Fake Antivirus Scams Spread To Android 236
SharkLaser writes "Fake antivirus scams have plagued Windows and Mac OS X during the last couple of years. Now it seems like such scams have spread to Android. Fake antivirus scams on Android work the same as they do on PC's — a user with an Android phone downloads an application or visits a website that says that the user's device is infected with malware. It will then show a fake scan of the system and return hard-coded 'positives' and gives the option the option to buy antivirus software that will 'remove' the malware on the affected system. Android, which is based on Linux, has been plagued with malware earlier too. According to McAfee, almost all new mobile malware now targets Android. Android app stores, including the official one from Google, has also been hosting hundreds of trojan applications that send premium rate SMSes on behalf of unsuspecting users."
Antivirus as a sign of failure (Score:5, Insightful)
I always believed that the day antivirus software becomes a universally accepted requirement the way it is on Windows is the day the platform has failed and missed the whole point of mobile operating systems. The point is to get away from the big mess of the desktop--the constant maintenance, driver updates, antivirus updates, defragmenters, and other utilities. Mobile operating systems are an opportunity to use a computer just to get things done, not to maintain the computer. That's what was so refreshing about the experience of the using the iPad and why it was such a surprise success to everyone including me.
Re:Walled gardens.. (Score:4, Insightful)
I hate a fucking walled garden as much as the next guy, but this type of shit is why users will stay with one. Not that a walled garden can't be hijacked, hacked, or otherwise messed with, but by and large it is a cleaner place to be. It is a win-win, both or users who can't, won't, or are too dumb to be bothered with learning a little software/hardware safety, and with corporations who thrive on control and stifling competition.
You can have a "walled garden" for users (some Android companies have their Appstores), yet still allow people to leave on their own risk. It's not mutually exclusive.
For instance you can install packages from repos in Linux, yet you can also download and install source packages with {./configure&&make&&make install;} if you don't mind the risk of screwing up your system. There is no need to lock out users from their phones.
Maybe you didn't mean "walled gardens" but cared-for repos anyway.
Re:Antivirus as a sign of failure (Score:1, Insightful)
Mobile operating systems are an opportunity to use a computer just to get things done, not to maintain the computer. That's what was so refreshing about the experience of the using the iPad ...
Why the !@#$ does it always have to come down to Apple iBaubles save the world?!?
Damn, man, if you'd bothered to run Linux/FLOSS all this time, you could have just fscking ignored the whole malware situation entirely, as I've been able to FOR THE LAST TWO DECADES!
Jeebus.
Re:Antivirus as a sign of failure (Score:5, Insightful)
Which is why sudo is being replaced by a policy-based system (some users may have package install rights, network configure rights etc.).
Still going on (Score:5, Insightful)
Android = Linux = Malware
Users are stupid whatever OS/Hardware they use, they will click on shit like this just because it pops up and they've never bothered to educate themselves about what it really means.
Re:Antivirus as a sign of failure (Score:4, Insightful)
Two decades ago, you had to edit XF86Config just to get your scroll wheel working, and you could fry your monitor if you entered the wrong clock rats. Linux on the desktop has been a disaster up until just a few years ago, and it still has yet to catch up to the big boys. It's a server/embedded OS. There's nothing wrong with that!
Also, /facepalm at the downmods of the OP.
Re:Antivirus as a sign of failure (Score:1, Insightful)
>Can't wait until after work to check Facebook
>Need to show others my "apps" to define my personality for me
Stay Classy, smartphone users.
Re:Antivirus as a sign of failure (Score:5, Insightful)
Which does absolutely nothing when computers on average have one user.
Re:Too open for its own good (Score:2, Insightful)
The reason iOS devices don't need anti-malware solutions is because all of the programs that run on that platform are from a secure and curated Apple App Store.
You know, we can make all computer systems secure by forcing people to only get software that has been screened by the government. And we can eliminate all sources of terrorist communication by forcing all telephone calls, email, letters, etc, to go through government "approval" censors. And we can eliminate fraud in the banking system by only allowing transactions that are pre-approved by the government. And we can improve car safety by only allowing people to buy cars supplied by the government.
And I wouldn't want to live in that world.
Re:Too open for its own good (Score:4, Insightful)
Yeah, but where would the fake webpage buy its traffic from? Apple controls in-app ads, and Google censors its search ads all the time. A fake antivirus website that nobody visits is not a problem at all.
Re:Too open for its own good (Score:5, Insightful)
Walled Gardens are the TSA Security Theater of the mobile space (coming soon to a PC near you!)
Not hardly.
When you talk about the TSA, there are literally hundreds of examples of the TSA not catching "banned items". WIth the iOS App Store, there have been what, one or two completely benign "breaches" in three years?
Hardly a fair comparison.
And, when compared with the track record of Android, even in the supposed "official" Android App Store, you would be bat-shit crazy to seriously suggest that Apple's curating of the App Store is "theater".
