<story><title>More than 1k Android apps harvest data even after you deny permissions</title><url>https://www.cnet.com/news/more-than-1000-android-apps-harvest-your-data-even-after-you-deny-permissions/</url></story><parent_chain><item><author>Ajedi32</author><text>It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity&amp;#x27;s API, for example, may not know that that information is supposed to be restricted on Android.</text></item><item><author>Avamander</author><text>Ban. These. Apps. And. Devs. Permanently.&lt;p&gt;It&amp;#x27;s hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like &amp;quot;How dare you have a Donate button in your app&amp;quot;.</text></item><item><author>alvern</author><text>[0] from the researchers pdf:&lt;p&gt;• We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through
a combination of dynamic and static analysis, in effect
creating a scalable honeypot environment.&lt;p&gt;• We tested our pipeline on more than 88,000 apps and
discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the
U.S. Google Play Store and include popular apps from
all categories. We further describe the vulnerabilities in
detail, and measure the degree to which they are in active use, and thus pose a threat to users. We discovered
covert and side channels used in the wild that compromise both users’ location data and persistent identifers.&lt;p&gt;• We discovered companies getting the MAC addresses of
the connected WiFi base stations from the ARP cache.
This can be used as a surrogate for location data. We
found 5 apps exploiting this vulnerability and 5 with the
pertinent code to do so.&lt;p&gt;• We discovered Unity obtaining the device MAC address
using ioctl system calls. The MAC address can be
used to uniquely identify the device. We found 42 apps
exploiting this vulnerability and 12,408 apps with the
pertinent code to do so.&lt;p&gt;• We also discovered that third-party libraries provided
by two Chinese companies—Baidu and Salmonads—
independently make use of the SD card as a covert channel, so that when an app can read the phone’s IMEI, it
stores it for other apps that cannot. We found 159 apps
with the potential to exploit this covert channel and empirically found 13 apps doing so.&lt;p&gt;• We found one app that used picture metadata as a side
channel to access precise location information despite
not holding location permissions.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.ftc.gov&amp;#x2F;system&amp;#x2F;files&amp;#x2F;documents&amp;#x2F;public_events&amp;#x2F;1415032&amp;#x2F;privacycon2019_serge_egelman.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.ftc.gov&amp;#x2F;system&amp;#x2F;files&amp;#x2F;documents&amp;#x2F;public_events&amp;#x2F;141...&lt;/a&gt;</text></item></parent_chain><comment><author>krageon</author><text>Who cares how accidental it was? If you don&amp;#x27;t vet what happens in your application and why, you have no right to put it on someone else&amp;#x27;s computer.</text></comment>
<story><title>More than 1k Android apps harvest data even after you deny permissions</title><url>https://www.cnet.com/news/more-than-1000-android-apps-harvest-your-data-even-after-you-deny-permissions/</url></story><parent_chain><item><author>Ajedi32</author><text>It seems like at least some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries. Game devs grabbing mac addresses via Unity&amp;#x27;s API, for example, may not know that that information is supposed to be restricted on Android.</text></item><item><author>Avamander</author><text>Ban. These. Apps. And. Devs. Permanently.&lt;p&gt;It&amp;#x27;s hypocricy if they let these malicious devs keep publishing but keep harassing non-malicious developers with things like &amp;quot;How dare you have a Donate button in your app&amp;quot;.</text></item><item><author>alvern</author><text>[0] from the researchers pdf:&lt;p&gt;• We designed a pipeline for automatically discovering vulnerabilities in the Android permissions system through
a combination of dynamic and static analysis, in effect
creating a scalable honeypot environment.&lt;p&gt;• We tested our pipeline on more than 88,000 apps and
discovered a number of vulnerabilities, which we responsibly disclosed. These apps were downloaded from the
U.S. Google Play Store and include popular apps from
all categories. We further describe the vulnerabilities in
detail, and measure the degree to which they are in active use, and thus pose a threat to users. We discovered
covert and side channels used in the wild that compromise both users’ location data and persistent identifers.&lt;p&gt;• We discovered companies getting the MAC addresses of
the connected WiFi base stations from the ARP cache.
This can be used as a surrogate for location data. We
found 5 apps exploiting this vulnerability and 5 with the
pertinent code to do so.&lt;p&gt;• We discovered Unity obtaining the device MAC address
using ioctl system calls. The MAC address can be
used to uniquely identify the device. We found 42 apps
exploiting this vulnerability and 12,408 apps with the
pertinent code to do so.&lt;p&gt;• We also discovered that third-party libraries provided
by two Chinese companies—Baidu and Salmonads—
independently make use of the SD card as a covert channel, so that when an app can read the phone’s IMEI, it
stores it for other apps that cannot. We found 159 apps
with the potential to exploit this covert channel and empirically found 13 apps doing so.&lt;p&gt;• We found one app that used picture metadata as a side
channel to access precise location information despite
not holding location permissions.&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.ftc.gov&amp;#x2F;system&amp;#x2F;files&amp;#x2F;documents&amp;#x2F;public_events&amp;#x2F;1415032&amp;#x2F;privacycon2019_serge_egelman.pdf&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.ftc.gov&amp;#x2F;system&amp;#x2F;files&amp;#x2F;documents&amp;#x2F;public_events&amp;#x2F;141...&lt;/a&gt;</text></item></parent_chain><comment><author>droithomme</author><text>&amp;gt; some of these apps might be using these vulnerabilities without even being aware of it, as the offending code is in third party libraries&lt;p&gt;I&amp;#x27;ll assume by vulnerabilities you meant to say exploits. Given that: True but so what. This is criminal behavior. Using criminal libraries makes you complicit and a co-conspirator.</text></comment>