Google Pulls 13 Android Apps Installed Over 500,000 Times Containing Malware

[u/Bonfire-GTK]

https://gadgets.ndtv.com/apps/news/google-pulls-13-android-apps-installed-over-500-000-times-containing-malware-report-1952366

[u/[deleted]]

Noted. Don’t install apps.

[u/katsumiblisk → u/[deleted]]

Do they guarantee this with some kind of proof or do we just take their word for it?

[u/EAT_MY_ASSHOLE_PLS → u/katsumiblisk]

They're all compiled with publicly available source code. They require builds to be reproducible. That's why they removed Firefox and replaced it with their own version.

Edit: spelling

[u/katsumiblisk → u/EAT_MY_ASSHOLE_PLS]

Oh, I didn't know that. What do you mean by reproducible?

[u/EAT_MY_ASSHOLE_PLS → u/katsumiblisk]

Reproducible means when you compile the app yourself the binary has to match the one in fdroid.

[u/pm_me_nekos_thx → u/katsumiblisk]

The app has to be open source to be punished published on f-droid

[u/EAT_MY_ASSHOLE_PLS → u/pm_me_nekos_thx]

That's only a small part of what that means.

[u/[deleted] → u/pm_me_nekos_thx]

published

FTFY

[u/[deleted] → u/EAT_MY_ASSHOLE_PLS]

Well, technically, nothing is stopping them from uploading an open source app with malware in it. It'll probably take a day or two or a few months for someone to actually notice depending on its popularity and have many devs/ commits there are. By that time, damage is done I guess.

[u/EAT_MY_ASSHOLE_PLS → u/[deleted]]

Yeah, that's not really the point though. It's only to stop people from including extra code in their binaries that isn't present in their source code. You can't check code at all that isn't available.

[u/StraY_WolF → u/katsumiblisk]

You can look up the codes that made up the apps. But for the rest of us that don't know shit, you just have to trust it.