Hasta La Gadget!

Android phones, like this Motorola Defy, can install apps from sources other than Google's official Android Market. But doing so poses security risks. Photo: Jon Snyder/Wired.com

Amazon’s new app store offers some killer deals and can make it easier for customers to purchase Android software. However, installing it reduces overall security for Android devices, some security experts say.

The root of the issue is the requirement to allow installations from “unknown sources,” in order to put Amazon’s Appstore app on an Android phone. Amazon instructs customers that this option must be enabled to install apps sold through the Amazon Appstore.

Selecting that option immediately puts Android customers at risk to malware that could come from sources that go unchecked by Google and the general Android community, said Charlie Miller, a security researcher well known for finding exploits on mobile devices.

“As soon as you flip that switch and go away from the Android Market, which is the one place where most people go, then you are putting yourself at some risk,” Miller said.

Amazon and Google did not respond to requests for comment.

That’s not to say Google’s official Android Market has been impervious to viruses. The Android Market was infiltrated recently when a malicious hacker injected a virus into the code of 21 popular, free apps and then republished them in the Market. The hacked versions of the apps contained code that stole user data and had the ability to download more code after it was installed, potentially hijacking devices.

Google responded immediately to the exploit and used a “kill switch” to remotely remove the infected applications from customers’ Android phones. The company also issued a security tool for people to remove the exploits caused by the malicious applications.

Although Google’s Android Market fell victim to a security exploit, it is still more secure to allow your Android device to install apps only from the official Android Market, explained Andrew Brandt, lead threat research analyst at security company Webroot. If malware were to make its way into the Amazon Appstore, Amazon does not have a kill switch to remotely remove apps from Android devices like Google does, he explained.

Miller added that the benefit of Android’s official market is that it’s one central location to get apps, tenaciously moderated by the Android community, which is safer than going out into the wild to find software, like you would with Windows. By exposing yourself to third-party stores, you’re subjecting yourself to less legitimate sources.

Brandt noted that weakened security is not unique to Amazon’s Appstore, because any third-party app store living on Android must require customers to allow installations from unknown sources. There is no other method to add third-party app stores on an Android device.

However, this security issue magnifies if you consider that Amazon, a retail giant who has millions of customers with registered credit cards, is telling Android owners to disable that security provision. Also, many Amazon customers aren’t as tech-savvy as the typical Android nerd seeking to unlock special functionalities on their phones.

“Without giving people the full context of the security involved in that decision [to install from unknown sources], I think it’s a little irresponsible,” said Brandt, regarding Amazon’s method.

To be fair, Amazon claims it carefully curates apps that appear on the Appstore, so the chances of malware appearing in the store are slim. However, installing the Amazon Appstore on an Android device also requires tapping on a shortened URL sent from Amazon, which could easily be spoofed.

Additionally, when you download an app from the Amazon.com website, you receive a URL in the form of a text message; these URLs could also be spoofed to redirect to malware.

Bottom line, becoming an active Amazon Android Appstore shopper reduces the security of your Android device, especially if you don’t know what you’re doing.

At the end of the day, however, when using Android the level of security depends on the user’s skill level.

“The real question is do dumber users need Big Brother to keep them from installing dumb things?” said Jonathan Zdziarski, a security researcher who specializes in mobile hacking.  ”I’m sure a lot of people are buying these [Android] devices without knowing anything about them. They are more likely to fall victim.”

See Also:

• Amazon Launches Its Own Android App Store
• Amazon Android App Store Set to Launch Tuesday
• Independent App Stores Take On Google’s Android Market

Heads-up, Kindle owners — digging into your next audiobook just got a lot less troublesome. Audible has just announced that over 50,000 of its audiobooks are now available to download directly onto Kindles everywhere through WiFi. Granted, that’s still one step away (3G) from being as good as it could possibly get, but it’s still a tremendous improvement over the tried-and-true USB sideloading method. For those looking to get started for the first time, the outfit’s offering a 30-day free trial of AudibleListener Gold, detailed in the source link below. Happy listening, bookworms.

Audible audiobooks now flying onto Kindles via WiFi originally appeared on Engadget on Thu, 24 Mar 2011 20:56:00 EDT. Please see our terms for use of feeds.

Permalink   |  Amazon  | Email this | Comments

Angry Birds developer Rovio announced on its Facebook account a few hours ago that “AT&T is also working on enabling purchases from the Amazon Appstore soon,” which would mark a pretty big move on AT&T’s part since they’ve been firm in their resolve to keep apps from outside the Android Market ecosystem off their branded Android devices — a frustrating (and arguably illogical) stance, to say the least. Well, first the good news — AT&T has confirmed to us that they are, in fact, setting up access to Amazon’s store:

“We’re working to give our Android customers access to third party application stores. This requires updates to our systems and finalizing arrangements with Amazon. We will share more info with our customers in the near future.”

