Slashdot Mirror
Skype For Android Can Leak Data To Malicious Apps
An anonymous reader writes "It appears that Skype account information on an Android phone remains readable by all in a standard installation, at least for certain versions of Skype out in the wild. That allows another potentially malicious app to know everything about you that Skype knows (contacts, history of whatever you've chatted about or who you called, phone numbers, personal information). Skype is said to be working to fix for what appears to be a simple file permissions issue. This sheds some more light on how much private information everybody gives away for free by just owning a phone with half a wrong chmod."
This just in, information written readable by other apps is readable by other apps!
"Half a wrong chmod"
What DOES that EVEN MEAN!?
"Flyin' in just a sweet place,
Never been known to fail..."
"Half a wrong chmod"
What DOES that EVEN MEAN!?
It means they meant it to be one thing but it is another. The first half (intent) was correct, the 2nd half (execution/implementation) was incorrect. Therefore 'half wrong'.
Parse?
My head bursteth asunder!
"Flyin' in just a sweet place,
Never been known to fail..."
I'm glad I have an android phone, lord knows I couldn't deal with those insecure iphones and blackberries ;)
The problem here is not with the app store. Nor is it with Skype's developers ability to produce neat code as one may think. In this case the problem is just some Anonymous Coward's troll attempt.
My ignorance is just as good as your knowledge.
# ls -l /data/data/com.skype.merlin_mecha/files/jcaseap
The dude is in as root (via adb shell?). note the '#'. I guess he's still got a point about 666 on private files. As long as you have execute perms on the directory, you can read files tagged o+r.
boycott slashdot February 10th - 17th check out: altSlashdot.org
Trading liberty for safety, is that what you are suggesting?
When you open Skype in the android market, it requests a skyscraper-high list of special permissions. When I saw that, I immediately decided to forget about it. There's no way that it could possibly need that much information to do its job, and now it looks like its even worse that I thought. Sucks that it leaks info like that, but kudos to Google for at least making the risk somewhat visible.
With all the grief slashdot gives the Apple App Store, when was the last time anyone read about a malicious or flawed app leaking personal information.
Would this really have been more detectable with Apple's approval process? It's been a while, but I've heard of apps getting passed Apple's approval process that should not have - apps that had hidden functionality even. Flaws like this probably get overlooked all the time. In fact, Android may have an advantage here. I don't know how iOs apps communicate with each other, but Android apps are sand-boxed with very specific ways they have to communicate. I'm out of date on my iOs information, though. I'd love to hear comments from some iOs developers.
In fact that is one of the major selling points, they really put security at the top of the list. Extremely fine grained per app access controls, FIPS compliant encryption, secure wiping and so on. There is little to criticize in that regard, and is one of the reasons the US government loves the things so much (seriously, find a government agency that doesn't use Blackberries for all their employees).
You can't actually expect the Slashdot editors to actually know enough to filter out these crap stories, right? What's more important is that it has a catchy headline and thus will drive page and ad clicks!
Not when the file perms are 666 (read/write by user, group, and everyone).
I completely disagree with you and Apple, but it is a valid point to raise.
I8-D
Trading liberty for safety
LOL, I don't think Ben Franklin was talking about toys.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Warning, Goatse link.
This space for rent.
And they let tinpot dictators read your texts and IMs.
Oh wait, that sounds not that good on second though.
I bet more than 1% of android users have some sort of emulator installed or other app that would not be approved on the app store. Flash is another good example. That sorta kills your 99% number.
Would this really have been more detectable with Apple's approval process?
No, because a permission based flaw is not possible in IOS, the directory your application goes into is not readable by other applications. It's not something the app sets up, but the system.
However I'm not convinced this is a flaw in Android either, I thought it sandboxed apps in the same way.
A potential flaw that may still exist in Android is if you have apps installed on external storage like an SD card - then I am not sure if the contents are really sandboxed.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Maybe you use it as a toy, some of us do real work on these devices. I doubt Ben would have been a huge fan of people not being able to use tools they bought.
To read a subdirectory under /data/ you need exec premissions on /data, but you don't have them.
He was using root shell, thus the story is moot.
Being the OP of the article, you are completely wrong. I had no problem reproducing it on stock, unrooted phones. Research, then comment. Test it? Still doubt? Once its fixed I will release source.
Maybe you use it as a toy, some of us do real work on these devices.
Then you value not spewing your business's data to strangers, right?
