Music and Movies Could Trigger Mobile Malware 88
mask.of.sanity writes "Lights, sounds and magnetic fields can be used to activate malware on phones, new research has found. The lab-style attacks defined in a paper (PDF) used pre-defined signals hidden in songs and TV programmes as a trigger to activate embedded malware. Malware once activated would carry out programmed attacks either by itself or as part of a wider botnet of mobile devices."
A good reason (Score:5, Informative)
Re:A good reason (Score:5, Insightful)
A better reason to ignore the torrent of mobile malware FUD being spewed by all the Windows AV vendors.
They're terrified because their business model involves being parasites bandaiding a virus ridden OS that's now failing in the market. Like fleas without a dog, hey're desperate to find a new host, but since modern mobile OSs aren't as colander-like as Windows, they're being forced further and further into snake-oil realms.
This story deserves nothing but ridicule.
Re: (Score:2)
Re:A good reason (Score:5, Interesting)
When it comes to computer systems, there are two camps -- freedom and not-freedom. The not-freedom camp, just as here in the good old USA, believes that we must remove freedom to remain safe. The freedom camp says life without freedom is slavery.
Both sides suffer from some common problems. Among these is that people are curious and want things. The more they want things, the more stupid they become when they want to have it. A lock on a door doesn't stop a criminal and doesn't stop a curious person. And in either camp, there are curious, stupid people who are willing to put aside good sense and caution to get what they want. It happens in every walk of life and in every environment.
Regardless of which camp you live, in the end, caution, care and restraint does the most to keep one's self safe but one always has to acknowledge there is no 100% safe if something is to be useful. Anything useful can be dangerous or safe depending on how it's used. (INB4 some jackass creates a list of 'safe things that cannot possibly be dangerous.')
I'm not denying that the AV people are intentionally stirring up fears in order to further their business models. Of that I have no doubt. And I think it is unquestionably true that more modern OS implementations are written with security in mind unlike Windows. Neither of these facts mean as much as knowledge and good practice. And isn't that what AV software is supposed to be a substitute for?
"Anti-virus software -- it's so you don't have to learn to take care of yourself!"
I run without AV 24/7 on all of my devices and some occasionally run Windows!! Shocked?! Well, I'm smart enough to run something other than MSIE and I don't run Javascript on every page from every source, I block ads and I don't run software (especially on Windows) that I don't know about. ALSO, I mitigate the possible damage which could be done in the event of compromise.
Why do people constantly tell you how important education is while at the same time avoid knowledge and wisdom at every possible opportunity? I get it -- for an advanced culture, we have to specialize. That's great. I don't make my own automobiles. But I do know how they work and have been known to fix them from time to time, just as I do computers of all sorts (laptops, desktops, servers, tablets, phones, video players, gaming consoles).
Nothing I say here or anywhere will convince people that their thinking is wrong though -- being wrong is not something easy for most people to admit -- it's their identity being called into question after all. So am I wasting my time here with this comment? I don't know... once in a while someone will read something I write and think about it.
Anti-malware -- so you don't have to take care of yourself.
I don't think I can distill that notion any further.
Re:A good reason (Score:5, Insightful)
You, me, and a few thousand professionals and "power users" got your message years ago. What was true in 1995 remains true. System integrity is the owner's responsibility.
One thing that hasn't been fixed is the millions of teenage girls, grandmothers, and neckbeards clicking on every widget that pops on a screen, and falling for every "fix your PC" gimmick they see.
It all boils down to, "You can't fix stupid."
Re: (Score:1)
It all boils down to, "You can't fix stupid."
No, but you can fix ignorant. Don't confuse the two. The AV people have a vested interest in keeping the ordinary user ignorant since they first started.
Re: (Score:1)
Neckbeards made your computer and the systems and programs you run on it you insensitive clod!
Re: (Score:1)
The funny thing is, you don't really need to know more. The skill to avoid being scammed in real life can easily be applied to computers.
Re:A good reason (Score:5, Interesting)
"Anti-virus software -- it's so you don't have to learn to take care of yourself!"
