Hello, welcome to the Monday, July 18, 2020 edition of the Sands and the Storm Center's

Stormcast. My name is Johannes Ulrich and I'm back here recording in Jacksonville, Florida.

Well, with a number of handers, of course, also traveling back home from Sands Fire. We didn't have a lot happening here at the

internet storm center, Diddy, who was stuck at home, did publish a quick diary? Just a little hint

if his zipdump.py tool doesn't open because it says that a file is being used by another process.

It may actually be the tool itself, and that's what happened to him here.

And Google in its Google Play Store has so far always listed any permissions that apps

required from the particular device they were installed

on. These lists were created automatically and often were criticized for really not being all

that telling and somewhat hard to read for at least non-security professionals. Well, Google kind of fixed some of that by adding a data

safety section. This data safety section is up to the developer. So the developer may indicate

how the data is being used in a particular application. But turns out that this appears to now replace the old permission list.

The problem here, of course, is that information that was automatically generated by Google

based on the code in the application is being replaced with data provided by the developer,

and there doesn't appear to be sort of any check really

in place to see if the developer's information here is truthful or even detailed enough.

Michael Raman, who did tweet about this change, suggests that a better option may have been instead of having the

fairly sort of cryptic and obscure titles for the various permissions replaced by something

that's more human readable and easier recognized by users.

Talking about the Google Play Store researcher, Maxime In Crowe, did find a number of malicious pieces of software in Google's Play Store that are a bit more stealthy than what has been done in the past.

In particular, this malware does not use a web view instead of just the business plane

HTTP requests in order to communicate with the command control server, just connects

...