top | item 23027184

Google Play has been spreading advanced Android malware for years

167 points| elsewhen | 5 years ago |arstechnica.com

121 comments

order
[+] AnthonyMouse|5 years ago|reply
Let this be another nail in the coffin of the "walled garden" farce.

We learn this lesson again and again. People want someone to trust, but a bureaucracy isn't trustworthy. It has its own agenda and values inconsistent with yours. They take 30% from everybody whether they approve malware or not, and whether they reject legitimate apps or not.

Trust doesn't come from size. If you want someone to vet your apps, it has to be someone whose interests are actually aligned with yours, not just whoever is big enough to force everybody through the tollgate into their store.

[+] Razengan|5 years ago|reply
I would still prefer to have to trust just one authority for my platform than a multitude of random developers.

> Let this be another nail in the coffin of the "walled garden" farce.

There is no coffin, the walled gardens are not dying, and have long since become the norm, which happened because the people found them to be better than the alternative: getting apps (and manually updating them) from many different sources of varying quality and convenience.

[+] _bxg1|5 years ago|reply
And yet Apple's walled garden is stronger and hasn't had anywhere near the malware problem that Google's has? I don't understand your point.

Privacy is where these companies' interests might not be aligned with users; when it comes to security, they very much are. It's just that for Google that's limited to their own services; they don't care so much when it comes to Android as a broader platform. But even then their interests are not not aligned with users. Just under-incentivized.

[+] ajconway|5 years ago|reply
But security is not binary. They (especially Apple) are doing something to limit the amount of fraudulent apps on their platform.

I would strongly prefer having a free-for-all platform because I have some basic knowledge of information security. Most people don't.

[+] gigatexal|5 years ago|reply
Google play != Apple App Store
[+] peterwwillis|5 years ago|reply
Nobody has yet said the words "lock-in device". Everybody moans about lock-in devices when it's convenient for them, but then they throw away the ability to use anything else by committing full-tilt to these mobile platforms where to install "unapproved" apps you have to literally hack your own device.

Apple and Google got rich doing what we would have lambasted Microsoft for, because our judgement is clouded by brands.

[+] lkrubner|5 years ago|reply
"a bureaucracy isn't trustworthy"

This kind of rhetoric has been popular in California at least since the 1970s and it has consistently played the same role, which has been to disguise reality. Bureaucracy is expanding because complex societies need complex bureaucracies. This isn't new. You can trace this far back in history. In some sense, the era of bureaucracy began around 3,300 BC when the first Pharaohs wanted to put up the first pyramids and found that they need hundreds of scribes to keep track of all the material, and payments for the material. And bureaucracy has gotten a lot bigger since that time. There are some totally legitimate criticisms that you can make about civilization, especially the way a complex civilization necessarily infringes on some of our basic rights, and the fact that there is a certain kind of inefficiency to bureaucracy. All the same, bureaucracy also has a kind of efficiency to it, especially when organizing things of immense scale. Lazy libertarianism is popular but it is not an accurate guide to the changes happening in our society or our economy.

[+] scarface74|5 years ago|reply
I never here users complain - just developers.
[+] WrtCdEvrydy|5 years ago|reply
Oh yeah, they can spread malware for months, but I submit one fucking app that allows you create signs for your business for COVID-19 and all of a sudden I get a 'Sensitive Events Violation Suspension' and get a ding on my Google Play account.

Google has become Apple except worse because at least Apple is reachable.

[+] realusername|5 years ago|reply
Apple is pretty much the same, I've been trying to create a developer account for three entire weeks and it still shows as "pending" without info. I saw on the forums that for some people it can take months. It looks like some bureaucratic government body from the 90s.

I now advise my friends to switch to Android if they want to see the app, there's a limit on what I can put with. These companies should just be broken up in pieces.

[+] cageface|5 years ago|reply
App stores are a trap. As developers we should be doing everything we can to keep the web alive. Every power you cede to a third party gets abused sooner or later.
[+] Karishma1234|5 years ago|reply
My app got suspended because my self publish ebook reader could be used to search for books one of which had a kid with a nerf gun on its cover.
[+] mclightning|5 years ago|reply
They're not picking on you. You're just easier to identify. Don't take it so personally. That's a very biased view.
[+] samoa42|5 years ago|reply
why would anyone need an app to print a text stating their business is closed?

probably someone was just looking for any reason to get rid of this.

[+] izacus|5 years ago|reply
The wording of the title is interesting - how it puts all the responsibility onto Play store and none of it onto the people actually developing the software.

