security Fortnite Mobile may make many Mobiles filled with Malware

[rcmaehl]

Sources:
Wired

LifeHacker

The Guardian
 

TL;DR:
Enabling Installation from Unknown Sources on an Android device is a bad idea.

 

Media:

 

Quotes/Excerpts:

Quote

Fortnite players risk becoming victims of malware infections on their phones... [following]... the decision of developer Epic Games to bypass the Google Play Store. Android devices... far more susceptible to malware... the greatest protection being to always download apps from the Play Store.  Epic Games leave their players vulnerable to malicious copycat apps. The threat of an attack isn’t hypothetical. The game was frequently used by malicious actors as bait to encourage naive users to install malware. Epic’s decision risks undermining the general security of the Android ecosystem... [if]... other popular games follow Fortnite’s footsteps and start to bypass the Google Play Store... [as]... they would be far more vulnerable to installing apps from unknown sources, which could be malicious. The move “normalises the behaviour of downloading apps from outside of Play Store, which can only lead to more malicious apps being installed in the long term.”

Quote

You might be tempted to download one of the many modified .APKs for Fortnite that are making the rounds right now...  You have absolutely no idea what’s in a modified .APK file... You’ll find plenty of places you can obsessively check to get a modified .APK onto your device... malware disguised as a modified Fortnite .APK. Wait a few days until you can play the game, for real, on whatever Android device you own. 

Quote

If you don't have a Samsung, don't bother tapping your Google Play store icon to find Fortnite... announced on August 3, the company is bypassing the Google Play store. Fortnite fans have been asked to disable default security settings of their Android devices. By distributing the game outside Google Play, Epic will not have to pay Google's 30 per cent 'tax'. The move, however, undermines the fundamental platform approach pursued by Google. Epic’s strategy poses a fundamental threat. “Lots of Android malware relies upon users disabling Android's default setting, which only lets you install apps from the official Google Play store,” “For such a popular app to push potential players into disabling this security feature is not good at all.” Gives criminals full access to the user’s mobile device (and all the cloud services that go with it). Epic says that it believes its users are savvy enough to use the third-party applications download feature safely. Epic's move may turn out to be epic not just for the gamers playing Fortnite, but also for all the users with hijacked smartphones and ultimately Google itself.

 

My thoughts:
React to this post to get 100,000 FREE V-Bucks! No scam! In all seriousness, with Epic Games having one of the most popular games they have a responsibility to ensure they're maintaining the best security practices, especially since they have a large amount of children playing the game. The wide spread success of using Fortnite to spread malware through "Free V-Bucks" websites and "Free Fortnite cheats" has been proven and Epic Games is putting people at risk.

[PokiDaSpitz]

meh my phone peasant friends can die.

[mynameisjuan]

We all said this when the whole doing this to save 30% scheme was rumored. Its a terrible idea and all because epic games isnt making enough billions of dollars.

[Arika]

22 minutes ago, rcmaehl said:

The move “normalises the behaviour of downloading apps from outside of Play Store, which can only lead to more malicious apps being installed in the long term.”

no it doesn't. you know where else you can download anything from anywhere? a regular PC.

 

If people are stupid with their tech they will download things they shouldn't regardless of platform.

[Adorable Cat]

Does epic not realize that a lot of their fans (not saying anything bad about the game, it's just true), would click literally anything that says "fortnite" in it?

 

also wer r my 100,000 free v bucks i reactd : (

[Iverion]

This is only news to people that know nothing about tech and sensationalist media. This is nonsense & a non-issue to anyone who even knows a little about tech. No offense to the op. If someone is playing a game like fortnite I'd like to think most would know better than to just start downloading things all willy nilly like everyones relatives that only know the absolute basics about tech

[Iverion]

5 minutes ago, Sayori said:

Does epic not realize that a lot of their fans (not saying anything bad about the game, it's just true), would click literally anything that says "fortnite" in it?

 

also wer r my 100,000 free v bucks i reactd 

It should be enough for Epic to release a statement that only downloads from their website is official and all others are fraudulent and possibly harmful

[rcmaehl]

7 minutes ago, Iverion said:

This is only news to non-tech knowledgeable individuals and sensationalist media. This is nonsense & a non-issue to anyone who even knows a little about tech. No offense to the op. If someone is playing a game like fortnite I'd like to think most would better than to just start downloading things all willy nilly like most peoples' not tech savvy relatives would.

I'd argue that with about 70% of their player base being under 24, and potentially half of that (~35%) being under 18, that that demographic is more susceptible to bad actors. Fortnite scams have been proven to be very profitable with victims in the hundreds of thousands. So much so that Fortnite has repeatedly posted announcements to try to combat them.

