Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Popular Google Play store apps are abusing permissions and committing ad fraud

buzzfeednews.com

Post reply on HN
Print view View original

161–170 of 178 posts

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#161

Post by snaky »

cjsilver wrote: post #127
kenoph wrote: post #120

I did my Master Thesis on this kind of stuff. There are many Apps among the top 100 free ones that ask permissions completely unrelated to their functionality. Yeah I know, not surprising. What surprised me at the time was that Android gives away much information "for free". For example, if I recall correctly, GET_ACCOUNTS was granted automatically and it allowed to get the "title" of every account on the phone as sh…

I'm the author of this article and I'd love to learn more about what you found in your research. You can reach me at craig dot silverman at buzzfeed.com.

This review from USENIX Enigma 2019 might be interesting for you. They tested over 80,000 of the most popular Android apps to examine what data they access and with whom they share it, how mobile apps are tracking and profiling users, how these practices are often against users' expectations and public disclosures, and how app developers may be violating various privacy regulations.

Some numbers from the presentation

  - the "GPS icon" is visible for only 0.04% of actual accesses to location data

  - of 42000 apps transmitting personal information, 21000 (50%) don't use TLS and send data unencrypted

  - 1,325 apps that don't have location permission, actually obtain street-level location data and transmit it home
https://www.usenix.org/conference/enigma2019/presentation/eg...

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#162

Post by shittyadmin »

vbezhenar wrote: post #154
shittyadmin wrote: post #14

Earlier quoted context omitted.

I'd say that the sandboxing introduced by mobile OSes today solves the vast majority of the problem. By isolating applications and introducing permissions, malware that can steal or encrypt user data isn't possible even for people installing those pirated APKs.

Don't trust Android or iOS or macOS sandbox. Google invests huge amounts of development time and research into Google Chrome JavaScript sandbox. It is the real wild west, there are malicious actors who want to break that sandbox. There are multiple layers of protection. Yet there are successful attacks. Much less people trying to break Android or iOS sandbox, because you can just ask for permission from Android and b…

> because you can just ask for permission from Android

You cannot ask for permission to bypass sandbox restrictions on Android. You need root access, which means physical access to do things like unlock the bootloader or an exploit.

iOS sandbox seems slightly weaker here due to the use of hidden/private functions to protect certain things, sideloaded apps would likely be a bigger risk on iOS than Android at the moment, but that's not something unresolvable.

In any case, the things you're discussing aren't really so problematic - isolation systems are only getting better, OS level ones are improving every day. We could easily have sandboxes at this level just as secure as the javascript ones.

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#163

Post by shittyadmin »

comex wrote: post #45
shittyadmin wrote: post #14

Earlier quoted context omitted.

I'd say that the sandboxing introduced by mobile OSes today solves the vast majority of the problem. By isolating applications and introducing permissions, malware that can steal or encrypt user data isn't possible even for people installing those pirated APKs.

But the type of malware described in the article obviously is possible, given that it’s possible even on the Play Store. The OP posed switching to a decentralized model as a solution to that , and it’s hard to see how that makes any sense.

I'd argue the type of malware described in this article is fairly to completely harmless to the user. Harm to ad networks and a bit of wasted bandwidth is basically the worst case scenario.

The wasted bandwidth would be made clear by the OS to the user too, so it'd be trivial to identify if it was a significant consumer.

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#164

Post by Yetanfou »

acdha wrote: post #157
Yetanfou wrote: post #151

Earlier quoted context omitted.

Linux survived these attacks. Debian survived them. Ubuntu did. More or less all Linux distributions have been attacked but survived, many of them thrive. Yes, this is free software. Being less susceptible to these problems has been one of the stated advantages of using such for a long time. Alternative 'stores' carrying 'pirated' non-free software do not have this advantage and can easily turn into dark places so th…

> Linux survived these attacks. Debian survived them. Ubuntu did. More or less all Linux distributions have been attacked but survived, many of them thrive. Really? Is there a huge market of mainstream consumer Linux software which I've missed in the past 3 decades of using it? The answer is, of course, no. Linux distributions have mostly been used by developers and other IT people and there's never been the equivale…

Well, there is Android, that uses Linux and is as mainstream consumer as it gets. Do mind that I specifically said 'Linux survived' as in 'the Linux kernel project', followed by a number of Linux distributions.

Also, where are those Linux users [who] have for years been fooled into running binaries or installing packages? The majority of Linux users get their software from repositories maintained by whichever distribution they use. This fact is one of the reasons why Linux users are far less likely to install 'random' software. It is that aspect of Linux distributions which 'stores' like F-Droid bring to Android.

