Android Lollipop sucks at security, says researcher

Re: Promotional hack for security "researcher".

Indeed scaremongering. In the real world this isn't happening. All this does is embarrass anyone passing nonsense around

Re: What is the exploit here?

Exploit based on fact that when a user installs an app it tells you what permissions that app requests.

Apps can request all sorts of permissions - it relies on user having a clue when they look at what an app is requesting, but lots of users accept regardless.

So the exploit works on lots of users who accept reagrdless

If you have android try an install of something "safe" e.g. the official facebook app (I recommend you do not install it - just look at the permissions it wants, not security hole per se but massive privacy hole)

On Android versions below Marshmallow you cannot so anything (bar uninstall the app) to prevent an app using permissions you gave it.

With Marshmallow you can restrict, e.g. with Facebook you could not allow it to access your contacts, camera etc.

Depending how well coded an app is, it *should* not break on Marshmallow if e.g. it tries to access contacts when you have disallowed contacts access

Big problem is most handset makers are not upgrading handsets (e.g. manufactuerer of my particular model has announced no upgrades beyond lollipop) so users stuck on less secure OS version

.. Though if someone is going to install an app that asks for excessive privelidges, even if they had marshmallow they would probably not tweak settings for security

It is an Android fault (IMHO) as user control of access should have been there from day 1 (instead of current scenario where, in my case, I install hardly any apps as most take the P in permissions they want, but most people just want to install a given app regardless of permissions)

Re: What is the exploit here?

Ok, the user installed an app that probably did something they didn't want it to but that's hardly android's fault.

It's not the fault of the Android OS, per se, no.

However, what we commonly see is that an app advertises itself as providing one useful feature but in fact also (or instead) does something quite different. That instances of such malware can get itself into the official Android store is the fault of the Android ecosystem, if not of the OS.

That the Android OS doesn't (until Marshmallow) give the user any way to vet the permissions actually requested by an app, and deny them on a permission by permission basis, is a shortcoming of Android, if not a fault.