Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More than 1k Android apps harvest data even after you deny permissions

cnet.com

Post reply on HN
Print view View original

91–100 of 146 posts

Re: More than 1k Android apps harvest data even after you deny permissions

#91

Post by saagarjha »

fitzroy wrote: post #63
alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

The picture metadata exploit is interesting. It would be trivial to guess the user's home and work location given enough photos with EXIF data (locations and timestamps). I'm curious how this works on iOS. Granting complete access to "Photos" always seemed overly broad. It should be possible to limit an app to only save images, and/or limit accessing images to photos from the last 3 days etc, or only the images the a…

> It should be possible to limit an app to only save images, and/or limit accessing images to photos from the last 3 days etc, or only the images the app has created.

It is, but currently this is something that apps need to use the API for rather than it being something that users can restrict.

Re: More than 1k Android apps harvest data even after you deny permissions

#92

Post by tracker1 »

baybal2 wrote: post #40
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Will google dare to ban alibaba? Alibaba does no effort to conceal that they target ads by IMEI. Browse Alibaba app*, search something. Do factory reset, make new account, and the first thing you will see after logging in with new acc will be your products from your last search. Moreover, Alibaba's app will refuse to work if you block IMEI retrieval, or if they detect some kind of spoofing edit, made it clear that it…

You know, maybe they should. Same for LinkedIn (assuming they're still doing dirty tricks). Maybe it's time for major app devs that exploit security holes in released applications to get the ban hammer, and show smaller devs it won't be acceptable and have less excuse if/when it happens to them.

Re: More than 1k Android apps harvest data even after you deny permissions

#93

Post by mirimir »

Avamander wrote: post #34
alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Yes. These are malware. It's disgusting.

Re: More than 1k Android apps harvest data even after you deny permissions

#94

Post by mirimir »

autoexec wrote: post #90
lern_too_spel wrote: post #78

Earlier quoted context omitted.

VPNService is an API ( https://developer.android.com/reference/android/net/VpnServi... ). Your own link points tp this documentation. It does not require sending your data to a VPN, and in this case, it obviously doesn't. The weird thing is that you went out of your way to research to find a misleading quote when the page itself points out why the quote is misleading and that the app is open source (negating your ads…

It has to route traffic through a local VPN to drop the traffic. Doesn't play well with other VPNs for this reason. Real firewalls need root. The VPN trick is a hack to get around that while still providing some of that functionality. Yes, you could edit the source code and compile it yourself every time it updates to remove the ads, but I think that's a little much to expect. Ultimately this is functionality users s…

> Real firewalls need root.

Real computers let you install trusted stuff that has root.

Re: More than 1k Android apps harvest data even after you deny permissions

#95

Post by ken »

Avamander wrote: post #34
alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Even Unity? Their CEO says half of all games are built on that. I imagine users would riot if most games were to simply disappear tomorrow.

Or more likely, since it’s Android, the first thing everybody would do is switch to the App store that has all the software they want, even though they know it’s bad.

Re: More than 1k Android apps harvest data even after you deny permissions

#96

Post by throwaway-888 »

ken wrote: post #95
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Even Unity? Their CEO says half of all games are built on that. I imagine users would riot if most games were to simply disappear tomorrow. Or more likely, since it’s Android, the first thing everybody would do is switch to the App store that has all the software they want, even though they know it’s bad.

There's something a lot of people don't know about Unity the company - they are awful. Difficult to work with, constant rumors about managerial scapegoating, questionable sales tactics.. the recent news about the allegations against the CEO didn't surprise me in the slightest.

I don't work with them closely, but I work with them closely enough that I've recommended that my employer cease all interaction with them, including further license purchases. That's how bad the taste in my mouth is after I deal with them interactively in any capacity.

Re: More than 1k Android apps harvest data even after you deny permissions

#97

Post by naikrovek »

ken wrote: post #95
Avamander wrote: post #34

Earlier quoted context omitted.

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

Even Unity? Their CEO says half of all games are built on that. I imagine users would riot if most games were to simply disappear tomorrow. Or more likely, since it’s Android, the first thing everybody would do is switch to the App store that has all the software they want, even though they know it’s bad.

[edit after reading more of the PDF]:

Yes, even Unity. Unity goes out of its way to get information that it does not have permission to acquire or transmit. It looks like knowledge of this is limited to a few developers who are "in the know" and I would not be surprised if Unity has given that info out to large licensees who have mentioned a need to uniquely identify players without permission.

Re: More than 1k Android apps harvest data even after you deny permissions

#98

Post by kevin_thibedeau »

Avamander wrote: post #34
alvern wrote: post #26

[0] from the researchers pdf: • We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through a combination of dynamic and static analysis, in effect creating a scalable honeypot environment. • We tested our pipeline on more than 88,000 apps and discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the U.S. Google Play…

Ban. These. Apps. And. Devs. Permanently. It's hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like "How dare you have a Donate button in your app".

They should be lifetime banned from every Alphabet property. Others have suffered this fate for lesser offenses.

Re: More than 1k Android apps harvest data even after you deny permissions

#99

Post by kevin_thibedeau »

tracker1 wrote: post #92
baybal2 wrote: post #40

Earlier quoted context omitted.

Will google dare to ban alibaba? Alibaba does no effort to conceal that they target ads by IMEI. Browse Alibaba app*, search something. Do factory reset, make new account, and the first thing you will see after logging in with new acc will be your products from your last search. Moreover, Alibaba's app will refuse to work if you block IMEI retrieval, or if they detect some kind of spoofing edit, made it clear that it…

You know, maybe they should. Same for LinkedIn (assuming they're still doing dirty tricks). Maybe it's time for major app devs that exploit security holes in released applications to get the ban hammer, and show smaller devs it won't be acceptable and have less excuse if/when it happens to them.

Shadowban them with bogus data to pollute their database.

Re: More than 1k Android apps harvest data even after you deny permissions

#100

Post by mandelbrotwurst »

Avamander wrote: post #80
Ajedi32 wrote: post #50

Earlier quoted context omitted.

It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity's API, for example, may not know that that information is supposed to be restricted on Android.

Some might be using them without being aware of but the rest can be nicely permabanned.

How would you go about reliably and efficiently determining which category each falls into?
Post reply on HN