I run without AV 24/7 on all of my devices and some occasionally run Windows!! Shocked?! Well, I'm smart enough to run something other than MSIE and I don't run Javascript on every page from every source, I block ads and I don't run software (especially on Windows) that I don't know about. ALSO, I mitigate the possible damage which could be done in the event of compromise.
Neat. So you've made a life-style and time consuming hobby out of running Windows without anti-virus. And it sounds like it is working for you. Today. Maybe your strategy works tomorrow too. Or maybe it doesn't because of something you didn't expect.
Let's say your method works 100%. How does this benefit grandma? Or a 9-old-year who likes to play Minecraft?
If your "lifestyle" or "hobby" can't be done by stupid people, you can't by defintiion be a "leader" because those people can't follow.
No I'm not defending anti-virus, I'm insulting Windows and how you are essentially making excuses for insecurities. They don't get solved by ignoring them, you know.
Re: (Score:3)
Don't you love your grandma? The woman who is partially responsible for your existence? Why are grandparents always painted as if they are stupid? (while the rest of everyone else is painted as if they aren't?) Got some news for you sonny. People who were smart when they were younger don't lose all that much when they get older -- unless outside forces take some toll along the way. And a 9 year old? Really? The things I did when I was 9? The things my sons did when they were 9? Geez. Let's stop thi
Re: (Score:2)
I'm sorry... but "pay-walled"? I think I know what you're meaning to say, but pay-wall...? I think it doesn't mean what you think it means.
As far as "just works" goes, I understand what you mean, but Ubuntu "just works" often as well. So it has come down to this for my son: (Not an IT guy of any sort or by any means)
For anything chat/Internet, he uses his Ubuntu netbook. For games or anything else (non-internet) he uses his Windows machine. You somehow catch almost 0 malware when not using your machine
Re: (Score:2)
Don't you love your grandma? The woman who is partially responsible for your existence? Why are grandparents always painted as if they are stupid? (while the rest of everyone else is painted as if they aren't?)
I love both my grandmas, and neither of them are stupid. But neither of them would know which way up a computer is supposed to go, let alone how to protect one from malware. Neither of them have ever owned a computer, so they know as much about them as I do about sailing a boat (which is to say- nothing).
My grandparents-in-law DO own a computer- I built them their first ever computer last year, at their request (Ubuntu, since you ask). Again, bright and clever people both of them, and they've taught themsel
Re: (Score:1)
Re: (Score:1, Insightful)
Anti-malware -- so you don't have to take care of yourself.
Anti-malware -- BECAUSE SOMETIMES SHIT HAPPENS.
FTFY
Re: (Score:3)
Precisely.
But there's one very real problem with this. Most computer users are simply that - end users of a device which they use for work and recreation that was sold as an appliance when the 'pc' got beyond the hobbyist phase. Expecting these people to know and do what a small group of sophisticated cognescenti do is ridiculous, and I think you can recognize that.
Thus the flood of infected machines, bots, and vendors of free and paid anti- this and that and the high fees charged to 'fix' things. (Not t
Re:A good reason (Score:5, Interesting)
A better reason to ignore the torrent of mobile malware FUD being spewed by all the Windows AV vendors.
They're terrified because their business model involves being parasites bandaiding a virus ridden OS that's now failing in the market. Like fleas without a dog, hey're desperate to find a new host, but since modern mobile OSs aren't as colander-like as Windows, they're being forced further and further into snake-oil realms.
This story deserves nothing but ridicule.
I'm an Android user myself, but I think we need to be careful with this sentiment. For Mac users this kind of sentiment led to OS-X Flashback being the biggest malware epidemic in modern times in terms of percentage of user base infected. Beating Windows Conficker for this honor. [pcworld.com] Yes, the number of Windows users are obviously larger, but in terms of infection risk and infectability of a platform, percentage of user base is the right measure.
Later versions of Flashback even did completely silent drive-by infection on OS-X, no user interaction or admin password needed, just visiting a web site was enough, something many Mac users still seem to think only happen on Windows. Even Apple has admitted that Unix-based OS-X need dedicated malware detection and cleaner tools.