Last, what kind of 'hardening' do you deem every other consumer OS has had to make which Linux distributions have yet to accomplish? I'd go so far as saying that the likes of Windows and MacOS are playing catch-up here in finally getting around to implementing a sane repository infrastructure from which users can install and update software instead of having them hunting around the web for some SETUP.EXE to download and click on - which then proceeds to install not only the requested program but also a host of toolbars and 'shopping assistants'.

That both Apple as well as Microsoft took one step further in making these software repositories single-source to the detriment of their user's freedom of choice is what started this discussion in the first place.

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#165

Post by DarwinMailApp »

Cthulhu_ wrote: post #153
fooqux wrote: post #139

Earlier quoted context omitted.

Abuse your trust? The better question is why are you trusting them in the first place? If you actually read the TOS of a service, you'd know that they are usually quite forthright with what they are going to do. If a murderer knocks on your door, informs you that if you let them in they're going to brutally murder you, but you choose to ignore that because they brought you free stuff, you don't get to complain about…

That is a stupid analogy which I hope I don't even need to explain. A terms of service is not a free pass to do whatever the fuck you want. Just because I agreed to Apple's terms of service doesn't mean they can turn me into a human centiPad, even if it says so in the small print.

Yes exactly. Not to mention (pun intended) they don't mention in their TOS that they will be abusing their power and doing whatever they want with your data.

They never say that. They just do it.

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#166

Post by DarwinMailApp »

tim_sw wrote: post #124
tremon wrote: post #103

Earlier quoted context omitted.

Microsoft, for all their other flaws, usually keeps out of the business of selling their consumers. Perhaps it's because they have better (internal) monetization possibilities.

Microsoft sells your browsing and installed apps data to companies

No way - do you know which?

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#167

Post by ajnin »

stephenr wrote: post #74
LoSboccacc wrote: post #72

Earlier quoted context omitted.

can't see anywhere mentioned geofencing.

That also applies to the comment I replied to.

The comment you replied to mentioned :

> use GPS like an app can

that means high resolution location, background updates, geofencing, etc ...

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#168

Post by linuxftw »

deogeo wrote: post #35
dzdt wrote: post #25

Earlier quoted context omitted.

So if google's app store is so bad (and I tend to agree it isn't great) what is preventing the rise of a better alternative app store? They exist, but as far as I can tell none have gained any traction.

Google's illegal anticompetitive contracts with phone manufacturers that forbid them from developing/selling non-Google-app-store-infected phones if they want to sell any phone's with Google's app store: https://www.theinformation.com/articles/Google-s-Confidentia...

How do people still not know about this?

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#169

Post by cjsilver »

snaky wrote: post #161
cjsilver wrote: post #127

Earlier quoted context omitted.

I'm the author of this article and I'd love to learn more about what you found in your research. You can reach me at craig dot silverman at buzzfeed.com.

This review from USENIX Enigma 2019 might be interesting for you. They tested over 80,000 of the most popular Android apps to examine what data they access and with whom they share it, how mobile apps are tracking and profiling users, how these practices are often against users' expectations and public disclosures, and how app developers may be violating various privacy regulations. Some numbers from the presentation…

Thanks!

Re: Popular Google Play store apps are abusing permissions and committing ad fraud

#170

Post by fooqux »

Cthulhu_ wrote: post #153
fooqux wrote: post #139

Earlier quoted context omitted.

Abuse your trust? The better question is why are you trusting them in the first place? If you actually read the TOS of a service, you'd know that they are usually quite forthright with what they are going to do. If a murderer knocks on your door, informs you that if you let them in they're going to brutally murder you, but you choose to ignore that because they brought you free stuff, you don't get to complain about…

That is a stupid analogy which I hope I don't even need to explain. A terms of service is not a free pass to do whatever the fuck you want. Just because I agreed to Apple's terms of service doesn't mean they can turn me into a human centiPad, even if it says so in the small print.

sigh Serves me right for using an analogy I guess. Or a "stupid" one. I dislike the need to defend against a strawman argument, but it looks like I am going to.

Anyway, you're right, and so are the other people pointing out quite correctly that murder is still illegal and an agreement doesn't magically give them a right to kill me. But you know what isn't illegal? A company selling your data that you gave to them and agreed to allow them to sell in exchange for providing a service. Yes, I know there are some weak protection rules out there, and things like the GDPR exist in some countries. IANAL, but an app using permissions that you gave it, to do things it says it's going to do in its description and/or TOS is not illegal in most countries. If it was, we'd not be in the privacy clusterfuck that we're in today.

The point is that trust has nothing to do with it. If anything, these companies tell you exactly what they're going to do (and if they don't, that's another problem altogether which I'm not getting into here) and you can trust that they will do what they said they're going to do to make as much money from you as they can. Treating companies like living, empathetic human beings worthy of your trust to "be nice and give you a product for free without selling your data you agreed to allow them to sell" is silly.

Post reply on HN