Database Users

Root and Malware?

Do we have to police our own apps to make sure no one is doing Keylogging or using our phones as zombies?

Treefallingquietly said:
Do we have to police our own apps to make sure no one is doing Keylogging or using our phones as zombies?
Click to expand...
Click to collapse
By "our own apps" what do you mean exactly? For the most part the people in this community are trustworthy. There have been some who were not so trustworthy but they are weeded out quickly. I say there is no need to worry about that.

"our own Apps" = The apps we install to our phones from the various sources.

Treefallingquietly said:
Do we have to police our own apps to make sure no one is doing Keylogging or using our phones as zombies?
Click to expand...
Click to collapse
It's a good practice to do anyways...check your sources and such (regardless of whether or not you had root). There's been more than enough stories of even legitimate apps on the iPhone App Store that were doing less than savory things.
Just be safe, make sure it's from a reputable source and if you don't have a need to be on the bleeding edge, stick with things tried and true and reviewed by a large number of people. (It's just an OS like any OS...it has it's vulnerabilities, just gotta be careful ^_^)

is there any type of Anti Virus or Firewall that we should run if we have root? Not familiar enough with android to answer this myself.
Thanks in advance!

i think there is, but why? theres no replacement for just being careful. I hate that people think they NEED an antivirus... keep current on updates, and dont be retarded, problem solved. (oh yeah, the program "Superuser Permissions" will prompt you when something needs root access, this will prevent unauthorized apps from unintentionally running)

The app on MoDaCo's 1.1 rom, "Superuser Permissions" helps with this (EDIT, just saw jmhalder beat me to this.) It asks you each time root access is requested, and you can choose to allow/deny or always allow/always deny. This is a firewall of sorts if you think about it. I most certainly would NOT choose to always allow, unless of course, I wrote the app myself.
It's good practice to police your own stuff. Be careful, because there ARE bad people out there, that would like nothing better than to screw up your stuff just for the fun of it.
Bottom line, as a previous poster mentioned, do your homework!

New Android Virus from China?

At the company I work for, an email came out from our care group that I thought everyone might find interesting. When I first read it, I immediately thought of the MIUI ROM that I installed....
"A new virus infecting the android based phones has been detected in china.It is being said that this is by far the most complicated and sophisticated Android virus that the security firm has come across.This virus is being dubbed as ‘Gemini’ and it has the capability of being remotely operated by the hacker once it is in the phone.Though many viruses have been detected earlier in Android apps. but this the is most sophisticated among all of them.
The Botnet feature of the virus is the major concern.Once the malware is completely installed on the user’s phone, it has the potential to receive commands from a remote server that allows the hacker to access the user’s data and all personal stuff.Once the privacy of the user is compromised,the hacker can do anything he wish to do.
Lookout mobile security,who basically detected this virus said that Gemini uses advanced and sophisticated techniques to hide it’s track.They also said that that the virus is capable of sending location coordinates and device identifiers to the remote server, helping it to generate a list of all installed apps on the infected phone and to install more infected ones.
All the infected applications that have yet come up have been downloaded from a third party Chinese application market. “Geinimi is effectively being ‘grafted’ onto repackaged versions of legitimate applications, primarily games, and distributed in third-party Chinese Android app markets,” the company wrote in a blog post.On the other hand,the same applications that are downloaded from official Android application market are safe.
Although it is not very clear that what actually is the intent of the authors of Gemini.The chief technology officer for Lookout,Kevin mahaffy said that “It could be anything from a malicious advertising network to an attempt to create a botnet”.Botnet basically is a group of infected computers or phones that the attacker controls to compromise for data and identity theft and also it can be used to launch attack on other machines.
The application which are grafted with virus are mostly games and a few applications.Some among them are:
• Monkey Jump 2
• Sex Positions
• President vs. Aliens
• City Defense
• Baseball Superstars 2010.
Here’s how it works:
When a host application containing Geinimi is installed on a client’s phone, the Trojan gets activated in the background and collects information that can compromise a user’s privacy.Geinimi attempts to connect to a remote server using one of 10 embedded domain names. If it connects, Geinimi transmits collected information to the remote server."