[Adorable Cat]

4 hours ago, Iverion said:

It should be enough for Epic to release a statement that only downloads from their website is official and all others are fraudulent and possibly harmful

By "a lot of their fans", I meant like little kids who wouldn't know the difference between "epicgames.com" and "AmazingEpicFortniteGames.com". It only takes a super flashy visual to get a small child to click on something, just search on youtube "fortnite", 

 

 

[Doobeedoo]

I'm sure they thought about it. Like really how hard is to download the game APK from their official site which you can't miss. 

[Iverion]

I forgot about demographics. I find it funny that when it comes to laptops and desktops it's ok to download from their website via a browser but it's feels like a completely different mentality when it comes to "mobile". Honestly "mobiles" have essentially become a light version of a pc.

 

Thing is that there will always be that risk even if Epic stuck with the Play Store. Most adults don't give kids enough credit. Most aren't downright idiots, but rather just naive. If someone hears of an app that can give them free v bucks or some other thing they'll download it regardless if it's on or off the Play Store. It doesn't help when android makes it easy to install non-market apps. When you go to install an apk android will tell you that the option is set to disable in the setting and it'll take you to the setting to enable it.

[Iverion]

33 minutes ago, Arika S said:

no it doesn't. you know where else you can download anything from anywhere? a regular PC.

 

If people are stupid with their tech they will download things they shouldn't regardless of platform.

Also this. I very much agree with this

[orbitalbuzzsaw]

if you copy and paste this post into 50 other threads you get 5000 vbucks 111/10 very tru

[BuckGup]

Well it's not like theres tons of malware on the trusted play store anyways

[Sauron]

This is no different than downloading the wrong installer for a windows app. I bet google would LOVE to pretend that the only solution is to keep handing them a monopoly on distribution, but the best way to handle this (in the customer's interest) is through community maintenance, as with linux software repositories.

[jagdtigger]

1 hour ago, Sauron said:

This is no different than downloading the wrong installer for a windows app. I bet google would LOVE to pretend that the only solution is to keep handing them a monopoly on distribution, but the best way to handle this (in the customer's interest) is through community maintenance, as with linux software repositories.

There is one already, its called FDroid...

[suicidalfranco]

This should be fun...

 

*grabs popcorn*

[Sauron]

33 minutes ago, jagdtigger said:

There is one already, its called FDroid...

Yep, not too many apps on there though

[rcmaehl]

33 minutes ago, jagdtigger said:

There is one already, its called FDroid...

FDroid has been great

[jagdtigger]

3 minutes ago, Sauron said:

Yep, not too many apps on there though

Maybe because its FOSS and nowadays being open source isnt trendy....

[Sauron]

2 minutes ago, jagdtigger said:

Maybe because its FOSS and nowadays being open source isnt trendy....

There are some non foss apps on it, it just warns you about it

[Jito463]

*cough*cough* 

 

[Commodus]

I don't know that it'll create an epidemic, but I do think Epic didn't entirely understand the consequences of its decision.

 

It's not just that they're basically asking kids to open up an avenue for attack... it's that many ordinary people don't load non-Play Store apps and don't understand the security consequences of doing so.  And sorry, folks, I don't think it's reasonable to expect people of all ages to understand the technical side of what they're doing.

 

Yeah, Windows and Mac users don't have to go through app stores, but... they also have a problem with "free V-Bucks" and other scams.  Imagine what happens when you bring that to anyone with a reasonably fast Android phone from the past couple of years.

[dalekphalm]

4 hours ago, Arika S said:

no it doesn't. you know where else you can download anything from anywhere? a regular PC.

 

If people are stupid with their tech they will download things they shouldn't regardless of platform.

While the technicals are the same, it's not equivalent.

 

There's an expectation that when you download a Windows program, you need to be careful with where you get it from. And even with that, many people - no doubt including those who play Fortnite - still download malicious programs.

 

Furthermore, it's not even the fact that Fortnite requests you download directly from them, it's the fact that in order to do so, you have to disable a security feature.

 

Sure, there are plenty of Android users that can manage with this feature turned off (many who do it on purpose to get custom apk's), that's a willing choice that they go out of their way to do.

 

Epic is forcing a lot of users hands who do not know better.

[Sauron]

41 minutes ago, dalekphalm said:

While the technicals are the same, it's not equivalent.

 

There's an expectation that when you download a Windows program, you need to be careful with where you get it from. And even with that, many people - no doubt including those who play Fortnite - still download malicious programs.

 

Furthermore, it's not even the fact that Fortnite requests you download directly from them, it's the fact that in order to do so, you have to disable a security feature.

 

Sure, there are plenty of Android users that can manage with this feature turned off (many who do it on purpose to get custom apk's), that's a willing choice that they go out of their way to do.

 

Epic is forcing a lot of users hands who do not know better.

of course it doesn't help that android only considers store apps to be "trusted"... I wish there was a user friendly signature system to add verified pgp keys.