Slashdot Mirror
Skype For Android Can Leak Data To Malicious Apps
An anonymous reader writes "It appears that Skype account information on an Android phone remains readable by all in a standard installation, at least for certain versions of Skype out in the wild. That allows another potentially malicious app to know everything about you that Skype knows (contacts, history of whatever you've chatted about or who you called, phone numbers, personal information). Skype is said to be working to fix for what appears to be a simple file permissions issue. This sheds some more light on how much private information everybody gives away for free by just owning a phone with half a wrong chmod."
With all the grief slashdot gives the Apple App Store, when was the last time anyone read about a malicious or flawed app leaking personal information. Maybe the "walled garden" isn't so bad afterall.
This just in, information written readable by other apps is readable by other apps!
That allows another potentially malicious app to know everything about you that Skype knows (contacts, history of whatever you've chatted about or who you called,
News flash. Malicious apps are not constrained by file permissions.
If your device is pwn3d by an app, nothing Skype does can really protect you.
How come there wasn't an article about how Windows PCs can leak data to malicious applications? The same flaw exists in Skype for Windows. Nothing stops KeyloggerXP (or whatever) from gathering all info entered into the PC that it wants, and all files in the user's profile are (of course) owned by the same user, including the skype files, and malicious apps can change file permissions anyways, and defeat other security (by way of privilege escalation).
I'm glad I have an android phone, lord knows I couldn't deal with those insecure iphones and blackberries ;)
# ls -l /data/data/com.skype.merlin_mecha/files/jcaseap
The dude is in as root (via adb shell?). note the '#'. I guess he's still got a point about 666 on private files. As long as you have execute perms on the directory, you can read files tagged o+r.
boycott slashdot February 10th - 17th check out: altSlashdot.org
When you open Skype in the android market, it requests a skyscraper-high list of special permissions. When I saw that, I immediately decided to forget about it. There's no way that it could possibly need that much information to do its job, and now it looks like its even worse that I thought. Sucks that it leaks info like that, but kudos to Google for at least making the risk somewhat visible.
I'm not Android expert, but I thought each application was given their own UID and could only see their own directory. Is that not the case?
In fact that is one of the major selling points, they really put security at the top of the list. Extremely fine grained per app access controls, FIPS compliant encryption, secure wiping and so on. There is little to criticize in that regard, and is one of the reasons the US government loves the things so much (seriously, find a government agency that doesn't use Blackberries for all their employees).
To read a subdirectory under /data/ you need exec premissions on /data, but you don't have them.
He was using root shell, thus the story is moot.
I completely disagree with you and Apple, but it is a valid point to raise.
I8-D
Warning, Goatse link.
This space for rent.
And they let tinpot dictators read your texts and IMs.
Oh wait, that sounds not that good on second though.
Would this really have been more detectable with Apple's approval process?
No, because a permission based flaw is not possible in IOS, the directory your application goes into is not readable by other applications. It's not something the app sets up, but the system.
However I'm not convinced this is a flaw in Android either, I thought it sandboxed apps in the same way.
A potential flaw that may still exist in Android is if you have apps installed on external storage like an SD card - then I am not sure if the contents are really sandboxed.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Is there an app that detects sarcasm?
I don't even want Skype on my phone (LG Ally) but Verizon forces it on you along with a bunch of other crap (CityID, etc.) you can't make them not run at boot up, can't uninstall them, can't move them to the SD, etc. You can kill them with a task killer or manage apps but they start back up.
chmod is a unix command to modify file permissions.
android is based on unix(linux).
the android chmod doesnt work properly.
I'm that dude, and the POC doesn't use root. It has app level UID. I was showing the permissions with a root shell, because that is what I have adbD running as on my daily phone.
twice I tried to use it for a conference call and the app was so bad it made me wonder why it was even released. Crashes, sporadically refuses to let me answer calls,... so never mind it being insecure, it just plain sucks.
Holy shit, you guys, I just checked the source code for Linux and it turns out that files with read permission set can also be accessed by anybody there. Somebody better fix this bug fast!
Yes, that's probably another reason governments like these things - well spotted!
Socialism: a lie told by totalitarians and believed by fools.
On a desktop OS (be it Win or Linux), every app can read any data belonging to any other app... you just get protection between users.
And I have not heard many people complaining about it.
While I give kudos to Android for allowing for greater isolation, is it really needed?
Igor
half-wrong button holes, half-wrong tube socks.
i thought everyone knew what these meant!
Yes, various middle eastern governments can securely monitor all your traffic. And the only thing different from the western governments is that they're admit they're doing it.