the manufacturer's certificate stored on the phone/laptop? Because if it isn't stored in a secure manner, an attacker could still modify the ROM and replace the certificate, and you would be none the wiser ;)
You are aware that e.g. Android ROM is flashable? So it's not a ROM in the literal sense -- probably EEPROM or something. I'd imagine an actual ROM (non-erasable) would only contain the bootloader and/or BIOS. So the manfacturer could sign those and check them, but everything afterwards would be modifiable.
Let's assume that the manufacturer places its cert in ROM so nobody can change it. Great! We are totally secure! Actually, not at all. Where does the signature check take place? In software? Then an attacker could man-in-the-middle and feed the signature check function with a malicious cert. Even if this was not a problem somehow, how would the manufacturer handle key revocation? The cert is burned in, so if their key is compromised, every single device out there is broken.
In summary, unless every single step of the signature check is performed in an isolated environment (e.g., TPM), an attacker will always be able to circumvent the process. Solid crypto is not enough; you need to also ensure that the crypto implementation is tamper-resistant!
It's not news that the indifferent, the ignorant, and the uninformed are screwed, or that some things are difficult to solve without individual knowledge and action.
This is clearly just an ad post. Can we stop allowing this stuff on HN? This is like Burger King posting an article "Hunger affecting 100% of living people up to several times a day has only one solution."
From my perspective there's been a drastic rise in these kinds of ad posts appearing on the HN front page lately. I dunno if it's vote manipulation via paid viral marketing or something else but it sucks.
Dude come on. Don't quote the guidelines at people unless they're new users who might not actually be aware.
I think it's pretty clear from my comment why I'm saying something; it's not just about this one article, there's been a rise in these obvious ads on the site in general (from my point of view), and I feel something needs to be done about it. I've obviously flagged every one of them but that's not enough.
The point of me making a comment about it is to see if other people feel the same way. If you don't agree, you can reply and say "I don't agree, I think these ads are good / I don't see many of them / whatever."
Replying and quoting the guidelines like that is trying to just shut down the discussion and/or just being pedantic.
If you look at the list of phones you'll quickly notice that 1/2 of the phones aren't even manufactured anymore. There is even a Nexus 5 in that list. What does this tell us? These 2 companies purchased these phones from a re-seller that clearly modified the phones by installing malware on them.
If you care about security, use iPhone or Google Android phone (pixel). They're not bullet proof, but they're 5x more secure by virtue of being able to react to issues like this immediately. Third party integrations like rest of Android phones are messy by design security wise.
So, it's an ad for their product/services/whatever. I'd be a lot more interested in a discussion of practical things that phone owners can do to detect malware, avoid infection, etc on their own.
Tell you what else is plaguing mobile users: the staunchly non-responsive design of the linked article's page. Is it a mobile article aimed at desktop users?
Android security is a joke. Seriously. Don't use an Android phone.