here you go http://www.msnbc.msn.com/id/40857219/ns/technology_and_science-wireless/

Interesting read. I wonder: If the infected app is removed, does the virus get removed with it?

rugedraw said:
Interesting read. I wonder: If the infected app is removed, does the virus get removed with it?
Click to expand...
Click to collapse
that would make for a pretty ineffective trojan. I highly doubt it.

also, as per the msnbc article, the virus is named "Geinimi," not "Gemini." Although I guarantee everyone will call it gemini because it's so much easier, at least to an english speaker.

Old news.
cjh6386 said:
that would make for a pretty ineffective trojan. I highly doubt it.
Click to expand...
Click to collapse
It does get removed if you remove it from applications. The only way it wouldn't get removed is if the app were to root the device first, and then push the apk to the apps folder. but this one doesnt do that.

I'm honestly surprised there aren't more of them out there, it would be way to easy to do.
Sent from my PC36100 using XDA App

cjh6386 said:
that would make for a pretty ineffective trojan. I highly doubt it.
Click to expand...
Click to collapse
Good point......I'm just not sure how viruses affect our phones compared to how they affect Windows based PC's.
Last-Chance said:
Old news.
It does get removed if you remove it from applications. The only way it wouldn't get removed is if the app were to root the device first, and then push the apk to the apps folder. but this one doesnt do that.
Click to expand...
Click to collapse
Even then, you would still be able to remove it manually from the apps folder, no? Providing the user has root access, of course.

This is bull****. Why can't they leave viruses for windows computers?
Sent From My HTC Evo 4G On The Now Network From Sprint Using Tapatalk Pro!

I guess it's becoming an issue with the carriers too since our Care department is now getting swamped with calls from people who either "think" they're phones are infected or read that MSNBC article.....
In any event, I have to admit that I didn't even give it a thought that I might get a virus on my phone. I actually even saw quite a few virus programs on the Market and just ignored them. I'll now have to revisit that option, especially since I'm installing ROMS from every source that posts them....

rugedraw said:
Good point......I'm just not sure how viruses affect our phones compared to how they affect Windows based PC's.
Even then, you would still be able to remove it manually from the apps folder, no? Providing the user has root access, of course.
Click to expand...
Click to collapse
probably, but if the app is smart enough to root android devices, chances are its smart enough to hide itself. With root access it can pretty much do anything it wants, including hiding itself, as well as accessing other programs, and what not.

Would a nand restore get rid of it?
Sent from my HTC Supersonic

If it needs root access to do it's thing, wouldn't that trigger the superuser app? And if a game triggers the superuser app, and a person clicks on "Allow"...then...maybe they deserve to be infected.

From what I remember of reading about this virus, it only affected users in China who downloaded it from a third-party market application and not Google's Android Market.

Viruses in android doesn't make any sense to me at all. Since android is so different. As another poster stated, doing a nand is in essence like wiping the total system, correct?
Sent from the Evo 4G

dglowe343 said:
Would a nand restore get rid of it?
Sent from my HTC Supersonic
Click to expand...
Click to collapse
in essence yes. But a person smart enough to code a virus that roots devices is probably smart enough to backdoor nand restore points as well.
Holyrolla said:
If it needs root access to do it's thing, wouldn't that trigger the superuser app? And if a game triggers the superuser app, and a person clicks on "Allow"...then...maybe they deserve to be infected.
Click to expand...
Click to collapse
The chinese one doesn't need root. I was just saying that if it had root it would be a lot harder to remove. And the app is binded to other programs, so the person will probably not even know that the legit one doesnt require superuser.
mbaseball3 said:
Viruses in android doesn't make any sense to me at all. Since android is so different. As another poster stated, doing a nand is in essence like wiping the total system, correct?
Sent from the Evo 4G
Click to expand...
Click to collapse
Why doesn't it? Millions of dollars are stolen each year by criminals that infect phones in order to dial out premium numbers.

