Comment by dmix | Hacker News Reader

Comment by dmix | Hacker News Reader

TLDR: Uber's Android app is literally malware

Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your:

- SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs)

It also checks if you're phone is rooted/jailbroken and if it's vulnerable to Heartbleed... which it also calls home.

From my understanding, which the author somehow missed, is that it is using http://www.inauth.com SDK which provides 'malware detection'. This SDK is popular in the 'mobile finance industry' and the banking sector. Also notably one of the founders is former DHS/FBI.

Two possible theories: it is being used for fraud detection and/or an intelligence gathering tool.

Edit: here is a copy of the decompiled source code http://www.gironsec.com/blog/wp-content/uploads/2014/11/InAu... note the name "package com.inauth.mme"

Edit #2: here is a screenshot of Uber's permission request https://i.imgur.com/4MmYrJH.png no SMS on the list

Just for completeness sake and judging from the function names, this is the list, with attributes stored for each:

- Accounts log (Email)

- App Activity (Name, PackageName, Process Number of activity, Processed id)

- App Data Usage (Cache size, code size, data size, name, package name)

- App Install (installed at, name, package name, unknown sources enabled, version code, version name)

- Battery (health, level, plugged, present, scale, status, technology, temperature, voltage)

- Device Info (board, brand, build version, cell number, device, device type, display, fingerprint, ip, mac address, manufacturer, model, os platform, product, sdk code, total disk space, unknown sources enabled)

- GPS (accuracy, altitude, latitude, longitude, provider, speed)

- MMS (from number, mms at, mmss type, service number, to number)

- NetData (bytes received, bytes sent, connection type, interface type)

- PhoneCall (call duration, called at, from number, phone call type, to number)

- SMS (from number, service number, sms at, sms type, to number)

- TelephonyInfo (cell tower id, cell tower latitude, cell tower longitude, imei, iso country code, local area code, meid, mobile country code, mobile network code, network name, network type, phone type, sim serial number, sim state, subscriber id)

- WifiConnection (bssid, ip, linkspeed, macaddr, networkid, rssi, ssid)

- WifiNeighbors (bssid, capabilities, frequency, level, ssid)

- Root Check (root staus code, root status reason code, root version, sig file version)

- Malware Info (algorithm confidence, app list, found malware, malware sdk version, package list, reason code, service list, sigfile version)

Or, put differently, I really don't see any reason for Google not to immediately remove this app from the store permanently and ban whatever developer uploaded it. There should probably be legal action.

Edit: I've augmented the various types of data retrieved (ie: there is capability in the source to read, save and transmit this data) from the inauth framework sources.

> I really don't see any reason for Google not to immediately remove this app

Apart from Google being an investor in Uber?

It might be worth taking the hit...

After all the recent scandals in Uber, how has Google not pushed for a complete overhaul of Uber's leadership already? It has become pretty clear the current leadership has some "issues".

Well I mean, is it actually causing any problems for Uber?

Uber has what's pretty close to a monopoly in what it offers, apart from a few cities in the US where Lyft also operates. I would say most people that user Uber are not interested in using the regular local taxi service.

I spoke to a Lyft/Uber driver today in NCY. He said that Uber's losing drivers every day here — about 5% (I don't know where he got those numbers from). He also mentioned that Uber are flat out lying about how much drivers earn, and in some months drivers that aren't on Uber's "favourites" list end up owing Uber for renting the gear instead of earning money.

This reputation is definitely damaging, and it's common knowledge here. Drivers bitch about it. They recommend Lyft.

I'm always very cautious of taking what opinion from HN (and others in 'tech') and extrapolating them out to the general population, so I read what you say (and my own opinion) with a grain of salt.

But like, Uber is in 230 cities around the world. Here in Australia I believe they added over 1000 new drivers over the past month. Here, Uber is the alternative. There is no Lyft or Sidecar - mainly because alternatives are too scared of legal action from government - ridesharing is essentially illegal here, but Uber plays the we're-waiting-for-the-law-to-catch-up card regardless.

I'm sure the turnover for Uber is high. I would expect that for that type of job, regardless of the apparent ethical makeup of the company's executives.

How would a driver come about these numbers? And 5% per day? Pretty sure you were talking to someone not in the know.

"the gear" huh? Exactly what "gear" do they rent?

If anything, that might make them pull it quicker.

If the analysis holds up, it would be very bad publicity to appear complicit.

well technically speaking google venture invested in uber

That's a multihundredmillion reason to cut them some slack ;)

> I really don't see any reason for Google not to immediately remove this app from the store permanently and ban whatever developer uploaded it

The original article is down, but do they somehow bypass the Android permission authorization process? Or the user still has to authorize the app to access all the resources?

They do need to ask for these permissions at install time. But as another user here pointed out, they do have legitimate reasons to ask for most of them to provide the functionality of the app.

The issue is that they're phoning all this information home, when the user might only be expecting it to be retrieved while the app is in use and only as needed.

Well it's very popular among users. Removing it from the store immediately and/or permanently seems likely to get some backlash from the user base.

The same could be said about a lot of things that are harmful to users.

