More than 1k Android apps harvest data even after you deny permissions • Hacker News Board

Re: More than 1k Android apps harvest data even after you deny permissions

#31

Post by izacus » Mon, Jul 08, 2019, 6:58 PM UTC

newscracker wrote: post #11

> Egelman said the researchers notified Google about these issues last September, as well as the FTC. Google said it would be addressing the issues in Android Q, which is expected to release this year. A whole year to get a solution out?! Google is clearly demonstrating where it stands when it concerns privacy. With the usual low penetration of the latest release of Android, this will probably be “solved” for the maj…

> Edit: Why not crack down on apps through updates to the Play Store policies and rules? Apple seems to use that tactic sometimes.

Google has been doing that a lot lately and has created the appropriate amount of heavy complaining from the side of developers. Still, auditing source code for every one of those things is pretty much impossible - even iOS apps use a lot of such tricks to fingerprint users and Apple has a hard time keeping on top as well.

Re: More than 1k Android apps harvest data even after you deny permissions

#32

Post by izacus » Mon, Jul 08, 2019, 7:00 PM UTC

JadeNB wrote: post #25

ocdtrekkie wrote: post #24

Earlier quoted context omitted.

I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior, and it's kind of incredible to see we still have so many people in the industry who think scraping location data out of people's stored photos for advertising data is okay. It's well outside the realm of something I'd think someone would even try to do, especially from a pretty legitimate company like Shutt…

> I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior …. Right, but "our system will protect you from ethical developers!" isn't much of a security model, so I think there's still plenty of blame for Android here.

What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files?

Because this criminal behaviour is also present in Linux, Windows and macOS.

Or the fact that an app can write a file to disk? And then another app can open the file? Also criminal behaviour present in other operating systems. Some users might even call it a feature and do the unthinkable - share files between applications! Horrible!

Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer. If you want a jailed down device, it's fine: buy Apple. But that doesn't mean every pocket computer needs to be a crippled device.

Re: More than 1k Android apps harvest data even after you deny permissions

#33

Post by izacus » Mon, Jul 08, 2019, 7:04 PM UTC

aw3c2 wrote: post #27

HillaryBriss wrote: post #17

Earlier quoted context omitted.

> So basically, they can't read your location, but they can read other things that contain your (previous) location Yes, and I think we could make a good case that the Android platform did a poor job of clarifying this to the user. I would guess that the typical android user thinks "location permission" means location data of any type as generated by any subsystem on the device. To whom would a reasonable user assign…

Does iOS do anything to prevent this?

Yes, iOS prevents you from directly accessing the images and apps sharing files between themselves.

Which has been one of the major reasons some people used Android - the ability to use their phone more like a computer.

Re: More than 1k Android apps harvest data even after you deny permissions

#34

Post by Avamander » Mon, Jul 08, 2019, 7:10 PM UTC

alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently.

It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Re: More than 1k Android apps harvest data even after you deny permissions

#35

Post by nerdjon » Mon, Jul 08, 2019, 7:11 PM UTC

izacus wrote: post #32

JadeNB wrote: post #25

Earlier quoted context omitted.

> I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior …. Right, but "our system will protect you from ethical developers!" isn't much of a security model, so I think there's still plenty of blame for Android here.

What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files? Because this criminal behaviour is also present in Linux, Windows and macOS. Or the fact that an app can write a file to disk? And then another app can open the file? Also criminal behaviour present in other operating systems. Some users might even call it a feature and do the unthinkable - share files…

I would not consider my iPhone to be a crippled device.

Just because these issues exist on a traditional computing device, does not mean we should continue that trend when a new type of platform exists (mobile).

Plus, many of us likely have much more personal data on our phones that we ever had on our computers, especially location data for where you are all the time.

This is absolutely a failure of the OS, but if you choose to accept that fine. But the issue is for those that are not in the tech community and don't realize there data is being mined when they specially chose the option to deny it.

Re: More than 1k Android apps harvest data even after you deny permissions

#36

Post by muro » Mon, Jul 08, 2019, 7:17 PM UTC

ceejayoz wrote: post #29

giancarlostoro wrote: post #8

Earlier quoted context omitted.

> Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access location data. One of the first things I disable when I have a new phone is geolocation being added to photos. I just don't want my location randomly being shared from an image without my consent. If I wanted yo…

> If I wanted you to know where I took the picture, I would tell you. That's really missing the major use case, though, isn't it? I like having it enabled so my phone will tell me where I took the picture, because there's little chance I'll be able to a year later. It'd be nice if the "access photos" API on the device would have a separate permission for EXIF data. Without it, the app would receive only the image its…

I think that's what Google Photos do when you share (at least by link). Would be nice if photos accessed on Android had their location stripped, if the app doesn't have location access.

Re: More than 1k Android apps harvest data even after you deny permissions

#37

Post by anticensor » Mon, Jul 08, 2019, 7:20 PM UTC

sschueller wrote: post #3

rkachowski wrote: post #2

By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…

Android does not ask for permission to read certain things like the clipboard. So an app can intercept anything added to the clipboard such as passwords copied in by password managers.

Why not require both clipboard source and target applications to be running at the same time (i.e. clipboard acts as a channel, not a buffer)? This is implemented in GNOME native apps.

Re: More than 1k Android apps harvest data even after you deny permissions

#38

Post by JadeNB » Mon, Jul 08, 2019, 7:24 PM UTC

izacus wrote: post #32

JadeNB wrote: post #25

Earlier quoted context omitted.

> I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior …. Right, but "our system will protect you from ethical developers!" isn't much of a security model, so I think there's still plenty of blame for Android here.

What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files? Because this criminal behaviour is also present in Linux, Windows and macOS. Or the fact that an app can write a file to disk? And then another app can open the file? Also criminal behaviour present in other operating systems. Some users might even call it a feature and do the unthinkable - share files…

I expect my devices to uphold the security model they advertise.

My desktop OS (macOS, for what it matters) doesn't ask me to approve permissions for apps, so I assume that anything I install has whatever privileges I have (or root privileges, given the broken must-install-as-root behaviour of many of them).

On the other hand, for example, Firefox asks my permission before allowing sites to use the microphone or camera, and I expect it to enforce that. If sites can get access to my microphone or camera without my giving them permission, then Firefox has failed, even if those sites have got that access through unexpected means.

I agree it's very hard to have a secure but useable general-purpose system—but pretending that you're offering such a system while not actually having the appropriate mechanisms to enforce it is, arguably, an even worse solution than offering an utterly locked-down system.

Re: More than 1k Android apps harvest data even after you deny permissions

#39

Post by Ajedi32 » Mon, Jul 08, 2019, 7:26 PM UTC

yegle wrote: post #21

BryantD wrote: post #10

Earlier quoted context omitted.

There's a paper linked from the article which contains details on the sidechannels: https://www.ftc.gov/system/files/documents/public_events/141... Example: if you have an SD card installed, one advertising SDK creates a file on it. When the SDK is running in an app with appropriate permissions, it writes the IMEI and advertising ID to that file. When it's running in an app without appropriate permissions, it retriev…

For this specific issue, I believe https://developer.android.com/preview/privacy/scoped-storage is the solution. Too bad many Android developers are opposing this feature (e.g. previous discussion: https://news.ycombinator.com/item?id=19521211 ).

Loos like that system also fixes the "steal user location data from pictures metadata" bypass: https://developer.android.com/preview/privacy/scoped-storage...

Re: More than 1k Android apps harvest data even after you deny permissions

#40

Post by baybal2 » Mon, Jul 08, 2019, 7:27 PM UTC

Avamander wrote: post #34

alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Will google dare to ban alibaba?

Alibaba does no effort to conceal that they target ads by IMEI.

Browse Alibaba app*, search something. Do factory reset, make new account, and the first thing you will see after logging in with new acc will be your products from your last search.

Moreover, Alibaba's app will refuse to work if you block IMEI retrieval, or if they detect some kind of spoofing

edit, made it clear that it is the app, not website that links you by imei to your previous accs and history