There is a very sophisticated multi-billion dollar malware industry out there. Android is not immune to this threat. And its volume is making it an increasingly likely target. Especially since the far majority of the Android user base is on old vulnerable versions, with added vulnerabilities from handset makers and operators, long after Google has patched vulnerabilities and improved security.
Re:A good reason (Score:4, Insightful)
And since right now we live in a world where ridiculous flaws actually make it to production, the manufacturers are often too incompetent to release a fix and perfectly normal ad networks unwittingly distributing malware (and perfectly normal websites having vulnerable backends) is not unheard of, we can't assume that restricting your browsing behavior to legit-looking sites is going to keep your system safe.
It's up to each of us to decide whether we need AV on our devices but just assuming that a device is secure just because it doesn't run on the NT kernel is delusional. For crying out loud, everyone who has an Exynos 4-based smartphone has the contents of their RAM world-readable and world-writable!
Re:A good reason (Score:4, Interesting)
"Fortress of unassailability called SCADA and other embedded OSes"?? You're being sarcastic [wikipedia.org], right? I think you know that you are.
But "we'll have malware researchers because malware is lucrative enough to always be there" does not catch all of the reasons. What about Stuxnet [wikipedia.org] ???
Stuxnet was made to be the governmental motive (of Israel and the USA) state-sponsored disruption of SCADA hardware with one particular type of facility in mind: centrifuges in the service of uranium enrichment. So profitability and money-making was not the motive there. The motive appears to have been state-sponsored disruption of another state's actions, and also appeared to be the first rootkit pointed against PLCs (http://en.wikipedia.org/wiki/Programmable_logic_controller [slashdot.org]>programmable logic controller).
http://en.wikipedia.org/wiki/SCADA#Security_issues [wikipedia.org]
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
There are many anti-virus programmes for Mac, including most of the same big names as for Windows. A quick Google search led me to this site with reviews and whatnot:
http://www.antivirusformac.org/ [antivirusformac.org]
They're out there for Linux too (not least the ever trusty ClamAV). If you don't have AV on your Mac or Linux box, it's because you don't think you need it, not because it isn't available.
Re: (Score:1)
Who are the group-think emos that modded this worthless and unsubstantiated rant up?
Challenge to one the diptards that modded this up: exactly how is that post insightful? Does it provide evidence, a link, cite information, provide something new no one has ever heard before? If not, what is your justification for rating a run-of-the-mill rant insightful?
Re: (Score:2)
Not that I like defending Microsoft and AV vendors but the virus infested envorinment isn't their fault. Net worms and OS exploits do exist, but are a minority compared to trojans malware that people install because they wanted to do something else. Warez oviously plays a role but you can get root kits from "legitime" vendors like Sony. Nothing is safe.
The only solution is fine grained control and there isn't such thing in the market. Android is the most secure design I can think of and it's still not enoug
Comment removed (Score:5, Interesting)
And the only thing I could think off... (Score:5, Funny)
Was a dingy rustic bar with Malcolm sitting talking to two twins and an ad appearing on TV for Fruity Oaty Bar...
Miranda...
Re: (Score:2)
Except in fantasy land it wasn't mandatory. Here in reality ....
Miranda (Score:2, Funny)
Fruity oaty bar
Make a man out of a mouse
Fruity oaty bar
Make you bust out of your blouse
Eat them all the time
They will blow your mind
Wo hen jiaonian diu lian - wo meiyou chi Fruity Oaty Bar!
Fruity oaty bars
Fruity oaty bars
Better Use (Score:2)
Perhaps the phone could issue an alert if the movie you sat down to watch had a Rotten Tomatoes score below 30%...
Really? (Score:2, Insightful)
Wouldn't the app have to carry the malware payload?
Battlestar Galactica (Score:1)
Isn't that the way the Cylons deactivated the Colonial ships in the BSG miniseries? Already installed malware activated when the sensors picked up a certain signal from the Cylons?
Lame (Score:5, Insightful)
Lame article.
If you're already infected by malware, that malware can sit there and wait to do stuff any time it wants. Not exactly a big surprise.
