Rogue E-Books Could Pose Threat to Amazon Accounts

If someone wants to avoid being hit with the above exploit, then not downloading pirated ebooks and content from dubious websites is the way to go, as per the researcher who discovered the flaw. It seems perfectly sensible to suggest that ripped books could be an avenue for compromise and so should be avoided until the flaw is corrected. I think we can agree on that – as for everything else…

If someone wants to take a risk after being told “This is a bad idea”, on their own head be it. We’re not here to tell people what may help some of the time, we’re here to tell people what will hopefully work all of the time. From there, they can increase the level of risk if they so desire but that’s up to them.

“The average consumer has zero way of comparing screenshots with the name/genre/description/intent of the game and making an educated decision as to whether something is malicious”

And that’s why we tell how to compare shots, or look for reviews, or be aware of faked screengrabs. If people never advised others what to look for, they’d continue to keep falling for it. Not sure what the starting point for people helping themselves to understand a current threat or issue is if nobody ever tells them about it.

We get plenty of comments and mails saying that they would have been hit with scam x, install y, exploit z only for us giving them advice on what not to do, so I don’t see the problem there.

“Reviews mean nothing. They’re easy to fake. Dev names mean nothing. They can be legit or they can be someone with really poor creative skills”

If a potentially dubious app has nothing but a stream of reviews on Amazon stating that it didn’t work, is a slide tile game (one of the most common fake app issues) or did something else unexpected then that’s a good place to start. Nobody is going to wage a spam campaign of poor reviews on a newly released spam app.

If anything, you’d expect to see a wave of bad reviews on a successful title – but given a genuine program will likely have hundreds or thousands of reviews, you can at least be reasonably confident you’re looking at the real version of the product you’re wanting to purchase.

Number of reviews can be important. Quality of reviews can be important. Being able to click on the names of reviewers and see that they’re verified amazon identities and so actually bought the product, or genuine google plus profiles with a long posting history taking time to comment on Play, is important. These are all relevant pieces of information a consumer can make use of. No spammer ever wrote “this product ripped me off” on their own app. But a stream of reviews saying “this did something bad”? I’d certainly take five minutes to see what they’re saying as part of the purchase process.

Reviews and ensuring dev names are correct and genuine is also important, given that most official dev stores don’t currently give any form of verified publisher status to developers unlike the verified profile seal on Twitter. You wouldn’t hand money to a stranger in real life for a service without a little background checking first and that’s what we’re advising people to do online.

“The average consumer has zero way of comparing screenshots with the name/genre/description/intent of the game”

That’s why we’re literally telling them why they should compare images on products they’re looking at, and provide a link to google image search because it’s a tool they can use to check the images with.

“Much the same as the average consumer can’t go to a gas pump and be reasonably expected to know whether it’s been tampered with to replace it with something that’s gong to swipe (no pun intended) their card number.”

And that’s why security sites, news sites and law enforcement frequently post information and articles on card skimming devices and related technology.

“but a mashup of names or words is *NOT* a malware flag”

We never said a mashup of names on an app was a “malware flag”. We said it was an indicator of a program which was low on threat but high on deception in terms of confusing branding and claiming to be something it wasn’t. From the linked blog the tips are taken from:

“The biggest problem here isn’t the app permissions which are generally fairly standard (and in many cases, often ask for less access to both personal information and the device itself than many of the more mainstream apps out there). The problem is a lack of information as to what the apps actually do, whether they’re games in the sense of “not a terrible sliding puzzle thing” or not and whether the Kindle owner will even get something functional after handing over their money.”

As for sideloading apps obtained for free from less than legitimate sources, you’re playing with fire and install the content at your own risk. I wouldn’t do it on my PC and I wouldn’t do it on any of my mobile devices – it simply isn’t worth it. YMMV on that but it’s not something we advise. If you go downloading random apps which should really only be installed from official app stores, then treating those files without the heavy dose of skepticism they deserve is asking for trouble.

“Good security software is supposed to compensate for the lack of common sense and knowledge”

I disagree. The overwhelming majority of things I’ve covered in the past 10 years have overwhelmingly been social engineering tricks. Almost every major scam you can think of – unless it’s a drive-by exploit – involves fooling somebody into clicking something as the first port of call.

Every security tool on the planet will eventually tap out as the unaware victim continues to hit one link too many, or starts responding to forged emails, or answers the phone to a fake tech support scammer, or replies to a phony “I’m on holiday and need help” facebook message. Layered defence is important, but it isn’t a replacement for education – and I don’t think there’s any sensationalism as a replacement for education on display here.

I don’t think we’re going to agree on much of this, but thanks for commenting.

“And that’s why we tell how to compare shots, or look for reviews, or be aware of faked screengrabs.”

The problem is that for the unassuming masses, it isn’t easy to tell what’s faked and what isn’t. I have to deal with this on a daily basis. “Don’t click this crap”, I tell my stepfather. “Why the frag are you even on this site?” I tell my kids. Like you said, much of it is social engineering. Convincing the target that something is safe or is the content they were expecting.

“If a potentially dubious app has nothing but a stream of reviews on Amazon stating that it didn’t work, is a slide tile game (one of the most common fake app issues) or did something else unexpected then that’s a good place to start.”

Maybe all the people I know are either … slow… or very impatient, but I can’t think of a single one who reads reviews and attempts to make a sound decision as to whether something is malware based on this. They simply don’t have the experience in the industry to make an educated decision, or even a gut reaction.

“And that’s why security sites, news sites and law enforcement frequently post information and articles on card skimming devices and related technology.”

I could watch the news all day. I could watch intricate explanatory videos on how these things work. Could I identify them if I pulled up to a gas pump or was about to swipe my card at a convenience store? I’m a fairly intelligent and profoundly paranoid guy, but probably only if it were the most basic of setups. It’s just not an industry or technology that I’m familiar enough with to catch on if there is any degree of real sophistication. If they were easy to spot, they wouldn’t work. Law enforcement personnel have admitted repeatedly that it’s unreasonable, if not impossible, for the average consumer to identify a well rigged skimmer.

“We said it was an indicator of a program which was low on threat but high on deception in terms of confusing branding and claiming to be something it wasn’t.”

That’s not malicious. It’s poor taste.

“Every security tool on the planet will eventually tap out as the unaware victim continues to hit one link too many”

I think that’s a little defeatist and technically true only to the point that the developers of security software wait for an exploit to be publicized prior to providing a solution.

To be clear, I’m not disagreeing with anything said here. In my line of work, I deal with the daily struggle of “I’m sorry you aren’t getting the expected results, but this is how I told you to do it.” If my mother wants to download a tile slide game and the screenshots are of laughing clowns and mushrooms (not that this shouldn’t warning enough), she’s going to think they’re some kind of level completion screen. (Seen it happen, but fortunately the app devs were just poor advertisers and not trying anything malicious.

When I think about app security, I think about my parents. I can preach to them all day long about whatever, but they’re not going to read reviews and try to determine if they’re fake, they’re not going to compare screenshots, they’re not going to image search some $.99 app and they’re definitely not going to read a blog on security. They want to log onto their laptops or phones and expect some semblance of security by putting their trust in companies who are supposed to identify these things for them. If it weren’t for users like them, the computer security market would be far more poorly funded.

This entire post should have been distilled to “Only download apps or eBooks from trusted sources, such as Amazon or Google. At least if you get had, you’ve got someone to sue.”