Slashdot Mirror
Fifth of Android Apps Expose Private Data
WrongSizeGlass writes "CNET is reporting that a fifth of Android apps expose private data. The Android market threat report details the security issues uncovered. Dozens of apps were found to have the same type of access to sensitive information as known spyware does, including access to the content of e-mail and text messages, phone call information, and device location. 5% of the apps were found to have the ability to make calls, and 2% can send text messages, without the mobile user doing anything."
My Evo tells me before I install an app what it will be able to do, I assume it works the same for all Android phones. It's hard to get worked up over an app that can access personal data, when you were told in big red letters that this app can access personal data, and you clicked ok anyway.
A fifth of applications rely on *permissions* that you, the user, must explicitly grant when you install them, that *allow* them to access private information.
That does not mean they do access that information, or put it to any sort of untoward use. Android practically screams at you when you install applications that need a bunch of permissions. Generally, sure, you ignore that if it just says "Read/write SD card" for example. But if something suspiciously asks for lots and lots of permissions, you might say to yourself "gee, this looks a little funny".
If 10,000 other people have installed it and everybody rates it 5-stars and there are no issues mentioned with it on the web, you can probably guess that it's not doing anything nasty with your information.
But the fact that Android extremely explicitly warns you about these permissions means that the only issue in my mind is there should be a more intense distinction in the UI between permissions like "Read/write to SD card" that lots of apps need, and "Access my contacts" or "Send text messages" which only a smaller number of apps need.
Otherwise, this is basically a hatchet job.
Whenever you install an application on Android, you're given a list of permissions the application wants to have in order to run, including accessing your data and making phone calls. You have to explicitly agree to this list before the app is installed. Is CNET saying that a fifth of Android apps can get your data, despite those permissions not appearing in the list? Because if they're not, this is a pointless "Well, duh" story: the user was told what the application is doing. If they just breeze through and click "OK" when that's clearly inappropriate (i.e., a tip calculator really shouldn't be requesting access to your call log), that's their damn problem.
Dislike the Electoral College? Lobby your state to join the National Popular Vote Interstate Compact.
This report is hardly independent. If you ignore the CNET reporter looking for controversial pulp to post on a blog you'll find that this report comes from smobilesystems, a little-known mobile security company who conveniently have a new piece of Android security software to sell that will stop all these non-existent rogue spyware apps. You can argue all you want that users install these apps with full knowledge and consent. They know that it's BS; they just want to use FUD to convince the unwary and paranoid that their software (which if it actually does anything, probably just checks the installed apps against a package name blacklist) will keep them safe from an imaginary raging torrent of malware on the Android platform.
And behold, a command prompt and he who sat upon it, his name was shutdown and -h 3:11 followed with him
If its open source, is it really a threat?
Have you read the source to all the open source apps you use? If your answer is no, then the answer to your question is yes.
I wanted to install an app that managed sms, and it asked for permission to access my messages!
It goes without saying that I immediately canceled the installation.
If you actually RTFAs' source, you'll see that this smobile systems company is using these statistics to try and sell a dependency checker.
Also, I saw no mention that these 'leaks' are derived from sources other than what the user allowed.
In short, Not news.
"Our goal each year should be to increase the number of goals we set for ourselves!"
100% of your pc applications have access to your file system!
Dozens of apps were found to have the same type of access to sensitive information as known spyware does
Dozens of children were found to have access to the same types of kitchen utensils that murderers use!
which is totally what she said
This PDF was the most useless crap slashvertisement I've seen in a while. They're trying to sell us their anti-spyware package for Android, by citing stats that are meaningless.
I have Handcent SMS installed. Of course it wants permission to send and receive SMS messages.
I have a remote bricking package installed so I can disable my phone remotely if lost or stolen, so it has those permissions legitimately too.
The key is verifying that the permissions a package requests seem reasonable upon installation.
For example, if your new kids fingerpaint program requires full internet access, contact list access and sms access, you might have spyware on your hands.