We truly live in an age where the mass media demands that corporations censor and police everything we see and use.

I wonder when they'll start targeting Linux and Windows for allowing you to download and run malicious programs without any corporation approving them.

[+] dunnevens|5 years ago|reply
Google advertises their store has "Google Play Protect" which promises to ensure no malware in the apps you download from them. Of course Google is going to get the blame when they make promises like that.
[+] amelius|5 years ago|reply
> The wording of the title is interesting - how it puts all the responsibility onto Play store and none of it onto the people actually developing the software.

But this is how app stores advertise their only benefit over traditional sales channels.

[+] leppr|5 years ago|reply
It's not the media, that's the stance Google themselves adopt with Google Play by acting as non-neutral gatekeepers.

Few people lack the intuitive understanding of the difference between free platforms and controlled ones. People don't blame Google Search for linking to Stormfront, but they would blame Facebook for hosting it. People don't blame Linux and Windows for allowing you to install malicious apps, because these allow you to install any apps.

[+] dathinab|5 years ago|reply
Besides what other comments noted there is the problem that sometimes Google knowingly tolerates software incompatible with their AGBs and through this endangering the privacy of users.

If I remember correctly TickTock was such a case.

[+] panny|5 years ago|reply
No worries Google fan. arstechnica is a paid Google "news" outlet. In the article, they downplay the damage and reach of the attack. If they titled it "Move along, nothing to see here" their ruse would be too obvious.
[+] javajosh|5 years ago|reply
It's emotionally difficult to find out about flaws in something you trust. I think humans really like black and white thinking, and crave association with people and institutions with blemish-free reputations. But the truth is that nothing and no-one is blemish free, especially if you zoom in on them enough. If you let it, then this truth can make you feel like you can't trust anything or anyone.

But its not true. You can trust. Although blemishes are universal, the scale of the blemishes are not. The key to trusting again in a world of flaws and faults is perspective. Is the flaw large or small? Does the agent accept it and want to fix it, or do they deny it exists (a much worse problem!)?

Everything has flaws, everyone makes mistakes, often people behave badly. That is never going to change. The thing we have to judge is whether the self-corrective systems in place are doing their jobs to acknowledge and repair the damage. IOW, making a mistake shouldn't determine trust, but failing to address the mistake should. One might call it "second-order trust". If you accept that, then the missing piece of this story is Google's response -- although they removed the offending malware from the Play Store, the journalist didn't apparently contact Google for anything else, like what steps they are taking (if any) to prevent this sort of thing from happening again. Ars didn't say anything about contacting Google, so I'd say that is an indication of lazy journalism, itself a sad but endemic problem in a world where we all have another false belief, that useful screens should be free (as in beer).

[+] xorfish|5 years ago|reply
Why haven't antitrust lawsuits made it mandatory that you can chose your app store after first use like it happened with browsers?
[+] jedimastert|5 years ago|reply
I currently have F-Droid installed on my stock phone and Google did nothing to stop me other than a single "unknown app" warning.

Also, that's not how it works with browsers. You have one browser installed. I don't think I've ever seen windows or mac (or any linux distro I've tried) ask which browser should be installed. There's just the default one and the choice to install anything else.

[+] Mindwipe|5 years ago|reply
They likely will eventually, but the browser verdict took a long time.

It's also unhelpful that many politicians have realised in retrospect that they quite like having single choke points that can be used to enact legislative control over the public.

[+] Leherenn|5 years ago|reply
There's no monopoly in the phone market like there was with Microsoft.
[+] innagadadavida|5 years ago|reply
Does google know which apps were infected and does it plan on letting folks installed know? It’s unfortunate their own project zero didn’t catch this.
[+] notRobot|5 years ago|reply
The article lists the package names of the infected apps.
[+] KingOfCoders|5 years ago|reply
Tin foil hat on. We had these iOS zero days and now conveniently we get something about Android security.
[+] wccrawford|5 years ago|reply
There's no tinfoil hat needed. It's pretty common for people who get their feelings hurt to lash out against "the enemy" with whatever they have. It doesn't matter how old the news is when they can just post it again and people will upvote it like it's new.

And it doesn't even necessarily have anything to do with Apple themselves. They don't need to spearhead this movement because fanatics will defend them like this anyhow.

The same goes for Google fanatics, and every other kind out there.

[+] freehunter|5 years ago|reply
If you think this is the only news article that has ever talked negatively about Android security, I'd recommend reading the news more often.