Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k Android apps harvest data even after you deny permissions

cnet.com

Post reply on HN
Print view View original

121–130 of 146 posts

Re: More than 1k Android apps harvest data even after you deny permissions

#121

Post by droithomme »

Ajedi32 wrote: post #50
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity's API, for example, may not know that that information is supposed to be restricted on Android.

> some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries

I'll assume by vulnerabilities you meant to say exploits. Given that: True but so what. This is criminal behavior. Using criminal libraries makes you complicit and a co-conspirator.

Re: More than 1k Android apps harvest data even after you deny permissions

#122

Post by droithomme »

Avamander wrote: post #80
Ajedi32 wrote: post #50

Earlier quoted context omitted.

It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity's API, for example, may not know that that information is supposed to be restricted on Android.

Some might be using them without being aware of but the rest can be nicely permabanned.

If you use a library that engages in criminal activity, you are legitimately a criminal as well and should be held accountable.

Re: More than 1k Android apps harvest data even after you deny permissions

#123

Post by droithomme »

scarface74 wrote: post #42
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

If the app can get around the permission system - it’s a vulnerability in Android itself that Google needs to correct.

> If the app can get around the permission system - it’s a vulnerability in Android

That's the same argument as saying that if someone can use a baseball bat to smash in the window to my car, it's a vulnerability in the auto manufacturers glass manufacturing and should be their fault and not that of the car thief. It's an absurd and ridiculously nonsensical argument in defense of criminals.

Re: More than 1k Android apps harvest data even after you deny permissions

#124

Post by doomjunky »

rkachowski wrote: post #2

By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…

It's NOT pretty absurd to use access point information to gain location knowledge. Google Street View has done so.

Re: More than 1k Android apps harvest data even after you deny permissions

#125

Post by kalleboo »

fitzroy wrote: post #63
alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

The picture metadata exploit is interesting. It would be trivial to guess the user's home and work location given enough photos with EXIF data (locations and timestamps). I'm curious how this works on iOS. Granting complete access to "Photos" always seemed overly broad. It should be possible to limit an app to only save images, and/or limit accessing images to photos from the last 3 days etc, or only the images the a…

On iOS, photo write and read access are granted separately, so you can allow an app to only save photos.

Apps can also import photos without any permissions at all by invoking the system photo picker (where the user manually has to pick the photos one by one).

Re: More than 1k Android apps harvest data even after you deny permissions

#126

Post by kalleboo »

scarface74 wrote: post #70
lern_too_spel wrote: post #62

Earlier quoted context omitted.

If you upload a picture to Shutterfly, that is a user specifically putting the photo in the app's sandbox. The same thing happens on every other OS.

Not with iOS. There is a separate media library API that’s separate from the file access API. You can give an app permission to access your media library without giving it access to the location metadata. The app has to specifically ask for location access to get the metadata.

> You can give an app permission to access your media library without giving it access to the location metadata. The app has to specifically ask for location access to get the metadata

I believe this used to be true, but it's not anymore. I just tested it and even without location permissions, the location EXIF is included

Re: More than 1k Android apps harvest data even after you deny permissions

#127

Post by kalleboo »

imtyler wrote: post #20
sschueller wrote: post #3

Earlier quoted context omitted.

Android does not ask for permission to read certain things like the clipboard. So an app can intercept anything added to the clipboard such as passwords copied in by password managers.

Wow. The password manager I've been using for the past few years has dedicated buttons/gestures for copying the password to the clipboard (like many others, I'd assumed.) I feel like the expectations in this case are clear: a copied password should only accessible when the user "pastes" it. (The app even clears the clipboard after a certain amount of time, making it seem like the only weak point in the system is the…

> Does anybody know of any good reasons why the clipboard shouldn't be secure?

Seems like a UI issue to me. Right now apps themselves invoke the paste command (e.g. they can put a "paste" button in their UI). If you remove clipboard access from programs, the UI would have to be presented by the OS.

Requiring paste to be initiated by the OS may work alright for text boxes (but you'd now have to sandbox all the text boxes to avoid the app simulating taps), but it wouldn't work for say, pasting images.

Another option is to add a dialog box every time asking the user "did you REALLY want to paste?", but that will quickly get annoying.

Re: More than 1k Android apps harvest data even after you deny permissions

#128

Post by chopin »

Ajedi32 wrote: post #50
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity's API, for example, may not know that that information is supposed to be restricted on Android.

Vet your dependencies. I have no mercy for people who put crap on my phone.

Re: More than 1k Android apps harvest data even after you deny permissions

#129

Post by Xelbair »

Avamander wrote: post #34
alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Banning is just a band-aid

We need systematic solu...oh wait GDPR - just hit them with all the fines.

Re: More than 1k Android apps harvest data even after you deny permissions

#130

Post by Xelbair »

Ajedi32 wrote: post #50
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity's API, for example, may not know that that information is supposed to be restricted on Android.

And that excuses them how?

Ignorantia legis non excusat

Post reply on HN