-
Re:Lame (Score:5, Insightful)
Bingo. I'd mod you up if I had the points.
Forget malware, what they're saying is that "software" can respond to input to trigger subroutines.
Which is shocking... I'm shocked... aren't you? We're both shocked... it's shocking.
So yeah... stupid article.
Re: (Score:2)
Add a couple of nine volt batteries, a wire and yes, I'm shocked as well.
Re: (Score:2)
How about 244 [youtube.com] of them?
Re:Lame (Score:5, Insightful)
This is just fear mongering. If you've already put malware on your phone then you're boned - there are countless ways it may "activate" itself - whatever that means. Just more crap from anti virus software companies whose products are worse than the malware they're meant to prevent.
Re:Lame (Score:5, Insightful)
and if you have malware doing constant audio/light analyzing then at least you don't need to worry about it malwareing about too long.
because you'll run out of battery pretty fast.
Re:Lame (Score:5, Insightful)
If you're already infected by malware, that malware can sit there and wait to do stuff any time it wants. Not exactly a big surprise.
-
Yes, the word "research" seems to be used rather loosely in that article.
Any input into a smartphone can be used to launch any app listening for it. This could be gps coords, barometric pressure, direction from the built in compass...
Well it is University of Alabama, perhaps we should be just grateful that they are studying something other than intelligent design [wikipedia.org].
Re: (Score:1)
You would do well to read the article just a bit more carefully
It can use the sensors to launch coordinated attacks. Not just deploy when it hears a certain sound.
Re: (Score:1)
It IS slightly interesting in that most malware is detected by it's effects. If your malware spreads slowly and has no obvious effect until activated, there;s a good chance nobody will notice it. If you rely on a timer to activate your malware (or checking a C&C IRC channel or the like), it could still be picked up by someone running a honeypot VM. But if your malware only activates in, say, a 2Hz magnetic field, then that's not something that's normally tested for.
Outside rampant paranoia about nationa
Re: (Score:2)
You're telling me that not having music and movies playing can also trigger the malware? It's unstoppable!
In tests, malware was only activated by one song (Score:5, Funny)
Re: (Score:1)
Re:In tests, malware was only activated by one son (Score:4, Funny)
I can't believe no one has said this: (Score:2)
I know, Lame.
-I'm just sayin'
Weirding comes to phones (Score:3, Funny)
I can just see it now. In a screening of the 1984 "Dune" flick or a superior remake, Paul Muadib is growling away working his weirding magic while everyone who left their phones on in the theater explodes.
Re: (Score:1)
How's life in the Embassy? Are you getting out at all?
finally. (Score:1)
research has proven the existance of the conditional statement.
Copyright conspiracy theory: (Score:2)
Re:Copyright conspiracy theory: (Score:5, Informative)
Current Blu-ray players are already infected with malware that shuts them down when a certain pattern of sounds is detected:
http://en.wikipedia.org/wiki/Cinavia [wikipedia.org]
Re: (Score:2)
It's like the AAs want to piss off all three self-aware people that were still thinking of supporting their cause and business with a video purchase. I guess when you've bought your very own government lobby-lackeys, you don't need those pesky, annoying "customer" things anymore.
Breaking news!! (Or just another PR puff piece). (Score:5, Insightful)
Seriously, what kind of nonsense is this? They *could* also use your GPS / network location to activate only in a specific location, or the compass to activate only when the phone faces Mecca, or the tilt sensor and camera together to activate only when you're trying to shoot a level picture, or
It makes not one jot of difference what they use as a trigger once your phone is compromised. The point is, it's already been compromised, and it's effectively wide-open to anything the hardware is physically capable of. How it was compromised in the first place is what's important, not meaningless conjecture on how the exploit's eventual activation can be timed in the least efficient way possible. (All this nonsensical idea would do is drain your battery in no time by holding the mic and processor active all the time, thereby ensuring the phone runs out of battery before the exploit activates.)
I mourn for the days when Slashdot posted intelligent tech articles, instead of a stream of PR puff pieces designed to spread FUD and generate clicks. There is not one useful or non-obvious piece of info in this "research".