Last-Chance said:
in essence yes. But a person smart enough to code a virus that roots devices is probably smart enough to backdoor nand restore points as well.
Click to expand...
Click to collapse
fear monger much?
EDIT: for those curious he's just drumming up nonsense to see if he can get you in a frenzy ... that or has has NO CLUE what he's talking about.
Even if someone was stupid enough to "Accept default permissions" and not question why your video game that you downloaded from a third party marketplace with "allow unknown sources to be installed" flag set needs to look at your phone calls and personal contacts ... there would still be a popup by superuser the moment it tried to do something that required root.
It's a perfect storm trojan: no more a risk to your phone than a phishing site is to your identity: that is a huge problem if you're an idiot.

Justin.G11 said:
fear monger much?
EDIT: for those curious he's just drumming up nonsense to see if he can get you in a frenzy ... that or has has NO CLUE what he's talking about.
Even if someone was stupid enough to "Accept default permissions" and not question why your video game that you downloaded from a third party marketplace with "allow unknown sources to be installed" flag set needs to look at your phone calls and personal contacts ... there would still be a popup by superuser the moment it tried to do something that required root.
It's a perfect storm trojan: no more a risk to your phone than a phishing site is to your identity: that is a huge problem if you're an idiot.
Click to expand...
Click to collapse
yea bro, cause you know what you are talking about. How about you actually look up **** before talking.
1. A 3rd party app can simply ask for 1 permission, then root the phone and gain wide variety of permissions. When i say root, i dont mean the same way as you see here. It will gain permissions beyond what normal apps do. It wont ask for superuser permissions. It will only ask for 1 permission on install
2. Did you know that there is a Buffer overflow available on all phones that are running 2.1 of android? Did you also know that there is a buffer overflow for all androids that are running the latest webkit on 2.2? apparently not. fyi, a buffer overflow in a browser can represent a huge risk, meaning visiting a website that is infected will in return infect you. A buffer overflow will also not ask for any permissions and load a malicious application straight to your phone.
Next time when you talk to someone as if they were a kid, make sure that person doesn't happen to have a CS degree, and 8+ years of experience in computer security. Now gtfo.

those chinese have a strange sense of humor, I bet it started as a prank by some drunk college students to see if they could do something small that would make americans even more paranoid

NewZJ said:
those chinese have a strange sense of humor, I bet it started as a prank by some drunk college students to see if they could do something small that would make americans even more paranoid
Click to expand...
Click to collapse
if you call being charged 100s of dollars on your bill because some virus made phone calls to premium rate numbers a joke, then yes they are very funny.

With all the talk about viruses on Android,is there an Anti-virus that actually works

Just wondering if there is one that will actually work etc? Seems like troll food for now, at least to me. Id like to get one that works, but is it necessary?

Lookout mobile security is good I have it and it works great, Lookout was the company that detected the Trojan Horse in the China market.

I use lookout also on 2 phones. Dont know how good it really is but it better than nothing.

+1 for lookout

Lookout has, in some people's experience, drained the battery.
Best anti-virus? COMMON. SENSE. If an app is asking for the permission to call numbers, send text messages, and access your Google account, OR, asks for root permissions, when it's supposed to be a wallpaper bundle, DON'T INSTALL IT.
Furthermore, DO NOT USE PIRATED CRAP. If you read the articles Lookout's posted about the malware going around, it's all from secondary or untrustworthy alternatives to the Android Market, or from pirate sites.
Really, for everything on the Market that costs money, there's some kind of free alternative. Or you could always, y'know, spend $2 to buy that app. After all you did buy a $450 phone with a monthly bill of no less than $70...

I think Lookout is shady. A lot of these companies create viruses so they could increase their user base.
Aforementioned, don't install an app that demands access to personal and sensitive stuff. That's the main giveaway.