The bad news is that AT&T’s having any discussions with Amazon about this at all, which would seem to indicate that they’re planning on making an exception to their Android Market policy for the Amazon Appstore rather than simply enabling sideloading on devices altogether and calling it a day. We suppose this could involve a round of firmware updates that drops the Appstore in ROM, but that seems like an awful lot of work considering how much red tape is involved in pushing even a single update for one handset on a major carrier. More on this as we get it; hopefully, AT&T subscribers will have their Angry Birds Rio fix soon enough.

[Thanks, Thomas]

AT&T planning access to Amazon Appstore, sideloading still an open question originally appeared on Engadget on Thu, 24 Mar 2011 11:50:00 EDT. Please see our terms for use of feeds.

Permalink   |  Angry Birds (Facebook)  | Email this | Comments

Whether via public library or personal collection, e-books may be getting harder to borrow and loan out — HarperCollins put the squeeze on government-funded rentals last week, and today Amazon has allegedly disabled e-book sharing startup Lendle with one fell stroke. Lendle allows readers to trade e-book rentals, in a fashion, by tapping Amazon’s API to list books they agree to loan out, and in return, gain access to a Lendle database of books available to borrow from readers like themselves. The service allegedly fell under the auspices of Amazon’s existing 14-day, one-time-only loaning policy, but that didn’t stop Amazon from revoking Lendle’s access to the API, effectively shutting the service down. According to the no-reply email Lendle received, the reason is that the service doesn’t “serve the principal purpose of driving sales of products and services on the Amazon site.” Perhaps there’s some deeper reason behind the move, but that explanation certainly sounds pretty narrow-minded.

Update: Well that was quick — Lendle is now reporting that Amazon has reinstated its API access under the condition that Lendle disables its Book Sync tool, which is a non-essential feature anyway. Great, just in time for bedtime stories on the west coast as well.

Amazon blocks Lendle e-book sharing service (update: it’s back!) originally appeared on Engadget on Tue, 22 Mar 2011 23:13:00 EDT. Please see our terms for use of feeds.

Permalink CNET  |  Lendle  | Email this | Comments

The Amazon Appstore is the exclusive source (for now) for Angry Birds Rio, which is a free download on Tuesday only.

Amazon opened the doors Tuesday on its own marketplace for Android apps.

As reported by Wired.com last week, Amazon’s new store, the Amazon Appstore for Android, appears to be a more-carefully curated, selective virtual storefront than the Google’s default Android Market. It features the new Angry Birds Rio game, as well as many other popular Android apps, including Twitter, Fruit Ninja, Shazam, Call of Duty: Modern Warfare 2 and others. The Amazon Appstore has 3,800 apps, according to reports.

While most of these apps (with the exception of Angry Birds Rio, which is an Amazon exclusive for now) are also available through Google’s Android Market, Amazon’s sales pitch to customers appears to be trust and ease of use. For developers, it’s access to Amazon’s vast customer base.

“The Android platform’s openness provides a great opportunity to reach new customers,” said Mikael Hed, CEO of Rovio, the maker of Angry Birds, in a statement provided by Amazon.

The Google Android Market is primarily accessible through Android phones, which makes comparison shopping difficult, hampers the ability to read many reviews and slows down search to the speed at which you can type on your phone’s keyboard. (Google recently added a web version of its store.) In addition, the Android Market has been frequently criticized for the low quality of and even security risks posed by some apps, a probably inevitable side effect of Google’s rather open policies. However, it contains over 200,000 apps, a far wider selection than any mobile app store save Apple’s.

With the Amazon Appstore, by contrast, apps are easier to browse and appear to be more carefully vetted by Amazon. Customers can browse Android apps through Amazon’s familiar web interface, which makes it easy to see customer ratings and reviews, look at screenshots, read details on the app and see related apps.

In addition, Amazon says it will provide the ability to “test-drive” apps in the web browser, through a simulated Android phone. We were not able to find this feature on any apps in the store, however.

To purchase apps, customers must install an Amazon Appstore app on their Android phones, which requires Android 1.6 or higher.

One problem for Amazon is that its store does not work with AT&T phones, although Amazon says AT&T is working on a solution. AT&T Android devices are currently configured to install apps from the Android Market only. There are workarounds, but they require a bit of comfort with using the command line.

AT&T told Wired.com that it plans to support third-party app stores, including the Amazon Appstore, on Android phones soon.

“We’re working to give our Android customers access to third party application stores,” an AT&T spokesman said. “This requires updates to our systems and finalizing arrangements with Amazon.  We we will share more info with our customers in the near future.”

Apple Sues

Another obstacle Amazon will face is a lawsuit Apple filed March 18, which claims that Amazon is improperly using the term “App Store,” which Apple says it has trademarked.

In addition to its store’s ease of use, Amazon’s biggest advantage may simply be the option to pay for apps through Amazon.com, which is available in more countries than Google Checkout and has been around more than a decade longer than Google’s payment system.

Once installed and connected with your Amazon account, you have the option of shopping through the Appstore app or on the Amazon.com website. However, you need to use Amazon’s app to actually download and install your new apps (they cannot be “pushed” to your device).

In addition, the Amazon website displays information about each app’s compatibility with your phones, since it knows what kind of hardware you have.