Re:Breaking news!! (Or just another PR puff piece) (Score:5, Funny)
You are missing the point. Being triggered by sound or light means the malware can be activate by a global hack on the world's TV stations, just like happens on bad sci-fi series.
Android devices world wide will rise up and take over when the call to arms comes over the airwaves. I'm imagining a nightmarishly robotic and shadowy figure flickering across billions of TV screens, screaming "ACTIVATE! ACTIVATE!"
At that point the malware Android army will simultaneously post inane and vague status updates onto everyone's Facebook, then self destruct. No-one will be able to reply except for users of Apple and Windows, and all Android users will wither and die alone in a desert of dis-communication.
That's the nightmare scenario the writers of this dumb study had in mind, isn't it?
Can't stop the signal (Score:2)
You mainly have to beware of commercials for Fruity Oaty Bar and other Blue Sun products.
Re: (Score:2)
Re: (Score:2)
Maybe you already have the code just from clicking to that web page. Or maybe not. Given your description of it I should probably not click the page to check for myself. :)
No they have not "found" (Score:1)
They have not "found" anything. I am not a native English speaker, so I feel I am missing the right word, but they have "theorized" or "speculated", and then realized, that a program in full control of a device with sensors, can use said sensors as inputs...
and...? (Score:2)
So what - anything can be used to trigger malware.
Re: (Score:2)
So what - anything can be used to trigger malware.
Hush. Don't you know that lots of people need to finish their PhD:s?
So what? (Score:4, Insightful)
The article makes this sound like its some new threat. Nobody has figured a way to infect your phone with malware by playing music or sowing a film, just trigger malware to do something whe. The phones sensors detect theses things. You have to have already been compromised via some more conventional vector.
So the question is why would anyone go to the trouble? I guess it could replace a command and control channel, I want my dodos to start at 8pm so have everyone's phone listen for the television themes for "the orrifice" or "CSI Newark", great but that is hardly a threat to mobile users more of an issue for carriers and ddos targets, who no longer have an irc channel to shut down or Dns entry to have the FBI yank but still not of great concern
Re: (Score:2)
Malware triggering on a specific time and date was common back in the days where the keyboard was the only input device on a typical PC, and even the fastest CPUs could not do signal processing in real time.
Back t hen It wasn't hard to trigger at a specific time, all it had to do was check the clock, which all PCs were equipped
Public Service "Malware" (Score:5, Funny)
Re: (Score:1)
You can't deploy a technical fix to a social problem. People need to learn not to ruin things for other people in shared spaces, people need to learn to expect that from others, and people need to learn to back up the guys who are are going to stand up for it.
What's the point if the phone's got malware anyway (Score:4, Insightful)
What is this, malware written by Dr. Evil? What's the benefit of all these overly-elaborate and exotic malware triggers when you already have malware installed that has taken over the phone? Why not just trigger it on a timer to poll a command and control server? If you want to target specific buildings you can just base it on GPS location or known wifi points etc.
Re: (Score:2)
I suppose it could be used to blackmail hipster by threatening to reveal their listen history to one another...
Old News? (Score:1)
Stephenson was right (Score:1)
Cue the Namshubs....
I'd vote for ... (Score:2)
Halloween III (Score:2)
So what? (Score:2)
ANY signal that can be picked by the phone could be used by running malware to activate itself. It could trigger literally by holding it wrong, or being in the wrong place at the wrong time, is not something to particulary worry about, you have it running already, so the max damage they can do is not tied specifically to a random trigger.
Now, if we are talking about triggering the malware when it detects an open wifi, gets an internet connection, connect with a banking site, take a picture, or when you sen
Firefly (Score:2)
Really? 12 hours of comments and nobody's mentioned the parallel to Firefly yet?
Just picture it where River is your smartphone (that'd be one badass smartphone), and the malware is a program that kicks everybody's ass within a 100-foot radius.
I just hope the malware comes with a safe word.
Really? (Score:1)
That's like saying that a single dust mote can start a rainstorm, if there is a storm cloud there. So lets ban clouds!
If the device has malware, then all bets are off...