Lookout is one of the only companies that has something to gain from the existence of viruses and since they are pretty much the only company who ever finds and reports about these viruses, gotta take that info with a grain of salt. Like previously stated, common sense will keep your phone safe
Sent from my PC36100 using XDA App

drmacinyasha said:
Really, for everything on the Market that costs money, there's some kind of free alternative. Or you could always, y'know, spend $2 to buy that app. After all you did buy a $450 phone with a monthly bill of no less than $70...
Click to expand...
Click to collapse
That's no fun
Sent on the go from my HTC EVO

I have lookout, works fine. I'm confident in it.
Using my HTC Evo phone which I'm using Xda app to post

i wish people would stop making virus' for our phones. =/

Rydah805 said:
i wish people would stop making virus' for our phones. =/
Click to expand...
Click to collapse
it's that or they get a real job, they can make more with viruses

Android is a linux based system and for Android currently only has one virus. If that says anything. Stop wasting your time on these bloatware apps, Linux does not get viruses. If you do, well I feel sorry for ya.

splmonster said:
Android is a linux based system and for Android currently only has one virus. If that says anything. Stop wasting your time on these bloatware apps, Linux does not get viruses. If you do, well I feel sorry for ya.
Click to expand...
Click to collapse
Wrong on your virus count and that Linux doesn't get viruses
http://www.kaspersky.com/viruswatchlite?search_virus=android&x=19&y=6&hour_offset=-9

There are no such thing as viruses for android. None - not a one - never has been, probably never will be barring some crazy zero day exploit is found (but a lot more platforms would be affected than just android.)
The only malware that exists for android are a few trojans, but you'll never run into the known ones since they are no longer on the market.
As for the unknown ones? Google removes them from the market once they are known, which means any kind of "anti-virus" software can only react about as fast as google can react, which makes any kind of "anti-virus" software superfluous. In other words, you don't need one, and if you buy one you're just wasting your money.
The only exception to this rule is if you download apk's from shady sources outside of the android market and install them, and if you do that indiscriminately, you're a moron.

Yea there is. Common sense.
Sent from my PC36100 using XDA App

Rakeesh_j said:
There are no such thing as viruses for android. None - not a one - never has been, probably never will be barring some crazy zero day exploit is found (but a lot more platforms would be affected than just android.)
Click to expand...
Click to collapse
Technically you are correct, a trojan is not a virus. As far as most smartphone users, the media and AV marketing is concerned they are the same. They screw up your phone. Barring pirated software it is still possible to infect a *nix based system. "Probably not" is not something you want to hear from admin on a network when it comes to infection.
I can give you and example but don't want to make my post a TL|DR (or get banned). The short version is:what phone to infect, what kernel, rooted, apps with SU, what should the virus do, injection point, carrier. The only things that makes *nix safer is, user permissions and that most of the coders are on a *nix OS and respect it.
To the OP, what you want is a security suite (AV,malware,locate,lock,erase) so look at Lookout. Also, are you running a stock rom or custom and if custom then which one? There's a fairly rom specific flaw in Lookout.

If anything I use lookout just for a sense of security. It doesn't take up that much space to me and regardless if how many viruses are out there, it makes me feel safer.
Sent from my PC36100 using Tapatalk

Anything anti-android is gay. Period!!!!
**Non-helpful post**

Lokifish said:
Technically you are correct, a trojan is not a virus. As far as most smartphone users, the media and AV marketing is concerned they are the same. They screw up your phone.
Click to expand...
Click to collapse
Ok name one that does, and how it does it.
As far as I'm aware, the only possible things they can do to harm you is:
- Steal your information
- Spy on you
- Send text messages that cost you money
None of the ones that exist in the wild are capable of causing any sort of damage to your phone.

Rakeesh_j said:
Ok name one that does, and how it does it.
As far as I'm aware, the only possible things they can do to harm you is:
- Steal your information
- Spy on you
- Send text messages that cost you money
None of the ones that exist in the wild are capable of causing any sort of damage to your phone.
Click to expand...
Click to collapse
Geinimi. Think of it as malicious bot-net attack for Android. It inits a backdoor and connects to a remote server. The remote server can then issues commands to download and prompt the user to install an app, prompt the user to uninstall an app, and to send a list of installed apps to the server, place phone calls, as well as the things you listed.
BTW remote deletion is built into Android. Look here:
http://www.h-online.com/open/news/i...oid-apps-from-smartphones-Update-1029188.html

[Q] Antivirus Software

Anyone using any that's good? I was using lookout, but I found it obtrusive and I want something worthwhile.