- Michael T. Babcock (Yes, I blog)
Fear, Uncertainty & doubt is all this article is doing
http://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt.
As many people have pointed out the security permissions model in android is very good.
you cant have fantastic apps without allowing them access to other data.
And so thats why the security permission authorization screens are there.
Its so dumb this article, because you cant have your cake and eat it too.
It pisses me off when journalists write a piece like this LL because it gets headlines.
Hey CNet, get a life and stop taking backhanders from Apple or Microsoft. Just a ridiculous article in the first place.
I think you'd surprised to find that to most private data NO apps have ANY access on the iPhone... They're mostly limited to their own data and to the net and there are only very few APIs to access anything else. Android may be cautios and transparent, but iOS is paranoid.
In the long run I very much doubt that the "flagging and informing" of Android helps here. It's good for shifting the responsibility over to the user ("You clicked OK after all, you dumb fuck!"), nothing more. The difference between Google and Apple is that Google thinks this is enough and Apple doesn't. I have not made up my mind yet about who's right. But I know one thing: Half of the population is beyond average intelligence.
For the real question is what percent of market apps abuse this capability? It's one thing to have the capability (and the installer is pretty clear about what an app can and can't do when you first install it), but it's another to have a bunch of spyware apps out there abusing users' data. My guess is this story is Apple FUD and that the market is working just fine with lots of well-behaved apps doing useful things with calling data, email and text capabilities.
The difference is that SMobile doesn't appear to have an antivirus/malware app for the iPhone.
You were presented with the confirmation when you installed the application. You should always read the requested permissions list before installing an application. If you're downloading a game, why does it need access to activate the phone? Legitimate developers will frequently leave comments and notes in the description about WHY they need additional permissions.
"Fighting the underpants gnomes since 1998!" "Bruce Schneier knows the state of schroedinger's cat"
Sounds like FUD to me.
Always a possibility to question these days. I have a silghtly different theory...
Note paragraph 3 of the whitepaper's summary:
SMobile's new behavior-based detection methodology leverages heuristic-style technology to determine if an application could be malicious, then gives the user the ability to use this information to determine if ... application is requesting permission to do things that just doesn't make sense for the application.
Given this it's obvious the whitepaper is an advertisement, not an objective security report.
Where the FUD question comes in is whether their application can actually do a better job at determining whether an application is "non-malicious" than the user could themselves. I believe the claim is exaggerated because trying to make a computer understand what an application does and how that relates to Android's security API is far from a trivial task.
The reason is, the Google Map app is NOT http://maps.google.com./ It's far more complicated. It's essentially a full car navigation system. It will respond to voice commands, dial numbers for you, keep the phone from sleeping ( so you can keep looking down at it while driving without having to unlock your phone ), cache's a large amount of data especially if sat view is on and traffic is on, and wiki layers, and last search layers...etc...etc.
Look, this is very much a One Button Mouse vs n-Button Mouse debate. On the Apple products, you don't trust the user or developer.... ever (unless the developer is Apple). On the Android platform, each party is liable. While the developer is held in a sandbox based on specific rights, it's not impossible for a seemingly legitimate app to wake-up in the middle of the night and dial 1-900 numbers. This trade-off in security is deemed a worthy risk because of the payoff in productivity and usefulness in increased application integration.
Google maps is a great example of the uber app on the Android. And all the functionality of Google maps could be replaced with by some other application. Anyone can compete with it. In the Apple world, the Google Map App would pretty much need to be part of the base phone operating system, or at least produced by Apple and not run in the sandbox.
In the case that a developer of an app uses it maliciously, it falls back to Google and Google marketplace to police this app.
-Malakai
A Dragon Lives in my Garage
That's not correct. iPhone apps have access to a far larger amount of data than you might expect. For instance they can all read the "keyboard cache" which records all keystrokes save for passwords. This iPhone Privacy study may prove interesting.