Multiple Android apps use combined permissions to siphon personal data(virusbulletin.com)
virusbulletin.com
Multiple Android apps use combined permissions to siphon personal data
https://www.virusbulletin.com/blog/2018/03/vb2016-paper-wild-android-collusions/
71 comments
> Some time ago I
As much as I'd like to believe this anecdote, more proof to back you up would be nice.
It's becoming super easy to post weightless stories here similar to this one, and I'd like to see the (rough?) integrity of HN somewhat preserved a little longer.
As much as I'd like to believe this anecdote, more proof to back you up would be nice.
It's becoming super easy to post weightless stories here similar to this one, and I'd like to see the (rough?) integrity of HN somewhat preserved a little longer.
Ok, I looked through old files and found the details. First, you need to get the file Uber_v3.86.5_apkpure.com.apk (Uber app) and decompile it. You can decompile a later version but I cannot guarantee that all the files are still there. In case you don't have decompiling tools around, I found that someone has uploaded files from the directory 'classes/com/baidu/' here: http://rgho.st/8WlHPJC8g
To find the code that scans WiFi networks, grep the files for getScanResults which is the method name from Android API. You will find a file classes/com/baidu/android/pushservice/util/l.java (and several other files). Someone posted this file here: https://pastebin.com/6cXv2itK
If you look at the method
I didn't have time to examine the code thoroughly.
By the way, the code in a paper [1] mentions a shared property named "pst":
classes/com/baidu/android/pushservice/c/b.java
classes/com/baidu/android/pushservice/PushLightapp.java
classes/com/baidu/android/pushservice/PushManager.java
classes/com/baidu/android/pushservice/util/i.java
You can also search for other keywords, for example 'http' and you'll find interesting URLs like 'http://127.0.0.1:7777/native'.
Finally, you can search for getSubscriberId which is an Android API method that returns an IMSI and you'll also find several matches:
classes/com/baidu/location/h/b.java
classes/com/baidu/platform/comapi/util/f.java
classes/com/baidu/vi/VDeviceAPI.java
classes/com/baidu/android/pushservice/message/f.java
[1] https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-p...
To find the code that scans WiFi networks, grep the files for getScanResults which is the method name from Android API. You will find a file classes/com/baidu/android/pushservice/util/l.java (and several other files). Someone posted this file here: https://pastebin.com/6cXv2itK
If you look at the method
public static String a(Context paramContext, String paramString)
I didn't have time to examine the code thoroughly.
By the way, the code in a paper [1] mentions a shared property named "pst":
SharedPreferences localSharedPreferences = paramContext.getSharedPreferences("pst", 0);
localObject1 = "pst";
...
localObject1 = paramContext.getSharedPreferences((String)localObject1, 0);
classes/com/baidu/android/pushservice/c/b.java
classes/com/baidu/android/pushservice/PushLightapp.java
classes/com/baidu/android/pushservice/PushManager.java
classes/com/baidu/android/pushservice/util/i.java
You can also search for other keywords, for example 'http' and you'll find interesting URLs like 'http://127.0.0.1:7777/native'.
Finally, you can search for getSubscriberId which is an Android API method that returns an IMSI and you'll also find several matches:
classes/com/baidu/location/h/b.java
classes/com/baidu/platform/comapi/util/f.java
classes/com/baidu/vi/VDeviceAPI.java
classes/com/baidu/android/pushservice/message/f.java
[1] https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-p...
Thank you for the in-depth analysis. I definitely learned a few tricks here!
Imagine if you invited an electrician to your house to fix something, but he would secretly search for your documents and copied them. That is what many apps do today. They advertise themselves as a game or as a map app but secretly they spy on you or use your phone for their purposes.
That's not a fair comparison. Imagine if you hired an electrician for no money, and you kept using them over and over again. I expect if I were to pay for an alternative to not have my privacy violated.
It doesn't matter. If an electrian says he will work for free it doesn't give him any special rights to do anything except his job.
It is sad that some people in Silicon Valley find it acceptable and ethical.
It is sad that some people in Silicon Valley find it acceptable and ethical.
They don’t say they’ll work for free, they say they’ll work in exchange for your data, which they will then sell
If you search for Facebook on Google Play then you'll see the word "free" under Facebook icon [1]. It is interesting ,that the app page [2] doesn't have this word, but it doesn't say that Facebook is going to upload your call list to the server either. So they advertise the app as "free".
[1] https://play.google.com/store/search?q=facebook&c=apps&hl=en
[2] https://play.google.com/store/apps/details?id=com.facebook.k...
[1] https://play.google.com/store/search?q=facebook&c=apps&hl=en
[2] https://play.google.com/store/apps/details?id=com.facebook.k...
... really?
Google asks devs how much an app costs to install not to use.
