cross-posted from: https://infosec.pub/post/53326082
A malware campaign dubbed ‘Midnight Mimosa’ has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. […]
my bank…
graphene os: eww no, sooo insecure, couldn’t possibly trust that, fails checkbox compliance!
rando crapware infested phone that hasn’t seen a security update in 3 years: right this way sir…
“We checked the checkbox that said ‘security’.”
I hear this complaint and perhaps I used the banking apps very minimally. I’m running GraoheneOS and just use the browser instead for my banking needs and I haven’t had any issues.
It was a slight setback but its not a huge deal for myself at least.
I had this mindset until signing up with a bank that only uses its app for 2FA of any kind. No SMS option. No TOTP code option. So anytime you log in using a a mobile or desktop browser it would require opening the mobile app (running google play services OR having an iPhone).
The only option I found to keep using this bank was to disable 2FA entirely.
Which is dumb.
But it was related to using a bank in a new country on GrapheneOS and Aurora Store version not fully working without Play Services and it turns out all banks suck here and not worth changing banks and there’s not much money in this account anyway so just…sigh.
I actually don’t do any banking on my phone at all, as phones can easily be stolen and if that person saw you typing your passcode, then they can unlock it and get past any screen that asks for your fingerprint.
Yes, I do use my fingerprint, but I can’t always use it (e.g. If I have rebooted or if my phone just won’t let me for some reason), so I don’t keep much on my phone and instead do things like banking on a desktop computer with disk-encryption.
How long left until my bank requires me to use their app? I don’t know and I have no idea if it’ll work on custom ROMs.
But Google told them it was/wasn’t secure! Google has to know, right?
/s
The researchers found preinstalled malware on devices with model names associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products.
In case you were wondering which brands are mentioned here.
oh no i would have trusted the KINGKONG X
no, you should always be team GODZILLA Y, everyone knows KING KONG X sucks
Team Mothra Z
Well, you should not!!!
silently install apps
Sounds like Google.
(/srs) Anyways, these "new"s are as old as “IoT” itself.
A little less than half of the apps you can download for an LG TV will also set up residential proxies.
Gamers Nexus mentioned this article in a recent video:
https://spur.us/blog/smart-tv-apps-residential-proxy-sdksUnironically everyone using a huge mesh residential proxy would be super based for internet privacy.
So…kinda like what apple and google are doing too 😁
Not to shill for Apple or Google, but it’s definitely important to draw a distinction between first party telemetry and straight up distributing malware. If we can’t we honest in our framing then there is really no reason to take what we have to say seriously.
While I wasn’t 100% serious, I wasn’t just joking either.
Sure there is a difference. But not a big one. Do you know what each android process actually does? And both can install any shit they want at any time. You can’t even uninstall their store or apps.
To me personally, the difference is slim. And malware is malware, the difference often is just billions of dollars and doing it more or less on the open.
No, because Apple and Google aren’t providing third parties access to the Internet through your devices.
for money they totally would do it. and since the whole thing is under their control they can design it in such way you wouldnt ever know. We are the product for them, not the phones.
Actually they do. Through their findmy networks.
Makes me feel so much safer with google or Apple 😁 They could though. All the tech for it is there and already installed. And you wouldn’t even know if they did, because you don’t own your own phone.
Not that I wouldn’t worry about an added layer of spy-shit though. The difference between that malware and the big malware it’s installed on is just slim to me. I’m very security- and privacy-driven.
And the carrier too.
say the thing on the lemmy to get the points that don’t matter
As if I would care about that. This is not reddit.
So… android IS google, and Apple is not doing anything remotely close to this.
