Multiple Android apps use combined permissions to siphon personal data | Hacker News Reader

Multiple Android apps use combined permissions to siphon personal data

virusbulletin.com

So the main purpose of new technology is to help corporations spy on people. Google Maps wants to know where you go, Facebook wants to know whom do you call, chinese SDKs want their share of data.

Some time ago I looked into Uber app and saw inside a Baidu SDK if I remember correctly. It had the class that was collecting WiFi network ids and sending them to some server. Of course, I cannot say that this code was really invoked by the app, but anyway this was very suspicious.

Some regulation is definitely necessary. The market cannot do anything with it and it needs help.

Imagine if you invited an electrician to your house to fix something, but he would secretly search for your documents and copied them. That is what many apps do today. They advertise themselves as a game or as a map app but secretly they spy on you or use your phone for their purposes.

That's not a fair comparison. Imagine if you hired an electrician for no money, and you kept using them over and over again. I expect if I were to pay for an alternative to not have my privacy violated.

As Walmart has proven, people will choose cheaper over their own long term benefit (and especially the benefit of others)

> cheaper over their own long term benefit

You're assuming you know better than millions who believe cheaper IS in their long term benefit. Quite a sweeping statement!

You're believing those millions actually consciously make that decision. Quite a sweeping statement.

It doesn't matter. If an electrian says he will work for free it doesn't give him any special rights to do anything except his job.

It is sad that some people in Silicon Valley find it acceptable and ethical.

They don’t say they’ll work for free, they say they’ll work in exchange for your data, which they will then sell

Where do they come out and say that? Where do they put a message, in readable english, and not buried under a thousand other things, that says they'll do that?

I guess you could say they do that when they ask for permission to you camera, to your call list, etc...

Allowing the app to access the contact list doesn't mean that the user allows to upload call history to the server. Maybe they only want to add one of the people from their contact list.

I agree privacy policy details are opaque, but it takes the bare minimum of skimming to know if the policy is not giving up your data.

It should be clear as day what’s being collected and it’s a failing that it’s not, but there’s also the old adage of “if it’s too good to be true...” doing some due diligence when you’re promised the services of a billion dollar company that’s not charging you is prudent.

If you search for Facebook on Google Play then you'll see the word "free" under Facebook icon [1]. It is interesting ,that the app page [2] doesn't have this word, but it doesn't say that Facebook is going to upload your call list to the server either. So they advertise the app as "free".

[1] https://play.google.com/store/search?q=facebook&c=apps&hl=en

[2] https://play.google.com/store/apps/details?id=com.facebook.k...

... really?

Google asks devs how much an app costs to install not to use.

Even if the app has IAP the value gets rendered as “Free” with an additional notice.

On that note Google will also take down your app if it doesn’t have a comprehensive privacy policy. And it also requires that policy to be accessible without installing.

They’ve been cracking down on things as detailed as “leaking” clicked URL in troubleshooting logs.

I’m not here to astroturf for companies abusing jargon filled pages of legalese to get you to sign over rights to your data, but you don’t even need to read those to know: “If you’re not paying, you’re the product”. Doubly so if you’re using a service valued at billions of dollars.

I expect if I were to pay for an alternative to not have my privacy violated.

The whole free versus pay argument is sophistry. Many pay products usurp your privacy. Your television is selling your viewing habits. Your car telematics solution is selling your movements. That operating system is mining your activity to sell you things.

And many free products defend your privacy. Linux, VLC, Firefox, IPF, and on and on. More concerned for your privacy than any other product.

So can we please stop this binary differentiation. It isn't useful.

How are you using Uber without paying?

> Some time ago I

As much as I'd like to believe this anecdote, more proof to back you up would be nice.

It's becoming super easy to post weightless stories here similar to this one, and I'd like to see the (rough?) integrity of HN somewhat preserved a little longer.

Ok, I looked through old files and found the details. First, you need to get the file Uber_v3.86.5_apkpure.com.apk (Uber app) and decompile it. You can decompile a later version but I cannot guarantee that all the files are still there. In case you don't have decompiling tools around, I found that someone has uploaded files from the directory 'classes/com/baidu/' here: http://rgho.st/8WlHPJC8g

To find the code that scans WiFi networks, grep the files for getScanResults which is the method name from Android API. You will find a file classes/com/baidu/android/pushservice/util/l.java (and several other files). Someone posted this file here: https://pastebin.com/6cXv2itK

If you look at the method

    public static String a(Context paramContext, String paramString)

at line 114 you'll see that it gets WiFi scan results and then does something that looks like composing a POST request to https://cp01-rdqa-dev404.cp01.baidu.com:8443/rest/2.0/zwifi/... (which doesn't resolve currently).

I didn't have time to examine the code thoroughly.

By the way, the code in a paper [1] mentions a shared property named "pst":

    SharedPreferences localSharedPreferences = paramContext.getSharedPreferences("pst", 0);

If you search Uber sources for "pst", you'll find a file classes/com/baidu/frontia/a/d/b$b.java (here: https://pastebin.com/4zDp8dSz ) that also uses this property:

    localObject1 = "pst";
    ...
    localObject1 = paramContext.getSharedPreferences((String)localObject1, 0);

You can also search for "push_sync", which was mentioned in the paper, and you'll find that several files contain this string:

classes/com/baidu/android/pushservice/c/b.java

classes/com/baidu/android/pushservice/PushLightapp.java

classes/com/baidu/android/pushservice/PushManager.java

classes/com/baidu/android/pushservice/util/i.java

You can also search for other keywords, for example 'http' and you'll find interesting URLs like 'http://127.0.0.1:7777/native'.

Finally, you can search for getSubscriberId which is an Android API method that returns an IMSI and you'll also find several matches:

classes/com/baidu/location/h/b.java

classes/com/baidu/platform/comapi/util/f.java

classes/com/baidu/vi/VDeviceAPI.java

classes/com/baidu/android/pushservice/message/f.java

[1] https://www.virusbulletin.com/virusbulletin/2018/03/vb2016-p...

Thank you for the in-depth analysis. I definitely learned a few tricks here!

Congress REALY needs to pass strong privacy regulations.

They can barely keep the government running. Don't hold your breath.

If somehow a dog dies because of FB or Android then… maybe.

It'd be better for everyone if they had unbiased experts lacking corporate ties draw up the regulations.

That's so un-American.

Technical solutions > legal solutions. iOS doesn't have (as many) problems like this (speaking as an Android user)

There is still the isssue of the Photos permission granting access to all photos on the device.

But I believe location metadata is stripped for apps without location permissions, and the Photos permission is largely unnecessary thanks to the near ubiquitous Share button support.

Do they know you care? Have you written to them? Called them? https://www.house.gov/representatives/find-your-representati... https://www.senate.gov/general/contact_information/senators_...

The last time I checked they passed a law allowing ISPs to sell browsing histories of their customers, so I wouldn't count on them.

In theory, yes.

The reality is they have no idea what this is all about.

If we want something done __and done right__ we're gonna have to figure it out on our own.

>Congress REALY needs to pass strong privacy regulations.

They could do that. The first thing I'll expect them to do is exempt themselves, so that the government(s) can continue to work with these same companies to violate your privacy as they have been doing.

You are assuming that this is a bug, and not a feature from the Government's perspective.

Reply on news.ycombinator.com