Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

21–30 of 164 posts

Re: Permissions asked for by Uber Android app

#21

Post by Arnor »

madeofpalk wrote: post #17
revelation wrote: post #14

Earlier quoted context omitted.

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

> I really don't see any reason for Google not to immediately remove this app Apart from Google being an investor in Uber?

It might be worth taking the hit...

Re: Permissions asked for by Uber Android app

#22

Post by higherpurpose »

madeofpalk wrote: post #17
revelation wrote: post #14

Earlier quoted context omitted.

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

> I really don't see any reason for Google not to immediately remove this app Apart from Google being an investor in Uber?

After all the recent scandals in Uber, how has Google not pushed for a complete overhaul of Uber's leadership already? It has become pretty clear the current leadership has some "issues".

Re: Permissions asked for by Uber Android app

#23

Post by lotsofmangos »

madeofpalk wrote: post #17
revelation wrote: post #14

Earlier quoted context omitted.

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

> I really don't see any reason for Google not to immediately remove this app Apart from Google being an investor in Uber?

If anything, that might make them pull it quicker.

If the analysis holds up, it would be very bad publicity to appear complicit.

Re: Permissions asked for by Uber Android app

#24

Post by jpatokal »

dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Now hold on a sec -- I'll buy that the Uber app appears to have a library compiled into it that could do all of that, which is worrisome enough, but as far as I can see, that blog provides no evidence that Uber is actually phoning home. Anybody up for doing a tcpdump?

Re: Permissions asked for by Uber Android app

#25

Post by liangx4 »

madeofpalk wrote: post #17
revelation wrote: post #14

Earlier quoted context omitted.

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

> I really don't see any reason for Google not to immediately remove this app Apart from Google being an investor in Uber?

well technically speaking google venture invested in uber

Re: Permissions asked for by Uber Android app

#27

Post by madeofpalk »

higherpurpose wrote: post #22
madeofpalk wrote: post #17

Earlier quoted context omitted.

> I really don't see any reason for Google not to immediately remove this app Apart from Google being an investor in Uber?

After all the recent scandals in Uber, how has Google not pushed for a complete overhaul of Uber's leadership already? It has become pretty clear the current leadership has some "issues".

Well I mean, is it actually causing any problems for Uber?

Uber has what's pretty close to a monopoly in what it offers, apart from a few cities in the US where Lyft also operates. I would say most people that user Uber are not interested in using the regular local taxi service.

Re: Permissions asked for by Uber Android app

#30

Post by profinger »

akanster wrote: post #9

Google cache: http://webcache.googleusercontent.com/search?q=cache:http://...

I like his image at the bottom that tells you to put in your credit card number and expiration to see if its been stolen. Upon inspection, the onclick just pops up an alert that says "Dumbass!" haha
Post reply on HN