Even if the app has IAP the value gets rendered as “Free” with an additional notice.
On that note Google will also take down your app if it doesn’t have a comprehensive privacy policy. And it also requires that policy to be accessible without installing.
They’ve been cracking down on things as detailed as “leaking” clicked URL in troubleshooting logs.
I’m not here to astroturf for companies abusing jargon filled pages of legalese to get you to sign over rights to your data, but you don’t even need to read those to know: “If you’re not paying, you’re the product”. Doubly so if you’re using a service valued at billions of dollars.
Google asks devs how much an app costs to install not to use.
Even if the app has IAP the value gets rendered as “Free” with an additional notice.
On that note Google will also take down your app if it doesn’t have a comprehensive privacy policy. And it also requires that policy to be accessible without installing.
They’ve been cracking down on things as detailed as “leaking” clicked URL in troubleshooting logs.
I’m not here to astroturf for companies abusing jargon filled pages of legalese to get you to sign over rights to your data, but you don’t even need to read those to know: “If you’re not paying, you’re the product”. Doubly so if you’re using a service valued at billions of dollars.
Where do they come out and say that? Where do they put a message, in readable english, and not buried under a thousand other things, that says they'll do that?
I agree privacy policy details are opaque, but it takes the bare minimum of skimming to know if the policy is not giving up your data.
It should be clear as day what’s being collected and it’s a failing that it’s not, but there’s also the old adage of “if it’s too good to be true...” doing some due diligence when you’re promised the services of a billion dollar company that’s not charging you is prudent.
It should be clear as day what’s being collected and it’s a failing that it’s not, but there’s also the old adage of “if it’s too good to be true...” doing some due diligence when you’re promised the services of a billion dollar company that’s not charging you is prudent.
I guess you could say they do that when they ask for permission to you camera, to your call list, etc...
Allowing the app to access the contact list doesn't mean that the user allows to upload call history to the server. Maybe they only want to add one of the people from their contact list.
I expect if I were to pay for an alternative to not have my privacy violated.
The whole free versus pay argument is sophistry. Many pay products usurp your privacy. Your television is selling your viewing habits. Your car telematics solution is selling your movements. That operating system is mining your activity to sell you things.
And many free products defend your privacy. Linux, VLC, Firefox, IPF, and on and on. More concerned for your privacy than any other product.
So can we please stop this binary differentiation. It isn't useful.
The whole free versus pay argument is sophistry. Many pay products usurp your privacy. Your television is selling your viewing habits. Your car telematics solution is selling your movements. That operating system is mining your activity to sell you things.
And many free products defend your privacy. Linux, VLC, Firefox, IPF, and on and on. More concerned for your privacy than any other product.
So can we please stop this binary differentiation. It isn't useful.
As Walmart has proven, people will choose cheaper over their own long term benefit (and especially the benefit of others)
How are you using Uber without paying?
Congress REALY needs to pass strong privacy regulations.
>Congress REALY needs to pass strong privacy regulations.
They could do that. The first thing I'll expect them to do is exempt themselves, so that the government(s) can continue to work with these same companies to violate your privacy as they have been doing.
They could do that. The first thing I'll expect them to do is exempt themselves, so that the government(s) can continue to work with these same companies to violate your privacy as they have been doing.
Do they know you care? Have you written to them? Called them?
https://www.house.gov/representatives/find-your-representati... https://www.senate.gov/general/contact_information/senators_...
If somehow a dog dies because of FB or Android then… maybe.
In theory, yes.
The reality is they have no idea what this is all about.
If we want something done __and done right__ we're gonna have to figure it out on our own.
The reality is they have no idea what this is all about.
If we want something done __and done right__ we're gonna have to figure it out on our own.
The last time I checked they passed a law allowing ISPs to sell browsing histories of their customers, so I wouldn't count on them.
Technical solutions > legal solutions. iOS doesn't have (as many) problems like this (speaking as an Android user)
There is still the isssue of the Photos permission granting access to all photos on the device.
But I believe location metadata is stripped for apps without location permissions, and the Photos permission is largely unnecessary thanks to the near ubiquitous Share button support.
But I believe location metadata is stripped for apps without location permissions, and the Photos permission is largely unnecessary thanks to the near ubiquitous Share button support.
It'd be better for everyone if they had unbiased experts lacking corporate ties draw up the regulations.
That's so un-American.
You are assuming that this is a bug, and not a feature from the Government's perspective.
Some time ago I looked into Uber app and saw inside a Baidu SDK if I remember correctly. It had the class that was collecting WiFi network ids and sending them to some server. Of course, I cannot say that this code was really invoked by the app, but anyway this was very suspicious.
Some regulation is definitely necessary. The market cannot do anything with it and it needs help.