More than 1k Android apps harvest data even after you deny permissions • Hacker News Board

Re: More than 1k Android apps harvest data even after you deny permissions

#21

Post by yegle » Mon, Jul 08, 2019, 4:55 PM UTC

BryantD wrote: post #10

rkachowski wrote: post #2

By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…

There's a paper linked from the article which contains details on the sidechannels: https://www.ftc.gov/system/files/documents/public_events/141... Example: if you have an SD card installed, one advertising SDK creates a file on it. When the SDK is running in an app with appropriate permissions, it writes the IMEI and advertising ID to that file. When it's running in an app without appropriate permissions, it retriev…

For this specific issue, I believe https://developer.android.com/preview/privacy/scoped-storage is the solution.

Too bad many Android developers are opposing this feature (e.g. previous discussion: https://news.ycombinator.com/item?id=19521211).

Re: More than 1k Android apps harvest data even after you deny permissions

#22

Post by Slashbot » Mon, Jul 08, 2019, 5:00 PM UTC

newscracker wrote: post #11

> Egelman said the researchers notified Google about these issues last September, as well as the FTC. Google said it would be addressing the issues in Android Q, which is expected to release this year. A whole year to get a solution out?! Google is clearly demonstrating where it stands when it concerns privacy. With the usual low penetration of the latest release of Android, this will probably be “solved” for the maj…

When Google doesn't and never has given a fuck about users privacy, it sets a clear standard and example for all the rest of bludgers doing the same...

Ironically, when you look at most of the obfuscated shite being peddled through javascrap, and all these damn ad and analytic networks.. they are all pretty much doing the same kind of user interest/mouse/click tracking etc... so gooble's dfp adplatform collects most of the same data... do they share it, with the rest of the 'ad partners' and save them from running the same sort of js crap via there own scripts.. nope... so end users end up loading pages in some cases more than 1mb worth of useless javascrap all doing the same shit.

And to hell with google ever providing adequate control over what in the javascrap api is allowed to be run on a users browser... I might be fine with some functionality of javascrap being able to run in order for websites to provide better functionality and design. But when you have to accept that just by allowing javascrap in order to get a functioning website you have to allow all of the rest of its possible bad behaviour of privacy and security abuse issues... do google care.. hell no, they've been finding ways to get lazy web developers hooked on making literately every site they come across into using and relying on third party scripts.. and it started off with recaptcha crap, site analytics, ad platform serving, to the ultimate point of insanity where entire websites (or crap apps) are rendered with overcomplicated shit like react and angular etc... you literately don't even get a semi functioning website with javascrap disabled now.. html/css specs have been left in stagnation while everyone has pursued abusing the hell out of javascrap into doing everything.

so to hell with the w3c, google, mozilla, microsoft etc.. they've all turned the internet into a pile of poo... now advertisement images come with more js shite behind it to run than the ad image itself... and I was fine with image baseed advertisements on a page... I'm not fine with the level of privacy invasion and shitty cookie popups prompts pretending to offer me choice on data collection etc.... these cunts and the EU all need to go take a hike into hell.

Re: More than 1k Android apps harvest data even after you deny permissions

#23

Post by BryantD » Mon, Jul 08, 2019, 5:24 PM UTC

yegle wrote: post #21

BryantD wrote: post #10

Earlier quoted context omitted.

There's a paper linked from the article which contains details on the sidechannels: https://www.ftc.gov/system/files/documents/public_events/141... Example: if you have an SD card installed, one advertising SDK creates a file on it. When the SDK is running in an app with appropriate permissions, it writes the IMEI and advertising ID to that file. When it's running in an app without appropriate permissions, it retriev…

For this specific issue, I believe https://developer.android.com/preview/privacy/scoped-storage is the solution. Too bad many Android developers are opposing this feature (e.g. previous discussion: https://news.ycombinator.com/item?id=19521211 ).

Yeah, that seems like the right answer.

However, I think you still have to hold developers responsible for clever tricks that violate the intent of the Android permissions system. There are always going to be loopholes. (This likewise means that there has to be room for developers to make honest mistakes.)

Re: More than 1k Android apps harvest data even after you deny permissions

#24

Post by ocdtrekkie » Mon, Jul 08, 2019, 5:32 PM UTC

HillaryBriss wrote: post #17

wartijn_ wrote: post #4

Earlier quoted context omitted.

From the article: > The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos. > Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access locati…

> So basically, they can't read your location, but they can read other things that contain your (previous) location Yes, and I think we could make a good case that the Android platform did a poor job of clarifying this to the user. I would guess that the typical android user thinks "location permission" means location data of any type as generated by any subsystem on the device. To whom would a reasonable user assign…

I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior, and it's kind of incredible to see we still have so many people in the industry who think scraping location data out of people's stored photos for advertising data is okay. It's well outside the realm of something I'd think someone would even try to do, especially from a pretty legitimate company like Shutterfly.

