Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

1–10 of 164 posts

Re: Permissions asked for by Uber Android app

#2

Post by api »

There's a general trend of mobile apps that ask for everything: camera, microphone, sensors, access to local files, WiFi, etc. These are apps (like Uber) with no good reason to need access to such things.

In most cases I can think of no good reason for this except either a desire to surveil customers for indirect monetization, or participation in government or private surveillance grid efforts.

I've got Lyft on my Android phone, but not Uber. I look at its permissions and the only dubious looking one is "access to take photos / videos." Is this perhaps for signing up as a driver and photographing yourself and your car? I don't see anything else that doesn't make sense.

Re: Permissions asked for by Uber Android app

#3

Post by andrewvc »

Recall that PUT / DELETE aren’t official HTTP requests, rather extensions implemented via WebDav. Modern applications don’t bother with these requests since its easier / more secure to perform those same actions with a server side language.

Apparently the author has not ever heard of REST. I'm a little shocked by that.

Re: Permissions asked for by Uber Android app

#5

Post by dmix »

TLDR: Uber's Android app is literally malware

Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your:

- SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs)

It also checks if you're phone is rooted/jailbroken and if it's vulnerable to Heartbleed... which it also calls home.

From my understanding, which the author somehow missed, is that it is using http://www.inauth.com SDK which provides 'malware detection'. This SDK is popular in the 'mobile finance industry' and the banking sector. Also notably one of the founders is former DHS/FBI.

Two possible theories: it is being used for fraud detection and/or an intelligence gathering tool.

Edit: here is a copy of the decompiled source code http://www.gironsec.com/blog/wp-content/uploads/2014/11/InAu... note the name "package com.inauth.mme"

Edit #2: here is a screenshot of Uber's permission request https://i.imgur.com/4MmYrJH.png no SMS on the list

Re: Permissions asked for by Uber Android app

#6

Post by mcav »

andrewvc wrote: post #3

Recall that PUT / DELETE aren’t official HTTP requests, rather extensions implemented via WebDav. Modern applications don’t bother with these requests since its easier / more secure to perform those same actions with a server side language. Apparently the author has not ever heard of REST. I'm a little shocked by that.

PUT and DELETE are standardized. http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

Re: Permissions asked for by Uber Android app

#7

Post by iolsantr »

andrewvc wrote: post #3

Recall that PUT / DELETE aren’t official HTTP requests, rather extensions implemented via WebDav. Modern applications don’t bother with these requests since its easier / more secure to perform those same actions with a server side language. Apparently the author has not ever heard of REST. I'm a little shocked by that.

Yeah I noticed that as well, it makes me wonder about the rest of his technical assertions that I'm less able to judge.

Just in case anyone was wondering here's the HTTP 1.1 rfc: https://www.ietf.org/rfc/rfc2616.txt A simple search will show that it does include PUT and DELETE.

Re: Permissions asked for by Uber Android app

#8

Post by alexbecker »

api wrote: post #2

There's a general trend of mobile apps that ask for everything: camera, microphone, sensors, access to local files, WiFi, etc. These are apps (like Uber) with no good reason to need access to such things. In most cases I can think of no good reason for this except either a desire to surveil customers for indirect monetization, or participation in government or private surveillance grid efforts. I've got Lyft on my An…

It's worth noting that the quick summation of Android permissions given to users isn't quite accurate. There are a limited number of permissions, and many of them (such as SD card read/write access) are very broad. So the summary Google uses is a lay description of the worst possible thing an app could do with those permissions, which may be much more invasive than what it actually does.
Post reply on HN