IlPapu said:
Anyone using any that's good? I was using lookout, but I found it obtrusive and I want something worthwhile.
Click to expand...
Click to collapse
Being these phones are Linux based most "virus" that are downloaded and installed (with user permission i remind you) are mal-ware.
There is no real reason to need one.
Just make sure you know where the apps are coming from and you shouldn't have a problem.

neidlinger said:
Being these phones are Linux based most "virus" that are downloaded and installed (with user permission i remind you) are mal-ware.
There is no real reason to need one.
Just make sure you know where the apps are coming from and you shouldn't have a problem.
Click to expand...
Click to collapse
As I stated in AC/AF forum. You have to understand the biggest threat *nix based system faces comes from the user itself who are danger to the system as they don't understand it. Now by default how the permission base structure was setup was designed to limit the access from rouge script or execute shell which was place remotely. For it to happen it didn't magically came on the local host it was done with the permission of the user unknowingly as they basically gave the rights away. This is why we say to new users not to run under usr root as even sufficient @wheel access they can do damage.
So when you download app specially you know who and you know where becareful make sure you read the permission that you grant the apps as it can connect, update, upload contents. Far as this thread goes its useless as virus scanner just waste resource which can be overcome with little caution or avoided totally with common sense.

You dont really have to worry about antivirus with android aslong as you dont let everything under the sun have its way with superuser. Theres not much that can go wrong past wipeing your contacts or something but thats a quick refresh on sync and there back. Really all u need is a good device finder something that can help you recover a stolen device or what ever. I use Mobile Defence and its almost out of beta so should be available on the market soon.

SoltyPK said:
You dont really have to worry about antivirus with android aslong as you dont let everything under the sun have its way with superuser. Theres not much that can go wrong past wipeing your contacts or something but thats a quick refresh on sync and there back. Really all u need is a good device finder something that can help you recover a stolen device or what ever. I use Mobile Defence and its almost out of beta so should be available on the market soon.
Click to expand...
Click to collapse
Do you even know what your talking about? Wiping contacts? Where did you get that from? That's least of the worst fear far as you know it can dail in some 900 number and charge you whatever money they want. They can even data mine and steal other info but antivirus wont help you only way you can be safe is follow common sense and not giving permission to things that's suspicious and asking for access to things it has no need for access to.
Sent from my HTC Glacier

SoltyPK said:
You dont really have to worry about antivirus with android....
Click to expand...
Click to collapse
I beg to differ. Just using one news source .. and articles from the last 30 days, I found the following Andriod malware news stories:
Infected Androids Run Up Big Texting Bills
Mobile Spyware Conferences Into Your Calls
New Android Malware Robs Bandwidth For Fake Searches
Security Warning Over Web-Based Android Market
Android isn't Windows, but it is susceptible to attack. It is a growing market (300,000+ phones activated daily), filled with non-technical, clueless users, as well.

Here's one more, from another news source, from yesterday. Fifty apps. Five-Zero. In Android Market:
Google Removes More Malware from Android Market

The only alternative app market I've ever seen is appbrain, and that re-routes you to the standard market. Why would you use something other than the android market? Outside of pirated apps, it seems pretty pointless. Am I missing something?

Well thats the beauty of open community even if anything does show up it is quickly identified and users blow the whistle on it. Other than that you need walgarden based market like Apple's App Store which takes time and forever to post as this is fine as is. This is why user recommendation is important and mostly everyone use similar.
Far as virus thing goes its pure void I mean if it was identified then the source wouldn't be available in first place. You DON'T need anything as thats what they want you to think as they pray on your fear to buy these BS app which you don't even need with little caution you can be safe.