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
When did I say business data was on the phone?
I do not use skype, and frankly would rather go without a smartphone than have one I cannot control.
When did I say business data was on the phone?
I must have misunderstood "doing real work" on your phone, my apologies.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
I believe madradioctiverat's goal was to get a Goatse link out there. Not post something true.
if (it != oneThing) it = another;
Is there an app that detects sarcasm?
I don't even want Skype on my phone (LG Ally) but Verizon forces it on you along with a bunch of other crap (CityID, etc.) you can't make them not run at boot up, can't uninstall them, can't move them to the SD, etc. You can kill them with a task killer or manage apps but they start back up.
chmod is a unix command to modify file permissions.
android is based on unix(linux).
the android chmod doesnt work properly.
Which is also not the default, Skype set them this way on purpose. According to a comment in TFA, they use some native libraries to access those DBs that run under a different user than the app does because they are trying to obsfucate the Skype protocol. I'm not sure how true all that it but it seems logical/feasible enough.
PocketPermissions Android Permission Guide
I'm that dude, and the POC doesn't use root. It has app level UID. I was showing the permissions with a root shell, because that is what I have adbD running as on my daily phone.
My real work involves tools like ssh, the data stays on the servers bucko.
Which is also not the default, Skype set them this way on purpose. According to a comment in TFA, they use some native libraries to access those DBs that run under a different user than the app does because they are trying to obsfucate the Skype protocol. I'm not sure how true all that it but it seems logical/feasible enough.
Sounds like the sort of behavior that would cause Apple to exclude it from their AppStore. Of course, that would be evil, right ?
If all else fails, immortality can always be assured by spectacular error.
You can't actually expect the Slashdot users to actually know enough not to respond to a goatse troll, right ?
If all else fails, immortality can always be assured by spectacular error.
Ah thanks, I learned long ago not to click comment links, so I didn't follow it
My real work involves tools like ssh, the data stays on the servers bucko.
And this whole thing isn't giving you pause for thought at all?
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
So just your private keys will be leaking into other apps. Good show bucko.
I don't keep those on the SD card, dimmy.
Yes, that's probably another reason governments like these things - well spotted!
Socialism: a lie told by totalitarians and believed by fools.
Considering this is about data on the SD card and I don't keep keys there, no it does not.
I wasn't trying to suggest that it was an android default, I was just clearing up the permissions confusion for the AC I was responding to.
some of us do real work on these devices
Okay, I've seen "Odd Jobs". Some people have weird jobs and I don't doubt your claims that you get work done on a toy. Some people make money setting up model railroads, too. But for most, I still stand by my assertion that it's a toy. It is certainly designed as a toy. That you can use it as a tool is great, and yeah, for you maybe Ben's advice holds. For the other 99.999% of the smartphone buying public, applying Franklin's statement is very inappropriate.
As an aside, Ben never got to see microelectronics or mass production. Ben lived in the day where a reasonably educated elite could have a firm grasp of every single scientific book published at the time. It was almost an expectation in some circles. Of course Ben wouldn't be "a huge fan" of people not being to use tools they bought... in his day, anyone could learn to build or alter the tool.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
That depends on what you mean by the phrase "data belonging to any other app".
You haven't heard people complaining about it because most programs have gotten pretty good at storing user data in non-world-readable directories. The mentality is finally becoming a bit more mainstream that "apps" store user data in the user's non-world-readable folder. When they deviate, people start to take notice. Contrast this with 10 years ago where on Windows--while such protections were available--they required knowledgeable configuration and many "apps" were written with assumptions that such protections were not exercised and could not run in sanely configured environments.
So, these days, on the desktop most "apps" can read "data belonging to any other app", but no one complains or cares because the data they *do* care about is stored in a location with more sane access controls. When "apps" deviate these days, they generally get called out on it.
didn't think you were, I was just adding to the info :)
PocketPermissions Android Permission Guide
half-wrong button holes, half-wrong tube socks.
i thought everyone knew what these meant!
Liberty? Apple isn't a government. You don't sign away any rights to them. Things like iPhones and iPads let you do *more* with them than you could do without them. How does liberty come into play at all?
Doubtful. But also mostly irrelevant. There's no way even 10% of Android users have an emulator installed (emulators are allowed in the App Store, btw), and out of all reasonably potential customers, the 99% number is quite reasonable.
Anyway, even if it's 90%, the point is still valid.