Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

41–50 of 164 posts

Re: Permissions asked for by Uber Android app

#41

Post by [deleted] »

revelation wrote: post #14
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

[deleted]

Re: Permissions asked for by Uber Android app

#42

Post by [deleted] »

revelation wrote: post #14
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

[deleted]

Re: Permissions asked for by Uber Android app

#43

Post by methehack »

amirmc wrote: post #32
jpatokal wrote: post #24

Earlier quoted context omitted.

Now hold on a sec -- I'll buy that the Uber app appears to have a library compiled into it that could do all of that, which is worrisome enough, but as far as I can see, that blog provides no evidence that Uber is actually phoning home. Anybody up for doing a tcpdump?

> "... but as far as I can see, that blog provides no evidence that Uber is actually phoning home" That does not make it ok.

It may not be ok, but it's completely different, imo. If they're not using the libraries, they can change it and no big deal. If they are using the libraries and stealing all this information that doesn't belong to them, that feels criminal to me (or ought to be).

So...I'd love to know...are they really doing this?

Re: Permissions asked for by Uber Android app

#44

Post by TillE »

api wrote: post #31
rco8786 wrote: post #11

Earlier quoted context omitted.

It's a common practice to do this "just in case" you need the permissions later on. When first installing an app users are likely to hit Ok to whatever, but when permissions change on an update they are hit with another screen that tells them the specific thing you are now asking permissions for.

Sounds like classic poor security UX design -- it encourages people to allow everything, and encourages apps to claim everything.

I have a lot of issues with iOS, but I think Apple's UX here is clearly superior: it asks you about each individual permission an app requests (not on install, but when the permission is first used), and allows you to deny it.

Re: Permissions asked for by Uber Android app

#45

Post by prostoalex »

revelation wrote: post #14
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

> I really don't see any reason for Google not to immediately remove this app from the store permanently and ban whatever developer uploaded it

The original article is down, but do they somehow bypass the Android permission authorization process? Or the user still has to authorize the app to access all the resources?

Re: Permissions asked for by Uber Android app

#46

Post by brotchie »

dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

All one has to do is look at the App info for the Uber app.

It doesn't ask for permissions to access anything SMS related, or call history related.

I'm assuming they've included the entire InAuth SDK, but not used most of the functionality.

Re: Permissions asked for by Uber Android app

#47

Post by blhack »

A LOT of this stuff is pretty easily explainable. They want access to SMS and phone calls because the Uber app uses those things.

Camera doesn't seem terribly implausible. IT could be an incoming feature that allows you to take a photo of where you are so that your driver can find you more easily.

The WiFi stuff is probably related to location. edit: as pointed out below, this is so that you can take a photo of your credit card so you don't have to type it in.

This seems like "hydrogen hydroxide KILLS" scare mongering.

BTW, this is all available in the app permissions: https://lh3.googleusercontent.com/-FVPu6x-F5SM/VHUZgU47m-I/A...

I don't see the big OMG SECRET MALWARE scariness.

Re: Permissions asked for by Uber Android app

#48

Post by tetrep »

dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

>- SMS list

Nothing provided by the OP shows what is actually being sent. The linked text document of the code only shows the creation of an instance of the SMSLog class, which itself is defined in another class (not provided or discussed by OP). This is the same for most of the scary bits, which is unfortunate as seeing the code itself (or the MITM'ing the app and seeing the data) would be very interesting.

Re: Permissions asked for by Uber Android app

#49

Post by hero454545 »

revelation wrote: post #14
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

Well it's very popular among users. Removing it from the store immediately and/or permanently seems likely to get some backlash from the user base.
Post reply on HN