Re: More than 1k Android apps harvest data even after you deny permissions

#25

Post by JadeNB » Mon, Jul 08, 2019, 5:42 PM UTC

ocdtrekkie wrote: post #24

HillaryBriss wrote: post #17

Earlier quoted context omitted.

> So basically, they can't read your location, but they can read other things that contain your (previous) location Yes, and I think we could make a good case that the Android platform did a poor job of clarifying this to the user. I would guess that the typical android user thinks "location permission" means location data of any type as generated by any subsystem on the device. To whom would a reasonable user assign…

I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior, and it's kind of incredible to see we still have so many people in the industry who think scraping location data out of people's stored photos for advertising data is okay. It's well outside the realm of something I'd think someone would even try to do, especially from a pretty legitimate company like Shutt…

> I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior ….

Right, but "our system will protect you from ethical developers!" isn't much of a security model, so I think there's still plenty of blame for Android here.

Re: More than 1k Android apps harvest data even after you deny permissions

#26

Post by alvern » Mon, Jul 08, 2019, 6:28 PM UTC

[0] from the researchers pdf:

• We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment.

• We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play Store and include popular apps from all categories. We further describe the vulnerabilities in detail, and measure the degree to which they are in active use, and thus pose a threat to users. We discovered covert and side channels used in the wild that compromise both users’ location data and persistent identifers.

• We discovered companies getting the MAC addresses of the connected WiFi base stations from the ARP cache. This can be used as a surrogate for location data. We found 5 apps exploiting this vulnerability and 5 with the pertinent code to do so.

• We discovered Unity obtaining the device MAC address using ioctl system calls. The MAC address can be used to uniquely identify the device. We found 42 apps exploiting this vulnerability and 12,408 apps with the pertinent code to do so.

• We also discovered that third-party libraries provided by two Chinese companies—Baidu and Salmonads— independently make use of the SD card as a covert channel, so that when an app can read the phone’s IMEI, it stores it for other apps that cannot. We found 159 apps with the potential to exploit this covert channel and empirically found 13 apps doing so.

• We found one app that used picture metadata as a side channel to access precise location information despite not holding location permissions.

[0] https://www.ftc.gov/system/files/documents/public_events/141...

Re: More than 1k Android apps harvest data even after you deny permissions

#27

Post by aw3c2 » Mon, Jul 08, 2019, 6:32 PM UTC

HillaryBriss wrote: post #17

wartijn_ wrote: post #4

Earlier quoted context omitted.

From the article: > The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos. > Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access locati…

> So basically, they can't read your location, but they can read other things that contain your (previous) location Yes, and I think we could make a good case that the Android platform did a poor job of clarifying this to the user. I would guess that the typical android user thinks "location permission" means location data of any type as generated by any subsystem on the device. To whom would a reasonable user assign…

Does iOS do anything to prevent this?

Re: More than 1k Android apps harvest data even after you deny permissions

#28

Post by z3t4 » Mon, Jul 08, 2019, 6:41 PM UTC

By default apps should not be able to call home, in order to save battery and data plan, ohh and also privacy.

Re: More than 1k Android apps harvest data even after you deny permissions

#29

Post by ceejayoz » Mon, Jul 08, 2019, 6:46 PM UTC

giancarlostoro wrote: post #8

wartijn_ wrote: post #4

Earlier quoted context omitted.

From the article: > The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos. > Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access locati…

> Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access location data. One of the first things I disable when I have a new phone is geolocation being added to photos. I just don't want my location randomly being shared from an image without my consent. If I wanted yo…

> If I wanted you to know where I took the picture, I would tell you.

That's really missing the major use case, though, isn't it? I like having it enabled so my phone will tell me where I took the picture, because there's little chance I'll be able to a year later.

It'd be nice if the "access photos" API on the device would have a separate permission for EXIF data. Without it, the app would receive only the image itself, not the attached metadata - kinda like how Facebook strips off any EXIF data when you publish a photo there.

Re: More than 1k Android apps harvest data even after you deny permissions

#30

Post by izacus » Mon, Jul 08, 2019, 6:57 PM UTC

driverdan wrote: post #6

Why do they have to wait for Android Q? Couldn't they pull the apps now?

They can pull the apps, but Android Q will add several additional security features - e.g. scoped storage (no more SD card access without user consent), EXIF location stripping (accessing EXIF from photos will require additional permissions) and plugging of several possible fingerprinting sidechannels.