Music and Movies Could Trigger Mobile Malware 88
mask.of.sanity writes "Lights, sounds and magnetic fields can be used to activate malware on phones, new research has found. The lab-style attacks defined in a paper (PDF) used pre-defined signals hidden in songs and TV programmes as a trigger to activate embedded malware. Malware once activated would carry out programmed attacks either by itself or as part of a wider botnet of mobile devices."
Re:A good reason (Score:5, Interesting)
When it comes to computer systems, there are two camps -- freedom and not-freedom. The not-freedom camp, just as here in the good old USA, believes that we must remove freedom to remain safe. The freedom camp says life without freedom is slavery.
Both sides suffer from some common problems. Among these is that people are curious and want things. The more they want things, the more stupid they become when they want to have it. A lock on a door doesn't stop a criminal and doesn't stop a curious person. And in either camp, there are curious, stupid people who are willing to put aside good sense and caution to get what they want. It happens in every walk of life and in every environment.
Regardless of which camp you live, in the end, caution, care and restraint does the most to keep one's self safe but one always has to acknowledge there is no 100% safe if something is to be useful. Anything useful can be dangerous or safe depending on how it's used. (INB4 some jackass creates a list of 'safe things that cannot possibly be dangerous.')
I'm not denying that the AV people are intentionally stirring up fears in order to further their business models. Of that I have no doubt. And I think it is unquestionably true that more modern OS implementations are written with security in mind unlike Windows. Neither of these facts mean as much as knowledge and good practice. And isn't that what AV software is supposed to be a substitute for?
"Anti-virus software -- it's so you don't have to learn to take care of yourself!"
I run without AV 24/7 on all of my devices and some occasionally run Windows!! Shocked?! Well, I'm smart enough to run something other than MSIE and I don't run Javascript on every page from every source, I block ads and I don't run software (especially on Windows) that I don't know about. ALSO, I mitigate the possible damage which could be done in the event of compromise.
Why do people constantly tell you how important education is while at the same time avoid knowledge and wisdom at every possible opportunity? I get it -- for an advanced culture, we have to specialize. That's great. I don't make my own automobiles. But I do know how they work and have been known to fix them from time to time, just as I do computers of all sorts (laptops, desktops, servers, tablets, phones, video players, gaming consoles).
Nothing I say here or anywhere will convince people that their thinking is wrong though -- being wrong is not something easy for most people to admit -- it's their identity being called into question after all. So am I wasting my time here with this comment? I don't know... once in a while someone will read something I write and think about it.
Anti-malware -- so you don't have to take care of yourself.
I don't think I can distill that notion any further.
Re:A good reason (Score:5, Interesting)
A better reason to ignore the torrent of mobile malware FUD being spewed by all the Windows AV vendors.
They're terrified because their business model involves being parasites bandaiding a virus ridden OS that's now failing in the market. Like fleas without a dog, hey're desperate to find a new host, but since modern mobile OSs aren't as colander-like as Windows, they're being forced further and further into snake-oil realms.
This story deserves nothing but ridicule.
I'm an Android user myself, but I think we need to be careful with this sentiment. For Mac users this kind of sentiment led to OS-X Flashback being the biggest malware epidemic in modern times in terms of percentage of user base infected. Beating Windows Conficker for this honor. [pcworld.com] Yes, the number of Windows users are obviously larger, but in terms of infection risk and infectability of a platform, percentage of user base is the right measure.
Later versions of Flashback even did completely silent drive-by infection on OS-X, no user interaction or admin password needed, just visiting a web site was enough, something many Mac users still seem to think only happen on Windows. Even Apple has admitted that Unix-based OS-X need dedicated malware detection and cleaner tools.
There is a very sophisticated multi-billion dollar malware industry out there. Android is not immune to this threat. And its volume is making it an increasingly likely target. Especially since the far majority of the Android user base is on old vulnerable versions, with added vulnerabilities from handset makers and operators, long after Google has patched vulnerabilities and improved security.
Re:A good reason (Score:5, Interesting)
"Anti-virus software -- it's so you don't have to learn to take care of yourself!"
I run without AV 24/7 on all of my devices and some occasionally run Windows!! Shocked?! Well, I'm smart enough to run something other than MSIE and I don't run Javascript on every page from every source, I block ads and I don't run software (especially on Windows) that I don't know about. ALSO, I mitigate the possible damage which could be done in the event of compromise.
Neat. So you've made a life-style and time consuming hobby out of running Windows without anti-virus. And it sounds like it is working for you. Today. Maybe your strategy works tomorrow too. Or maybe it doesn't because of something you didn't expect.
Let's say your method works 100%. How does this benefit grandma? Or a 9-old-year who likes to play Minecraft?
If your "lifestyle" or "hobby" can't be done by stupid people, you can't by defintiion be a "leader" because those people can't follow.
No I'm not defending anti-virus, I'm insulting Windows and how you are essentially making excuses for insecurities. They don't get solved by ignoring them, you know.
Comment removed (Score:5, Interesting)
Re:A good reason (Score:4, Interesting)
"Fortress of unassailability called SCADA and other embedded OSes"?? You're being sarcastic [wikipedia.org], right? I think you know that you are.
But "we'll have malware researchers because malware is lucrative enough to always be there" does not catch all of the reasons. What about Stuxnet [wikipedia.org] ???
Stuxnet was made to be the governmental motive (of Israel and the USA) state-sponsored disruption of SCADA hardware with one particular type of facility in mind: centrifuges in the service of uranium enrichment. So profitability and money-making was not the motive there. The motive appears to have been state-sponsored disruption of another state's actions, and also appeared to be the first rootkit pointed against PLCs (http://en.wikipedia.org/wiki/Programmable_logic_controller [slashdot.org]>programmable logic controller).
http://en.wikipedia.org/wiki/SCADA#Security_issues [wikipedia.org]