Live data from Hacker News

Pairings of Android apps that leak sensitive data

theatlantic.com

11–14 of 14 posts

Re: Pairings of Android apps that leak sensitive data

#11
post #9
post #2

Or in other words: There are 35 apps that can leak your data to tons of other apps. However we're not going to tell you which ones.

Also... MUSLIMS! In case you weren't suitably terrified by the meaningless large numbers

In no way does it imply you should be scared of the Muslims.

In the example given, it is the Muslims who should be scared.

Re: Pairings of Android apps that leak sensitive data

#13
post #9

Earlier quoted context omitted.

Also... MUSLIMS! In case you weren't suitably terrified by the meaningless large numbers

In no way does it imply you should be scared of the Muslims. In the example given, it is the Muslims who should be scared.

> In no way does it imply you should be scared of the Muslims.

It's not implying that you should, it is expecting that you are. It’s a FUD article touting b.s. numbers to boost the impression of vulnerability and of the 35-ish problem apps they chose to describe the one that’s a muslim prayer app. Why not choose a stopwatch app or a flappy bird clone or literally ANY of the other ones? Because they are depending on your preexisting, generalized fear of muslims.

> In the example given, it is the Muslims who should be scared.

Yes, I agree. Not only are they the victims of poorly written apps, they are also the victims of poorly written news

Re: Pairings of Android apps that leak sensitive data

#14

The study is available here[0]. The gist is that an app can launder a request it isn't privileged to make through another app that is privileged and doesn't correctly check the intent sender. There are examples in Section 4.3. [0] : http://people.cs.vt.edu/danfeng/papers/AsiaCCS-17-Yao.pdf

maybe i'm reading it wrong, but a lot of the examples in section 4.3 look like one app inadvertently sending sensitive data to another app (in an intent object).

i.e. the receiving app is getting some sensitive data it isn't supposed to have but didn't ask for, and then handling it inappropriately (e.g. leaking it to a log).

Post reply on HN