Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k Android apps harvest data even after you deny permissions

cnet.com

Post reply on HN
Print view View original

71–80 of 146 posts

Re: More than 1k Android apps harvest data even after you deny permissions

#71

Post by autoexec »

lern_too_spel wrote: post #68
autoexec wrote: post #59

Earlier quoted context omitted.

> Seriously, you're blaming the OS because it allows you to run useful software on it, just like a desktop computer. Unlike a desktop computer Android prevents you from taking steps to protect yourself. Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Google designed their OS to collect and leak your data. It's why their permissions system…

> Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Of course you can. There are multiple apps that do this. One example: https://f-droid.org/en/packages/eu.faircode.netguard/

It looks like netguard is a VPN service, not a true firewall. A firewall on my desktop doesn't require me to route all my traffic through a VPN. Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q

Re: More than 1k Android apps harvest data even after you deny permissions

#72

Post by lern_too_spel »

autoexec wrote: post #71
lern_too_spel wrote: post #68

Earlier quoted context omitted.

> Without rooting your phone you can't even install firewalls or prevent applications from ever connecting to the outside world. Of course you can. There are multiple apps that do this. One example: https://f-droid.org/en/packages/eu.faircode.netguard/

It looks like netguard is a VPN service, not a true firewall. A firewall on my desktop doesn't require me to route all my traffic through a VPN. Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q

Nope. It runs solely on the device. How else would it know which app is making the network request? What are you basing your strange claims on?

> Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q

Netguard is open source (with a license not supported on iOS: https://github.com/M66B/NetGuard), so there is no reason to use a build that shows ads. Alternatively, as I said earlier, there are multiple firewall apps you could use that don't require root.

Re: More than 1k Android apps harvest data even after you deny permissions

#73

Post by StreamBright »

Avamander wrote: post #34
alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

The entire Android ecosystem is about abuse. Banning these apps won't help. Google legitimized surveillance capitalism that is the worst that could have happened.

Re: More than 1k Android apps harvest data even after you deny permissions

#74

Post by cmroanirgo »

alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Wow. I'll use this paper as a good reason to encourage usage of a firewall (afwall or netguard) for my non nerdy friends. It can stop a lot of this nonsense being reported back, but sadly not all.

I'm thinking there's probably a reporting vector in how an app might use the download manager to leak data.

Re: More than 1k Android apps harvest data even after you deny permissions

#75

Post by StreamBright »

srcmap wrote: post #64
baybal2 wrote: post #40

Earlier quoted context omitted.

Will google dare to ban alibaba? Alibaba does no effort to conceal that they target ads by IMEI. Browse Alibaba app*, search something. Do factory reset, make new account, and the first thing you will see after logging in with new acc will be your products from your last search. Moreover, Alibaba's app will refuse to work if you block IMEI retrieval, or if they detect some kind of spoofing edit, made it clear that it…

Maybe someone in EU can file a class action lawsuit base on GDPR? Per description here, it seems have enough legal, $, evident here to make a few lawyers excited?

Not really unless they are stealing PII.

Re: More than 1k Android apps harvest data even after you deny permissions

#76

Post by autoexec »

lern_too_spel wrote: post #72
autoexec wrote: post #71

Earlier quoted context omitted.

It looks like netguard is a VPN service, not a true firewall. A firewall on my desktop doesn't require me to route all my traffic through a VPN. Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q

Nope. It runs solely on the device. How else would it know which app is making the network request? What are you basing your strange claims on? > Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q Netguard is open source (with a license not supported on iOS: https://github.com/M66B/NetGuard ), so there is no reason to use a build that shows ads. Alternatively, as I said earlier, the…

From their own FAQ:

> NetGuard will do its best, but it is limited by the fact it must use the VPN service.

FAQ: https://github.com/M66B/NetGuard/blob/master/FAQ.md

See also: https://www.reddit.com/r/Android/comments/4uhl3w/netguard_ad...

Re: More than 1k Android apps harvest data even after you deny permissions

#78

Post by lern_too_spel »

autoexec wrote: post #76
lern_too_spel wrote: post #72

Earlier quoted context omitted.

Nope. It runs solely on the device. How else would it know which app is making the network request? What are you basing your strange claims on? > Netguard also injects ads in your traffic (or at least did) https://imgur.com/a/2YG7Q Netguard is open source (with a license not supported on iOS: https://github.com/M66B/NetGuard ), so there is no reason to use a build that shows ads. Alternatively, as I said earlier, the…

From their own FAQ: > NetGuard will do its best, but it is limited by the fact it must use the VPN service. FAQ: https://github.com/M66B/NetGuard/blob/master/FAQ.md See also: https://www.reddit.com/r/Android/comments/4uhl3w/netguard_ad...

VPNService is an API (https://developer.android.com/reference/android/net/VpnServi...). Your own link points tp this documentation. It does not require sending your data to a VPN, and in this case, it obviously doesn't.

The weird thing is that you went out of your way to research to find a misleading quote when the page itself points out why the quote is misleading and that the app is open source (negating your ads claim earlier).

Re: More than 1k Android apps harvest data even after you deny permissions

#79

Post by lern_too_spel »

scarface74 wrote: post #70
lern_too_spel wrote: post #62

Earlier quoted context omitted.

If you upload a picture to Shutterfly, that is a user specifically putting the photo in the app's sandbox. The same thing happens on every other OS.

Not with iOS. There is a separate media library API that’s separate from the file access API. You can give an app permission to access your media library without giving it access to the location metadata. The app has to specifically ask for location access to get the metadata.

> The app has to specifically ask for location access to get the metadata.

Source? https://apple.stackexchange.com/questions/335809/can-ios-app... disagrees with your claim.

Re: More than 1k Android apps harvest data even after you deny permissions

#80

Post by Avamander »

Ajedi32 wrote: post #50
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity's API, for example, may not know that that information is supposed to be restricted on Android.

Some might be using them without being aware of but the rest can be nicely permabanned.
Post reply on HN