That's fine, but it goes further (Score:1, Insightful)
Why would you want to avoid Android just because other Android users might make bad choices?
Awesome, I totally support people choosing a platform they are comfortable with managing security on.
Now you aren't recommending Android to non-technical people right? Because I think it's wrong to tell people that CANNOT handle securing of systems, that they should buy and Android phone which I know full well they cannot manage securing properly.
Just as I would not recommend Windows PC's to people back in the day, these days to recommend Android devices to non-technical people is irresponsible.
Re:Antivirus as a sign of failure (Score:4, Insightful)
Yes. Why didn't Android devs put full thought into having ACLs and the such? I think something like solaris's pfexec! Perfect. I mean the average android phone has probably what, 100, 1,000, 10,000 concurrent users?
Re:Walled gardens.. (Score:4, Insightful)
You aren't putting your data at risk, unless you are sharing your android phone with some idiot. The user that is smart enough to download from sources he trusts, check the reviews, watch for unnecessary permissions etc... is not at risk from these scams.
So, I can either just click a link on the iOS App Store and KNOW all that stuff has already been done for me, or waste two hours scouring the internet just to figure out whether some stupid egg timer app is going to sell my soul to the Ukraine right?
I don't know about you; but my time is worth a lot more than that.
The curated collection approach is not perfect; but it sure seems to work out quite well in the real world, where the rest of us live...
Which I believe anyone who is not completely delusional would agree has not been the case so much for the Android "Wild West" approach. Note, for example, that Apple has never had to exercise its "Kill Switch" option for an App already in the Wild; whereas Google has had to do so on several occasions.
Re:Antivirus as a sign of failure (Score:5, Insightful)
I always believed that the day antivirus software becomes a universally accepted requirement the way it is on Windows...
That day occurred when Outlook would run malicious scripts by default found in received email messages, that had access to the entire OS/hard drive, without any needed user intervention.
For Android, I'm not sure that day has arrived yet, the article is derived from the press release of an antivirus company. Of course, it's going to imply that you absolutely need to buy *their* product (instead of using a little bit of street sense).
Now never mind that Google already has the capability of uninstalling malware from Android that was previously downloaded from their Market (or that you can already download a "Kid Mode" launcher to prevent your kids from installing anything, or just press a button to reset your phone to wipe everything and restore it to its factory settings). Does McAfee think it can act much faster than google in identifying and removing malware? Personally, I doubt that. And never mind that an Android user actually has to locate and tick the checkbox for installing apps from unknown sources (which AT&T doesn't let you do anyway), and then has to accept the permissions to install the application in the first place.
It's not like on the iPhone/iPad where you just need to go to a web page with some jpeg image on it and then your iDevice is magically rooted, and then the iPhone user is free to install any type of malware he wants (McAfee or no McAfee). That's one of the reasons that the McAfee anti-virus software on iOS is even more useless on iOS than on Android, since it can't run in the background and it can't even be scheduled to run at different times. On iOS, it couldn't prevent you from going to a malicious site even if it wanted to.
Re:Still going on (Score:4, Insightful)
And that's why "walled gardens" are safer for the vast majority of users.
Re:Antivirus as a sign of failure (Score:1, Insightful)
For non-techies, a curated software store is the middle-ground. It's third-party software you are free to choose from but vetted by the vendor, which filters a lot of potential problems. The mass deregulation represented by the Android third-party software platform is itself a black-and-white position, often argued for from a freedom perspective. Going back to your post, what if the person you give the freedom to is maliciously tricked into killing themselves? Just as we have an FDA to regulate food, and we have regulatory agencies for other industries, there is value in standards and quality control for software applications. We even have comment moderation on Slashdot to prevent the inevitable degeneration of discussions into a cesspool.
Re:Still going on (Score:5, Insightful)
... they will click on shit like this just because it pops up and they've never bothered to educate themselves...
We have decades of observed behavior showing that users will not "educate themselves". As such, any consumer-facing system that requires users to "educate themselves" is de facto broken and, frankly, poorly designed.
Re:Antivirus as a sign of failure (Score:5, Insightful)
(Nevermind that objective-C is an obscure language and Apple just could feasibly review every single line of code. It's not logistically possible.)
Android has a pretty sophisticated security model, compared to anything running the desktop space. Actual root never needs to be given up for a huge range of modifications to the system. There's policy based access so users can see and restricted what apps will have access to. Apps also run in their own userid and can be restricted from accessing the users data. Brilliant stuff.
So if the platform has malware on it, and it's the most secure thing out there in the mainstream... then what is wrong?
Due to it's popularity Android is a juicy target for the malware ecosystem, and like natural ecosystems, it'll adapt to any hardened defenses if there's nourishment to be had. Google was silly to not fully anticipate this.
For now there is no actual need for anti-virus anti-malware tools on Android for most users. But as always, the problem is a user education problem.