A lot of apps collect this information. There are flashlight apps that collect the same level. This is nothing new.

That doesn't mean it's good for users or for users or for Android's reputation as an app ghetto. Some means of scoring apps down for needless permissions would be a good thing.

Yeah, it does suck that you need to install the app before you can rate it. I mean...I understand why they would do this in an attempt to limit review gaming but in this case I often have to install something if I want to give it a bad review. In reality, I just don't install it and move on.

Huh, really? That sounds almost like something Apple would do.

Seriously? You mean, information that 1. Google makes available via API and 2. You agreed to when you installed the app is now means for Google to take legal action?

You're deluded. If you don't like this, stop using Android. I did.

Now hold on a sec -- I'll buy that the Uber app appears to have a library compiled into it that could do all of that, which is worrisome enough, but as far as I can see, that blog provides no evidence that Uber is actually phoning home. Anybody up for doing a tcpdump?

> "... but as far as I can see, that blog provides no evidence that Uber is actually phoning home"

That does not make it ok.

It may not be ok, but it's completely different, imo. If they're not using the libraries, they can change it and no big deal. If they are using the libraries and stealing all this information that doesn't belong to them, that feels criminal to me (or ought to be).

So...I'd love to know...are they really doing this?

It does make a huge difference. I'm uninstalling, but at this point I just needed an excuse.

If they're actually sending all this stuff, I'm also telling everyone I know about it. But only if they actually are.

What's not-ok about linking a do-everything platform library?

Even before this disclosure, the Uber app required a nauseatingly long list of permissions.

I wiped an old Android phone, configured it with a dummy Gmail account, and then installed the Uber app there.

So it's a dedicated Uber-only phone with no contacts, no personal data, powered off until I need a ride. It's a giant pain in the ass.

Kinda happy to see this article, it validates my paranoia in some small way.

Now the real question is, why use Uber at all if they're this cavalier with my personal information? Good question, I may not need to power-on my Uber-only phone any more.

I don't use the Uber app at all; I use m.uber.com via Firefox Mobile, and it works just fine.

If Uber is such a bad actor, why are you people using it at all?

Convenience? Price? Lack of competitors (other than Lyft)?

> Good question, I may not need to power-on my Uber-only phone any more.

Beats the alternatives. Worlds better than any experience I've ever had with a taxi (and more importantly with trying to obtain one).

Android isn't perfect (case in point: it should support saying "yes I want to install the app, no it can't have the permissions it asked for"), but at least it isn't iOS; I'm not going to stick with a feature phone until someone comes up with the perfect smartphone OS. If someone comes up with a service better than Uber, I'll switch. (For instance, I do plan to try Lyft next time I'm in a city it supports, to see if the experience is better.)

Why not just.... not use Uber?

That seems like a massively inconvenient workaround to use a service which really only offers a mild convenience (over, say, a regular taxi).

You must live in an area with good to great taxi service.

There are areas where taxi service is so spotty as to be scary, were simply getting a cab is a huge pain (IE: called and ordered) and flagging one down is a non-starter. Even after calling in a cab, they often end up being no-shows (get a better fare en-route, etc)... it is scary when you can't get dependable public transit home from a location (stuck alone, outside, waiting for sometimes hours).

Uber started and initially flourished in areas were taxi service was insanely poor due to bad regulation and/or corruption. Uber was basically a response to the godawful taxi situation in SF.

I know I feel far more comfortable when the people I care about are able to get an Uber/Lyft/(similar) service.

>- SMS list

Nothing provided by the OP shows what is actually being sent. The linked text document of the code only shows the creation of an instance of the SMSLog class, which itself is defined in another class (not provided or discussed by OP). This is the same for most of the scary bits, which is unfortunate as seeing the code itself (or the MITM'ing the app and seeing the data) would be very interesting.

It takes all of a minute to download the APK from the store and check for yourself. I just did and SMSLog is present in it and does grab all your SMS metadata starting with the most recent ones, saving for each message:

- checked at (timestamp when read?), to number, service number, sms at (timestamp received?), sms type

Now I can't tell you if it does actually transmit that data, but the remainder of the code looks for the world like it. In the end, of course, it doesn't actually matter. That's like arguing if malware that lies dormant actually exists.

All one has to do is look at the App info for the Uber app.

It doesn't ask for permissions to access anything SMS related, or call history related.

I'm assuming they've included the entire InAuth SDK, but not used most of the functionality.

Yikes, uninstalling now. I haven't used Uber for a while, but it's been useful to have just in case Lyft is +200% and Sidecar doesn't have anything available... Now it's not even worth it to have the software on my phone. Thanks for the summary and link to the decompiled source code.

This is not something new. I've had LinkedIn and Facebook do this with my personal contacts.

I use disposable emails for every site (www.spamgourmet.com). After installing LinkedIn and Facebook Android apps they started recommending adding old coworkers that I have 0 mutual friends / connections with.

It's not always them knowing your contact list. Sometimes (most times) this will be powered from the other side, as in someone you know has uploaded their contact list and it's matched you as you registered

Sorry might not cut it this time.

Reply on news.ycombinator.com