ie8 fix

The ToyBox

Ricardo Bilton & Gloria Sin

Android fragmentation opens door for Netflix-faking trojan

By | October 12, 2011, 12:13pm PDT

Summary: Add data security to the list of concerns stemming from the fragmentation of Android.

Android fragmentation may be bad enough by itself, but what if it leads to stolen user information?

Symantec posted on its official blog today a report about Android.Fakeneflic, an information-snatching trojan operating under the guise of the Android Netflix app.

The app is fairly easy to understand. Believing it to be the official Netflix app, users are coaxed into providing it with their Netflix credentials. The result is a stolen password, and potentially a purloined credit card number.

Symatec says that the trojan’s effectiveness comes from the vacuum left by the launch of the official Netflix app, which only supported a few devices upon its release. The popularity of Netlfix, coupled with the lack of universal support for the app created the ideal environment for trojans like Android.Fakeneflic.

But what’s really scary is just how similar the two apps are. As shown in the Symantec image above, the duo are nearly inseparable from each other, and it wouldn’t take much for any normal user to convince one with the other.

[Symantec]

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Ricardo Bilton writes for ZDNet's The ToyBox. His work has appeared in The Japan Times, The New York Observer, and The International Business Times, among other publications.

Disclosure

Ricardo Bilton

Ricardo Bilton has no investments that may conflict with his work with ZDNet. Similarly, he has not worked with any companies that he may write about in his technology coverage.

Biography

Ricardo Bilton

Ricardo Bilton writes for ZDNet's The ToyBox. His work has appeared in The Japan Times, The New York Observer, and The International Business Times, among other publications. He lives in New York, and is a graduate of Amherst College.
28
Comments

Join the conversation!

Just In

kzulleo 37 gza
cdfwekrdfe5101-24379066094053758434108816164805 23rd Nov
shequu,rabupwbo16, xzmck.
Misleading title...Fragmentation didn't cause that problem, poor policing of an app store, malign content, or user side-loading did. Apple could have similar issues if a webpage was made to look like the app above and linked to with an icon, so could any phone platform.
@Socratesfoot
+1. Google needs to step up and enforce policies around its market approval policies.
0 Votes
+ -
Not Exactly
m0o0o0o0o 13th Oct
@Socratesfoot - This is not a webpage. This is an app. If it was a webpage we wouldn't be talking about the OS and the open ecosystem, we'd be talking about the users.
@Socratesfoot
I think the point is that it is fragmentation that has prevented Netflix from releasing an app that works on all Android devices - thus leaving a gap in which frustrated people look for foreign support.
I'm lucky - the Netflix app works on my phone.
@Ralph124 Yeah, I think it was pretty obvious to everyone but anything to deny fragmentation is his motto.
0 Votes
+ -
Testing
nykitty411 12th Oct
Test
Sorry but Android == Linux == perfectly secure. Therefore, this reported malware can't possibly exist.

Right?

Right.
@bitcrazed

Yet another one writes a personnel opinion without any supporting facts.
0 Votes
+ -
@bitcrazed That's right, it doesn't exist. Now you may return to defraging your hard disk. Oh wait, I just started defrag for you.
@anothercanuck

what are you living in the XP days vista and 7 do it in the background
I'm confused. Is the fake NetFlix in the market, or would it require downloading from a 3rd party site?
Both Symantec and author seem to be oddly silent about that.
Just how hard does someone need to try to get the fake?
@anothercanuck Yeah - just more ZDNET sensationalism.
0 Votes
+ -
Google could care less. This is Google's attitude:

Does Google make any more money with a real Netflix app? Nope.
Does Google make any more money with a fake Netflix app? Nope.
Do they care? Nope.

If anything, you might be more likely to search on Mobile Google for 'Android malware.'

Google's attitude to the average Android user? Don't download apps. Just use the browser and Google search.

To DIY/programming geeks - write some code.

Android is NOT a professional OS - it's a passable mobile OS based on an engineers recollection of his work 5 years ago on IOS ... what do you expect? Then compound taht with Google's "customer service" attitude, you have a take out container by the side of the road - it is a free meal but it's also a lot of other issues ...
0 Votes
+ -
Netflix Stupidity
ldo17 12th Oct
I would like to know why Netflix feel they have to individually test and certify every single Android device individually before releasing their app on it? That's not how normal Android development works. Netflix are the ones primarily responsible for this situation, not Android.
@ldo17 It might not be how "normal" Android development works but why is Netflix the bad guy when all they are trying to do is make sure their users have the best possible experience using their app. Is quality control a foreign concept? Your kidding right, blaming Netflix for this situation? If some put a fake Siri app in the marketplace that stole personal info trying to use it's publicity would that be Apple's fault?
0 Votes
+ -
Similarity
Rubix_z 13th Oct
Acutally, I think they really differ a lot from each other considering how simplistic the user interface is. How hard can it be to make it exaxtly or near exactly the same??
My research of better reported articles (from which this one was probably culled and doctored) indicate quite clearly that the trojan had to be installed from a third party page (NOT Android Market). The likelihood of this attack vector working is indicated (in the source I read from Symantec) was increased due to the perceived absence of an official Netflix app for android, along with a significant demand for one - that would encourage the victim with the notion that what they were downloading was a pirated / hacked version of the real thing that was not yet available through official channels.

