Sophos's security research blog covering ransomware, malware, fleeceware, scams, and cybercrime news.
HN links it as a source for cybercrime stories, such as a council's ransomware recovery and Silk Road founder Ross Ulbricht's tweets from prison.
It's not uncommon for Android malware to exploit system vulnerabilities to break out of the sandbox.
- Agent Smith abused an installation vulnerability in order to inject malicious code into other installed APKs on the device. (https://research.checkpoint.com/2019/agent-smith-a-new-species-of-mobile-malware/)
- HummingBad used multiple root exploits to auto-root 10 million devices. (https://arstechnica.com/information-technology/2016/07/virulent-auto-rooting-malware-takes-control-of-10-million-android-devices/)
- xHelper similarly buried itself deep in the system partition in order to survive device resets, and went so far as rewriting libc.so to prevent you from mounting the system partition to remove it. (https://arstechnica.com/information-technology/2020/04/solved-how-android-backdoor-called-xhelper-survives-factory-resets/)
You are also underestimating the amount of damage malware can cause even within the sandbox.
- The CryCryptor ransomware abuses file access APIs to encrypt photos and videos on external storage and hold them hostage. (https://threatpost.com/emerging-ransomware-photos-videos-android/156893/)
- The DEFENSOR ID banking trojan abuses accessibility APIs to steal login credentials, text messages, and 2FA codes. (https://www.welivesecurity.com/2020/05/22/insidious-android-malware-gives-up-all-malicious-features-but-one-gain-stealth/0/)
Even the majority of the adware you describe abuses system APIs to hide their own icons and draw their own ads on…
You hope they cannot be held liable. That doesn’t mean that you can’t be raided, or have to defend yourself against charges of illicit content being found in a computer you use, or accusations that you’re knowingly supporting crimes. A lot of that is going to depend on the service and how much visibility you have into user activity - a caching storage node is going to be riskier than forwarding encrypted packets, for example.
Here’s an example of some privacy activists:
https://news.sophos.com/en-us/2016/04/07/couple-hosting-tor-exit-node-raided-by-cops-investigating-child-abuse/
Maybe you’re super ideologically committed to providing a privacy service and willing to take the risk, but you still want to soberly consider those risks and think about the impact if it’s harder to defend yourself than you thought. It’s not a casual decision.
Telescreen works both ways. That could come in handy if you truly have nothing to hide, or I suppose if what you are hiding must be within His tolerances.
Chalmers sent a copy of his timeline to Premier Park Ltd, the company that charged him with the crimes, and the defendant was able to prove his innocence. The charges against him were dropped.[1] the lawyer met with the detective in order to show him screenshots of McCoy’s Google location history, including data recorded by RunKeeper. The maps showed months of bike rides past the burglarized home, NBC News reports.[2] 1: https://www.phonearena.com/news/google-maps-keeps-user-from-jail-and-from-paying-a-hefty-fine_id141275
2: https://news.sophos.com/en-us/2020/03/10/google-data-puts-innocent-man-at-the-scene-of-a-crime/
3: https://www.youtube.com/watch?v=d-7o9xYp7eE
It’s already extremely common in the Python, Ruby and Node ecosystem (see sources below).
The only company that has a real chance at making a dent in the issue is GitHub and to a degree they already have.
SOURCES:
- https://www.mandiant.com/resources/blog/supply-chain-node-js
- https://www.zdnet.com/article/backdoor-found-in-ruby-library-for-checking-for-strong-passwords/
- https://www.reversinglabs.com/blog/mining-for-malicious-ruby-gems
- https://news.sophos.com/en-us/2021/10/24/node-poisoning-hijacked-package-delivers-coin-miner-and-credential-stealing-backdoor/amp/
- https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/amp/
- https://portswigger.net/daily-swig/amp/malicious-python-library-ctx-removed-from-pypi-repo
I don't have a direct source but I found some other posts that suggest many people are unknowingly turning it on.
"While this feature is turned off by default, many of Google's services and apps require it to be turned on, so unless you're actively keeping it off, there's a good chance it's enabled for your Google account." https://www.xda-developers.com/google-location-history/
"lots of people seem to have it switched on without even realising" https://news.sophos.com/en-us/2017/10/03/the-google-tracking-feature-you-didnt-know-youd-switched-on/
Also, "Turning off the timeline feature doesn’t remove Google’s access to your location data as long as you use it for navigation and Google searches." https://www.guidingtech.com/how-to-view-and-manage-location-history-in-google-maps/
No. It was a policy problem large enough that legislators required it as a condition of selling phones.
It was a real problem that kids walking around high-school, or people walking in the street, were carrying something easily stolen and fenced for several hundred dollars. Ride-by theft by bike was a notorious mode. The equivalent would be people walking around with a stack of $50s flapping in their hands. A target like that is called an "attractive nuisance", and the law has a long tradition of discouraging them.
https://news.sophos.com/en-us/2015/07/02/smartphone-anti-theft-kill-switch-law-goes-into-effect-in-california