Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Permissions asked for by Uber Android app

gironsec.com

Post reply on HN
Print view View original

71–80 of 164 posts

Re: Permissions asked for by Uber Android app

#71

Post by [deleted] »

tetrep wrote: post #48
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

>- SMS list Nothing provided by the OP shows what is actually being sent. The linked text document of the code only shows the creation of an instance of the SMSLog class, which itself is defined in another class (not provided or discussed by OP). This is the same for most of the scary bits, which is unfortunate as seeing the code itself (or the MITM'ing the app and seeing the data) would be very interesting.

[deleted]

Re: Permissions asked for by Uber Android app

#72

Post by andymcsherry »

revelation wrote: post #61
andymcsherry wrote: post #34

There's perfectly reasonable explanation for almost all of these permissions, and there's nothing in this analysis that suggests they're doing otherwise. The only one that I couldn't think of was WRITE_SETTINGS Permissions ACCESS_COARSE_LOCATION & ACCESS_FINE_LOCATION: Fairly obvious, they need to figure out where to pick you up ACCESS_NETWORK_STATE, ACCESS_WIFI_STATE , INTERNET: They need to figure out if you have i…

This is like saying we should give everyone root access because there are legitimate situations where that is warranted and not misused. I mean, I might trust my neighbor with the key to my apartment, but I'll still call the cops when he comes in and trashes the place. Similarly, maybe there are valid reasons for Uber to have these permissions. That doesn't mean they can upload a dump of whatever data they can find t…

There's a difference between checking if root access can be granted and gaining root access. If Uber were to use this access, the superuser app would prompt the user to approve it. The user would then have to grant permission.

There's no proof in this article that they are uploading this data to their servers, just speculation. The snippet of some methods he showed doesn't even make sense, because they don't ask for permissions for your SMS, MMS or other permissions required for these things.

Re: Permissions asked for by Uber Android app

#73

Post by bcoates »

amirmc wrote: post #32
jpatokal wrote: post #24

Earlier quoted context omitted.

Now hold on a sec -- I'll buy that the Uber app appears to have a library compiled into it that could do all of that, which is worrisome enough, but as far as I can see, that blog provides no evidence that Uber is actually phoning home. Anybody up for doing a tcpdump?

> "... but as far as I can see, that blog provides no evidence that Uber is actually phoning home" That does not make it ok.

What's not-ok about linking a do-everything platform library?

Re: Permissions asked for by Uber Android app

#74

Post by [deleted] »

brotchie wrote: post #46
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

All one has to do is look at the App info for the Uber app. It doesn't ask for permissions to access anything SMS related, or call history related. I'm assuming they've included the entire InAuth SDK, but not used most of the functionality.

[deleted]

Re: Permissions asked for by Uber Android app

#75

Post by revelation »

andymcsherry wrote: post #72
revelation wrote: post #61

Earlier quoted context omitted.

This is like saying we should give everyone root access because there are legitimate situations where that is warranted and not misused. I mean, I might trust my neighbor with the key to my apartment, but I'll still call the cops when he comes in and trashes the place. Similarly, maybe there are valid reasons for Uber to have these permissions. That doesn't mean they can upload a dump of whatever data they can find t…

There's a difference between checking if root access can be granted and gaining root access. If Uber were to use this access, the superuser app would prompt the user to approve it. The user would then have to grant permission. There's no proof in this article that they are uploading this data to their servers, just speculation. The snippet of some methods he showed doesn't even make sense, because they don't ask for…

That was a metaphore. Also, as you are certainly aware, Android apps don't ask for permissions through code, they request them in various metadata manifests.

Re: Permissions asked for by Uber Android app

#76

Post by Zigurd »

nhayden wrote: post #57
revelation wrote: post #14

Earlier quoted context omitted.

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

A lot of apps collect this information. There are flashlight apps that collect the same level. This is nothing new.

That doesn't mean it's good for users or for users or for Android's reputation as an app ghetto. Some means of scoring apps down for needless permissions would be a good thing.

Re: Permissions asked for by Uber Android app

#77

Post by serve_yay »

revelation wrote: post #14
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each: - Accounts log (Email) - App Activity (Name, PackageName, Process Number of activity, Processed id) - App Data Usage (Cache size, code size, data size, name, package name) - App Install (installed at, name, package name, unknown sources enabled, version code, version name) - Battery (health, level, plugg…

Huh, really? That sounds almost like something Apple would do.

Re: Permissions asked for by Uber Android app

#79

Post by revelation »

tetrep wrote: post #48
dmix wrote: post #5

TLDR : Uber's Android app is literally malware Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your: - SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs) It…

>- SMS list Nothing provided by the OP shows what is actually being sent. The linked text document of the code only shows the creation of an instance of the SMSLog class, which itself is defined in another class (not provided or discussed by OP). This is the same for most of the scary bits, which is unfortunate as seeing the code itself (or the MITM'ing the app and seeing the data) would be very interesting.

It takes all of a minute to download the APK from the store and check for yourself. I just did and SMSLog is present in it and does grab all your SMS metadata starting with the most recent ones, saving for each message:

- checked at (timestamp when read?), to number, service number, sms at (timestamp received?), sms type

Now I can't tell you if it does actually transmit that data, but the remainder of the code looks for the world like it. In the end, of course, it doesn't actually matter. That's like arguing if malware that lies dormant actually exists.

Re: Permissions asked for by Uber Android app

#80

Post by [deleted] »

blhack wrote: post #47

A LOT of this stuff is pretty easily explainable. They want access to SMS and phone calls because the Uber app uses those things. Camera doesn't seem terribly implausible. IT could be an incoming feature that allows you to take a photo of where you are so that your driver can find you more easily. The WiFi stuff is probably related to location. edit: as pointed out below, this is so that you can take a photo of your…

[deleted]
Post reply on HN