More than 1k Android apps harvest data even after you deny permissions
1–10 of 146 posts
Re: More than 1k Android apps harvest data even after you deny permissions
#2By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen.
The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting.
And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on android without requiring the location permission. It's pretty absurd that "list the access points that I have recently received wifi beacons for" is equal to "locate where I am on earth", but that's the world we live in now.
Whether it's just location data or a larger set of data is unclear from the article.
Re: More than 1k Android apps harvest data even after you deny permissions
#3By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…
Android does not ask for permission to read certain things like the clipboard. So an app can intercept anything added to the clipboard such as passwords copied in by password managers.
Re: More than 1k Android apps harvest data even after you deny permissions
#4By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…
From the article:
> The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos.
> Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access location data.
> Some apps were relying on other apps that were granted permission to look at personal data, piggybacking off their access to gather phone identifiers like your IMEI number. These apps would read through unprotected files on a device's SD card and harvest data they didn't have permission to access. So if you let other apps access personal data, and they stored it in a folder on the SD card, these spying apps would be able to take that information.
So basically, they can't read your location, but they can read other things that contain your (previous) location and other information about you.
Edit: The article links to the original research[0], which seems to describe/link to different methods that the apps use. I haven't had time to read it yet, but it seems interesting.
[0] https://www.ftc.gov/system/files/documents/public_events/141...
Re: More than 1k Android apps harvest data even after you deny permissions
#5> The update will address the issue by hiding location information in photos from apps and requiring any apps that access Wi-Fi to also have permission for location data, according to Google.
The great minds at Google have done it again!!
This craziness (Bluetooth requires location) was the reason I never bought a smartwatch. I guess now I should stop using internet too.
Re: More than 1k Android apps harvest data even after you deny permissions
#6Why do they have to wait for Android Q? Couldn't they pull the apps now?
Re: More than 1k Android apps harvest data even after you deny permissions
#7By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…
Android does not ask for permission to read certain things like the clipboard. So an app can intercept anything added to the clipboard such as passwords copied in by password managers.
As far as I'm aware iOS doesn't require permission for clipboard access either. Up until Q a background service on Android could constantly monitor the clipboard however.
Re: More than 1k Android apps harvest data even after you deny permissions
#8By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…
From the article: > The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos. > Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access locati…
> Researchers found that Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access location data.
One of the first things I disable when I have a new phone is geolocation being added to photos. I just don't want my location randomly being shared from an image without my consent. If I wanted you to know where I took the picture, I would tell you.
Re: More than 1k Android apps harvest data even after you deny permissions
#9> The update will address the issue by hiding location information in photos from apps and requiring any apps that access Wi-Fi to also have permission for location data, according to Google. The great minds at Google have done it again!! This craziness (Bluetooth requires location) was the reason I never bought a smartwatch. I guess now I should stop using internet too.
According to Google Bluetooth requires location, because it van be used to find your location. So there is some reasoning behind this decisions, although I wwould be mutch happier with something like: Location (Bluetooth), location (GPS), location (WiFi)
>A location permission is required because Bluetooth scans can be used to gather information about the location of the user. This information may come from the user's own devices, as well as Bluetooth beacons in use at locations such as shops and transit facilities.
https://developer.android.com/guide/topics/connectivity/blue...
Re: More than 1k Android apps harvest data even after you deny permissions
#10By what set of mechanisms is it possible for the app to access data that you've denied the app access to? It seems the flaw is in Android allowing this to happen. The example given (app accessing photo with embedded gps coords) seems very specific and doesn't deal with the general notion of data harvesting. And wrt mac address lookups - for this reason it's not possible to list the available wifi access points on and…
There's a paper linked from the article which contains details on the sidechannels: https://www.ftc.gov/system/files/documents/public_events/141...
Example: if you have an SD card installed, one advertising SDK creates a file on it. When the SDK is running in an app with appropriate permissions, it writes the IMEI and advertising ID to that file. When it's running in an app without appropriate permissions, it retrieves the IMEI and advertising ID from that file.
Lots of interesting tricks. The one that surprises me the most is Unity using ioctl tricks to harvest the device's MAC address.