^^^^ lol Blackshelf is never wrong
.. at least that's what he thinks... ARROGANT
sent from my rooted mytouch 4g

surfnhawaii808 said:
^^^^ lol Blackshelf is never wrong
.. at least that's what he thinks... ARROGANT
sent from my rooted mytouch 4g
Click to expand...
Click to collapse
So why don't you prove me wrong here? are you actually trying to debate this? Last time I checked I was the one behind *nix system for past 12+ years. Thats like driving your car with your eyes closed and when you get in accident you blame the car, no you only have yourself to blame. As this same concept apply for system. Fine lets drop this subject ill let you prove your own point so did you ever find the docs about your "VICC 4G Sim Card"? How did that go for ya? how do I get one? will you sell me one for $9.99? lol

So since I don't need antivirus, and mal-ware is all I am looking for, what then is the best methods for telling if an App is laced with mal-ware? I am very careful in what I grant SU access and look at the permission before I install. I usually install from the app market. Any other helpful hints?

Well when you need something as the community for recommendations on which app would be appropriate for your need I mean if you Google it you will find answer as I'm sure someone asked, this way based on top pick what everyone use you can get.
Second is be cautious and what I mean by that is look for abnormalities like the app is asking for permission which wouldn't have news for to function.
Third is the most important part to where you get it ask you can reduce the risk by downloading from app market and not downloading from 3rd party of by pirated *.apk's as you wont know where it came from or what it contained.
If you follow these simple methods you can reduce the risk factor by large margin, now I am no fool I know you still can get it even after this but this way it wont be long before someone blow the whistle on it and app gets pulled from the market. This is just common sense you should follow.
Sent from my HTC Glacier

Antivirus software?
The most widely used free anti-virus software is AVG from Grisoft which makes money by selling virus protection to small businesses. To promote this, it offers domestic users a very professional free version which allows regular updates.

Viruses & Malware

So besides Lookout, anyone know of any good anti-virus/malware apps?
Thanks

cabello80 said:
So besides Lookout, anyone know of any good anti-virus/malware apps?
Thanks
Click to expand...
Click to collapse
TBH, you don't need none of those, contrary to belief those companies are just trying to rip you off....Those viruses require you to install a apk to actually run, and they tell you the permissions needed...
http://www.engadget.com/2011/08/02/new-android-trojan-can-record-phone-calls-expose-your-embarrass/
I had thought you saw that article and then made this post, but you really don't need none. I've been using android for 2+ years and I never caught nothing, making a virus is possible, the person just has to know what they're doing.
P.S. that article is just taking shots at android, you have nothing to worry about

Ace42 said:
TBH, you don't need none of those, contrary to belief those companies are just trying to rip you off....Those viruses require you to install a apk to actually run, and they tell you the permissions needed...
http://www.engadget.com/2011/08/02/new-android-trojan-can-record-phone-calls-expose-your-embarrass/
I had thought you saw that article and then made this post, but you really don't need none. I've been using android for 2+ years and I never caught nothing, making a virus is possible, the person just has to know what they're doing.
P.S. that article is just taking shots at android, you have nothing to worry about
Click to expand...
Click to collapse
I am no expert, but what about a browser type attack? maybe an app couldn't "install" but it could run. Just like people found very very simple bufferover flow exploits for iphones. I am sure one is known for HTC glacier phones as well, even more so with the flash and java on web pages.
But i do agree, most likely the USER would have to install a bad app. Same thing with 99% of computers virus, people click that "install activeX" button all the time like retards

viper_1986_1986 said:
I am no expert, but what about a browser type attack? maybe an app couldn't "install" but it could run. Just like people found very very simple bufferover flow exploits for iphones. I am sure one is known for HTC glacier phones as well, even more so with the flash and java on web pages.
But i do agree, most likely the USER would have to install a bad app. Same thing with 99% of computers virus, people click that "install activeX" button all the time like retards
Click to expand...
Click to collapse
Our phones are *UNIX based, actually very closely related to Linux. There are no web style attacks.

I use lookout for my phone, but not for the antivirus part. Only the lost phone sound and gps locate. The contacts backup is pretty useful too, i like not having to worry about losing numbers if i lose my phone or my gmail gets hacked.