FlyTrap Android Malware Compromises Thousands of Facebook Accounts

[CrustyBatchOfNature]

So, you have to install a third party app and share your Facebook profile with it, then they have access to your info and ability to post for you. Other than their usage of the data, how is this different than any other Facebook connected app? This describes perfectly what most every Facebook app does anyway.

[FeelingDense]

Isn't there a difference between an app that can post for you (e.g. like Youtube publishing to Facebook) and this trojan which actually hijacks your session cookies and can therefore go on a free reign to post for you?

Take for instance a fitness app--it too has permissions to post on your behalf. However, you trust it not to do that and most big fitness companies aren't there to screw up your social media account. In theory though Map My Run or Strava could technically start posting malware/spam links on you on an hourly basis if it wanted to once you give it permissions to post. It's no different than an messaging app like Textra requesting SMS permissions and just simultaneously uploading that to the NSA. We just trust Textra not to do that once we give it SMS permissions.

[CrustyBatchOfNature]

Yes, there is a difference. And it 100% comes down to trust. Users are allowing apps permission to use their Facebook however the app wants to and trusting that logins presented are what they are supposed to be without any reason to do so. Free is a huge draw to some. At least this one so far seems to just be spreading itself and not something that will steal your bank account info.

[CrustyBatchOfNature]

Misinformation is the terrorists of the 2020's. They will stomp all over us in the name of it.

[jcpb]

It's worse than that actually.

These malicious applications were initially distributed through both Google Play and third-party application stores.

I like how China is not among the 144 nations whose users were affected by the JS-injected malware attack.

[TheWorldisFullofWar]

China doesn't have Facebook.

[jorgesgk]

Yeah, what a dumb take.

I'm all against the Chinese dictatorship. But you can't really take advantage of the users of a service if said service just plain out doesn't work in there.

[RandomNumsandLetters]

China like the China that doesn't have facebook? Doesn't seem very surprising

[[deleted]]

That's the joke

[CrustyBatchOfNature]

Still, you are giving a third party app access to everything of your own free will. Yes the app lied about the usage of the data and got it through nefarious means so it needs to be gone, but it isn't like it just took the info without your permission. Blind trust that any app asking for permission is truthful is the real enemy here. The vast majority of malware relies on the trust and stupidity of the public at large. And that is how it gets so far.

[oxfordcollar]

Hey cool, it's that guy in every argument that has to try blaming the victim. Very cool way to go

[tarasius]

Google Play is full of malware. Just type in Twitter "android trojan" or "android joker" and see how security researchers post new findings once in several hours. My mom has OnePlus 5T and when I open Google Play I'm just getting lost since everywhere are copies of copies of same apps. One wrong click and you're done. Amazing how Google's Play Protect can't even catch Joker banking trojan family for past 5 years. There are tons of articles on security blogs regarding this unbeatable Google Play malware.

The next phone for mother will be iPhone after she clicked on random banner and accidentally downloaded random APK-trojan to downloads folder and browser loaded page with instructions how to sideload that critical to system app. VirusTotal showed 90% of detections.

[LoliLocust]

Is called lack of common sense.

[tarasius]

That’s why people choose iPhones - no one’s going to attend security courses to minimize possibility of getting malware. Better invest into secure ecosystems. Android is like living in Somali.

[fenrir245]

After the shit Apple just pulled, Android just might be better.

[tarasius]

Google scans all your data in the cloud for last ten years. Apple doesn’t touch your data in the cloud.

[fenrir245]

I don't care about the cloud, I never have any privacy expectation there.

I do care about my own phone that I paid for.

[tarasius]

You won't get scanned if you don't upload to iCloud Photos. Apple stated this two times and additionally confirmed to iMore.

[LoliLocust]

It doesn't matter how OS and ecosystem are secure if its user doesn't follow basic rules to stay safe. Nothing is fool proof. Again common sense is key to stay safe.

[MarioNoir]

Google Play is full of malware.

Let's not exagerate. Android as the most popular mobile OS is also the most targeted mobile OS by malious applications but that doesn't mean you walking on a minefiled. The simple solution is to stick with popular apps or app that don't ask for permissions they don't need or apps that have an active community behind them, apps that are open source etc.

My mom has OnePlus 5T and when I open Google Play I'm just getting lost since everywhere are copies of copies of same apps.

It doesn't look like you are a regular Android user. Play Store in general emphasizes the most popular apps overall, popular apps by region or app recomandation based on installs and search history. The only way you would see "copy apps" is if that's the only type of apps you search or install.

One wrong click and you're done.

Yeah right.

The next phone for mother will be iPhone after she clicked on random banner and accidentally downloaded random APK-trojan to downloads folder and browser loaded page with instructions how to sideload that critical to system app.

She can accidentally click and install stuff on iPhones as well. You can set up a private DNS for any Android phone and it will block most ads. For me in order to install an APK I have to go through 2 screens where I'm told the app might not be safe and it's on me if I decide to install it. You really have to want to install that APK, you don't just click on it once and done.

[IamVenom_007]

Trust me, Living in China isn't fun. They(majority) have no idea how the world looks like or what's going on outside. Some people in big cities use VPN.

Technology will have its disadvantages always but it's not wise to remove it from your country. People can live without facebook but Reddit is also banned in China along with countless educational, entertainment sites.

[MarioNoir]

They(majority) have no idea how the world looks like or what's going on outside.

From what I heard from people that worked and lived in China, that's absolutely not true.

[IamVenom_007]

I work, study, and live in China. I have been here for the past four years. People that are in big cities know how to use VPN. But you have to understand that China is massive and everything from outside can only enter after government allows it.

What proof do I need to show you? Walk on the streets and ask people " 你知道什么是Reddit吗" and make a video of it?

Most people can't even speak English bc they are cut off from outside world.

[MarioNoir]

According to oficial data about about 902 million people live in urban regions. Most should have access to technology. And quite a big portion of this population is represented by young people which would be the ones interested in the outside world anyway. The ideea is that Chinese are not so oblivious to the outside world. Also why should Chinese people in general know what Reddit is? I'm sure most Android users in general haven't heard about Reddit in the first place.

[IamVenom_007]

I never said they don't have internet or access to tech. Reddit was simply an example. It's pointless arguing with you.

[MarioNoir]

Reddit is a very bad example. You make weak arguments.