More than 1k Android apps harvest data even after you deny permissions • Hacker News Board

Re: More than 1k Android apps harvest data even after you deny permissions

#41

Post by Ajedi32 » Mon, Jul 08, 2019, 7:28 PM UTC

wartijn_ wrote: post #4

rkachowski wrote: post #2

By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…

From the article: > The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos. > Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access locati…

This particular issue should be fixed by Android Q's new "scoped storage" permission model: https://developer.android.com/preview/privacy/scoped-storage...

Re: More than 1k Android apps harvest data even after you deny permissions

#42

Post by scarface74 » Mon, Jul 08, 2019, 7:29 PM UTC

Avamander wrote: post #34

alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

If the app can get around the permission system - it’s a vulnerability in Android itself that Google needs to correct.

Re: More than 1k Android apps harvest data even after you deny permissions

#43

Post by baybal2 » Mon, Jul 08, 2019, 7:30 PM UTC

panpanna wrote: post #16

wartijn_ wrote: post #9

Earlier quoted context omitted.

According to Google Bluetooth requires location, because it van be used to find your location. So there is some reasoning behind this decisions, although I wwould be mutch happier with something like: Location (Bluetooth), location (GPS), location (WiFi) >A location permission is required because Bluetooth scans can be used to gather information about the location of the user. This information may come from the user'…

Please take a step back and look at this again. What is the cause and what is the effect here? Is Google's solution making it better or worse from a practical privacy point of view? (Also, don't buy Google's explanation that this is just to inform users of potential misuse - they actually log your location and even wait for a GPS lock when you pair a new device)

Even APIs of J2ME applets and symbian s60 did not reveal hardware addresses to the program.

I felt that google was lazy and simply mapped bluez 1-to-1 to public api.

Re: More than 1k Android apps harvest data even after you deny permissions

#44

Post by scarface74 » Mon, Jul 08, 2019, 7:32 PM UTC

ocdtrekkie wrote: post #24

HillaryBriss wrote: post #17

Earlier quoted context omitted.

> So basically, they can't read your location, but they can read other things that contain your (previous) location Yes, and I think we could make a good case that the Android platform did a poor job of clarifying this to the user. I would guess that the typical android user thinks "location permission" means location data of any type as generated by any subsystem on the device. To whom would a reasonable user assign…

I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior, and it's kind of incredible to see we still have so many people in the industry who think scraping location data out of people's stored photos for advertising data is okay. It's well outside the realm of something I'd think someone would even try to do, especially from a pretty legitimate company like Shutt…

Yes Android is to blame. The entire idea behind a sandboxed mobile OS is that random developers can’t be trusted not to invade your privacy.

But honestly neither can Google, but that’s another story...

Re: More than 1k Android apps harvest data even after you deny permissions

#45

Post by Ajedi32 » Mon, Jul 08, 2019, 7:35 PM UTC

baybal2 wrote: post #40

Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Will google dare to ban alibaba? Alibaba does no effort to conceal that they target ads by IMEI. Browse Alibaba app*, search something. Do factory reset, make new account, and the first thing you will see after logging in with new acc will be your products from your last search. Moreover, Alibaba's app will refuse to work if you block IMEI retrieval, or if they detect some kind of spoofing edit, made it clear that it…

How does that work? None of the methods described in this paper seem like they'd work with _websites_. They all seem to rely on permissions only available to native apps.

Re: More than 1k Android apps harvest data even after you deny permissions

#46

Post by scarface74 » Mon, Jul 08, 2019, 7:35 PM UTC

izacus wrote: post #33

aw3c2 wrote: post #27

Earlier quoted context omitted.

Does iOS do anything to prevent this?

Yes, iOS prevents you from directly accessing the images and apps sharing files between themselves. Which has been one of the major reasons some people used Android - the ability to use their phone more like a computer.

No, iOS prevents the application from directly accessing files without the user’s permission. The user can choose to allow access granularly to a file via the file picker within the app.

There are also separate permissions to allow apps to read and write from the media library.

Re: More than 1k Android apps harvest data even after you deny permissions

#47

Post by Ajedi32 » Mon, Jul 08, 2019, 7:35 PM UTC

alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

> We also discovered that third-party libraries provided by two Chinese companies—Baidu and Salmonads— independently make use of the SD card as a covert channel, so that when an app can read the phone’s IMEI, it stores it for other apps that cannot.

From the paper, it looks like it stores those in `/sdcard/.googlex9/.xamdecoq0962` and `/sdcard/backups/.SystemConfig/.cuid2`. I wonder what would happen if I simlinked those files to `/dev/null`...

Re: More than 1k Android apps harvest data even after you deny permissions

#48

Post by scarface74 » Mon, Jul 08, 2019, 7:36 PM UTC

izacus wrote: post #32

JadeNB wrote: post #25

Earlier quoted context omitted.

> I mean, as much as I'd like to give Android crud here, I think this is incredibly unethical developer behavior …. Right, but "our system will protect you from ethical developers!" isn't much of a security model, so I think there's still plenty of blame for Android here.

What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files? Because this criminal behaviour is also present in Linux, Windows and macOS. Or the fact that an app can write a file to disk? And then another app can open the file? Also criminal behaviour present in other operating systems. Some users might even call it a feature and do the unthinkable - share files…

What exactly is the blame of Android? That it allows the app to read photos when user allows it to read photo files?

On iOS, you have to separately allow image access and access to location data stored as part of the image.

Re: More than 1k Android apps harvest data even after you deny permissions

#49

Post by VectorLock » Mon, Jul 08, 2019, 7:38 PM UTC

z3t4 wrote: post #28

By default apps should not be able to call home, in order to save battery and data plan, ohh and also privacy.

So don't let them.

Doesn't work so well on apps that by their very nature and a variety of contrived reason have to call home.

Re: More than 1k Android apps harvest data even after you deny permissions

#50

Post by Ajedi32 » Mon, Jul 08, 2019, 7:38 PM UTC

Avamander wrote: post #34

alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity's API, for example, may not know that that information is supposed to be restricted on Android.