Android is google? You don’t say? 😉
And Apple is doing the same shit as google. At least they never tried to hide it
At the end of the day, each of us need to make a choice. Go with Apple and land in their walled garden and everything that comes with that. Choose Android with any OEM and bend over to Google AND the OEM. Get a pixel and bend over to Google (or nuke Pixel stock and install GOS, CalyxOS or whatever rocks your boat). Go the dumb phone way and only bend over to the carriers. Too many factors influence this, not just philosophy, taste or choice. Some people genuinely need a phone that will work with banks or cards, others can live without. Others, as is my case, can separate their life into 2 devices, I have a pixel 8 pro that I use exclusively for work on stock pixel, and a GOS pixel 10 Pro XL for my personal life.
This technological life is a fucking mixed bag for sure.
Totally… I also “solved” it best i could. One dedicated totally anonymous phone for android-auto and one for banking-apps (they ALL need their fucking apps even though i use HBCI with most). Main phone is an aging pixel with graphene. The moment it dies (i’m waiting for many years now) i’m going some linux-phone, no matter how lacking it might be.
Apple is a no-go. But yes, at least there’s “only” one that i have to bend over for. But I was there when they tried so hard with “pay less, get more!” and now it’s “get less, pay a lot more you dumb stupid consumer-trash-idiot”. I would be ashamed of myself for using one.
But yes. It sucks. And i was dumb enough to kinda believe google with “android will always remain free and open!”. Yeah sure. Go fuck yourself.
I was a full blown Google fanboy until around 2017. I had all their tech, no matter how new it was. Then I started looking, and my race to get out of there was fast and furious. That’s when I landed on LineageOS first, then Calyx and have been on GrapheneOS since the pixel 6 came out. It was brutal, honestly. I swore by Google.
Never been an Apple fan, I’ve always seen it as expensive shit that’s only good to show off that ‘I can spend more than you to do the exact same shit’.
Then there’s Windows. My last time on windows was also in 2017, and looking back, I do have to thank Google for opening my eyes to all the shit these companies were turning into.
I’m “glad” to see that this shit also opens some eyes. Probably not enough to change anything, but it’s something.
Wouldn’t call myself a fanboy but I really loved android when it came out. Mostly had custom Roms all the time, but it got harder and harder, and in the end I spent a day just to he able to install one. I was glad if there at least was a root. Needed for backup, I would never use a cloud. Especially not google.
And I am still on the p6p. Got it when it came out. Hated google already but it were - ironically - the only brand left that was “open”. It Broke 1 day before end of guarantee and got a brand new one. And this sucker refuses to die 😁 Graphene is nice and all, but I miss root. And because I basically don’t use any “regular” app anymore, I will switch to a Linux then.
Apple… It’s tech-products for people that want tech but have not the slightest clue. Its like “my first Sony” 😁
Oh Windows…I took too long to ditch it. As a hardcore gamer I never even thought about switching. I use mostly Linux for all my servers, but never used any GUI. But then I tried cachyos, super worried on a second nvme parallel to win. Nearly all games work, rarely any tweaking needed. And instead of having to write my own tool for months to move my windows where I want them and how, I use KDE win-rules. God I love KDE. Never ever booted win again. And I even made a VM out of it for “super emergencies”…never started it.
Now I just need the “downgrade” from nvidia to and…
Can’t say though which company’s shit made me snap and ditch all US-bigtech. Reddit helped a lot…
Yeah, this path we’re on seems endless. I’ve always played on console more than PC, and have had every PlayStation generation and all Nintendo’s up to the wii-u (my son does have a switch first gen and wanted the switch 2, I told him he could get one when he pays for it). With all the bullshit in the gaming world I’m looking to build a ‘Steam Machine’ of my own eventually to throw the PS5 out the window (or sell it 😏) because I’ve found that my way of thinking is entirely incompatible with every tech company out there except Valve (So far). I haven’t touched the PS5 in about 4 months but my kids still play on it, I have been keeping to my steam deck mostly.
What happens when I decide ‘fuck Sony too’? Prices for parts to build my 'Bazzite console skyrocket and now I have to save more to be able to build something mildly functional.
This whole tech environment has gotten so fucking tiring.