Therefore, the victim would have to a) not know that netflix was available in the market already, and b) be willing to take a risk and load it from an unnapproved source and c) believe that there is such a thing as a free lunch!
@dimonic I doesn't matter what excuses you offer, fragmenation is still the cause. Get over it.
@dimonic While not a good situation I am glad to hear it was not in the marketplace.
Linux zealots of course will come to the defense with baseless arguments, given their OS only has about .8% market share .

Linux has horrible fragmentation ( therefore its stability and non usability issues; gnome 3 anyone ? LOL ), and so does android, as its not a new issue rocket scientist .

http://www.symantec.com/connect/blogs/will-your-next-tv-manual-ask-you-run-scan-instead-adjusting-antenna read and learn, it IS about hardware fragmentation, apparently, as it left open a door of 'trust' , brought about BY FRAGMENTATION. Get real already , game over.

Stop making excuses for your beloved linux OS /hardware environment. Windows and mac have no such issues, and never will. Linux fail, and often, and thats why its marketshare is in the tank.When average people hear of such things, is it any surprise they dump android and latch onto iphone ? Heck no. Those platforms are professional, and I will gladly pay money for them until the 'other' platforms mature .
As someone who has been a supporter and developer for MS products for decades, I'd like to say a few things...

First, desktop Linux currently has far more than ".8% market share" (that's simply a fact). Furthermore, Linux's uptake is the fastest growing in the marketplace (which is why Microsoft is, so obviously, scared silly). And, if you are talking about handhelds, mainframes, Internet-servers, etc... Linux actually is, already, a primary player.

Second, "fragmentation", has nothing to do with this issue. Netflix, did not need to limit the devices that ran their "app" because of, alleged, fragmentation. That was, apparently, yet another stupid decision made by this, recently, seemingly intellectually-challenged company ...not to mention, that it is amazing that trojan-writers didn't seem to consider, so-called, "fragmentation" to be much of a technical-hurdle.

Additionally to refer to a trojan, from an unauthorized pirate website, as any kind of real security-lapse or market-problem which could (in any rational way) actually be related directly to "Linux", is absolutely asinine to the point of being nothing but the sensationalist FUD... which this clearly is.

Simply put, for the most part, so-called "Linux fragmentation" poses absolutely no more compatibility issues than Microsoft's endless treadmill of software "versions", "MS standards", market-manipulation, arbitrary changes, and "updates" (especially compared to the major Linux distributions).

Furthermore, we have just been forced, by Microsoft's "compatibility" issues, to abandon reliance on the latest -versions- of "Windows" for many of the applications, tools, and utilities that our technology company relies upon. Now, I'd call that "fragmentation".

Furthermore, every recent version of Windows (and, yes that is including "Vista/Windows-7") has so many, well-documented, security-issues, REAL viruses, trojans, and stability problems... that no honest comparison can (in any reasonably way), seriously, negatively denigrate the quality of Linux, these days.

And finally, in most people's opinions, the maturity, efficiency, and usability, of Linux (compared to MS-Windows) -is- at least comparable to commercial, proprietary, software (in virtually all meaningful ways).
@Raife_1
This is a fragmentation problem for Android. NetFlix could only release their app for a few Android devices because almost all could not produce the required DRM support. This was required by NetFlix to stay in compliance with their current contracts with content providers.

Unlike the rigid design specs for Microsoft Windows Phone - Mango and iOS devices there is virtually no control from Google over the Android devices.
@blinkey01

This, alleged "fragmentation problem" was actually a "DRM" problem?

Hhhmm...

I guess I just prefer to stick to the freedom to use, and develop, applications without the unbelievably-onerous, and ridiculously-expensive, restrictions (and ever-present CONTROL-MANIA) inherent in monopoly-based, closed-source, proprietary, software/hardware systems.

And, honestly, I kind of think that most consumers, and industry professionals, tend to agree.
@Raife_1 Think whatever you want, without fragmentation this would not have happened. Sure, without DRM this would not have happened either but fragmentation is more to blame here.
0 Votes
+ -
Yeah... right...
Raife_1 18th Oct
I think most people have come to realize the true origins of this "fragmentation" myth...

...the intentional spreading of Fear, Uncertainty, and Doubt, being used as a weapon against the highly-successful Android-platform.
I guess we're lucky the bad guys didn't put in what has to be a trivial amount of extra effort to make it look exactly like the real thing
Disclaimer: My cell makes and receives calls, and can text in an emergency. This bis not my problem.
0 Votes
+ -
kzulleo 37 gza
cdfwekrdfe5101-24379066094053758434108816164805 23rd Nov
shequu,rabupwbo16, xzmck.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix