Slashdot Mirror
Android Bug Allows Geolocation Tracking of Users (duo.com)
Trailrunner7 writes: Researchers have discovered a weakness in all version of Android except 9, the most recent release, that can allow an attacker to gather sensitive information such as the MAC address and BSSID name and pinpoint the location of an affected device. The vulnerability is a result of the way that Android broadcasts device information to apps installed on a device. The operating system uses a mechanism known as an intent to send out information between processes or applications, and some of the information about the device's WiFi network interface sent via a pair of intents can be used by an attacker to track a device closely.
A malicious app -- or just one that is listening for the right broadcasts from Android -- would be able to identify any individual Android device and geolocate it. An attacker could use this weaknesses to track a given device, presumably without the user's knowledge. Although Android has had MAC address randomization implemented since version 6, released in 2015, Yakov Shafranovich of Nightwatch Cybersecurity said his research showed that an attacker can get around this restriction.
A malicious app -- or just one that is listening for the right broadcasts from Android -- would be able to identify any individual Android device and geolocate it. An attacker could use this weaknesses to track a given device, presumably without the user's knowledge. Although Android has had MAC address randomization implemented since version 6, released in 2015, Yakov Shafranovich of Nightwatch Cybersecurity said his research showed that an attacker can get around this restriction.
That is really pathetic implementation by Google. The idea is that your application should have to register for special permissions to access this information, but apparently the system broadcasts it to all listening applications on the device. The fact that this actually exists makes me wonder about the entire codebase. There should be single point in the code where intents are sent out and matched against access/permissions. It sounds like spaghetti.
You can download the "Internal Broadcasts Monitor" app from the store and see the data yourself.
Yeah, when I was young, I used to fantasize about the government knowing what library books I had checked out. Now I know that I am nobody, just like 98% of everybody. My private information, aside from that necessary for financial transactions, is worthless. If you're not in the public eye, nobody gives a fsck.
Strange things are afoot at the Circle-K.
Maybe it is just an undocumented feature installed for those in the know.
We call it a feature.
-- Tigger warning: This post may contain tiggers! --
When they try out removing the info and every ad network on the planet crashes every app because that data is unexpectedly null, what can Google realistically do???
At some point the horses are not just out of the barn, the barn has caught fire and there is no barn to put them back into.
I have serious reservations this should be counted as a bug though. I am nearly 100% sure this was by design. Even if you wanted to give Google the benefit of the doubt in regards to intent you could imagine some technical person simply thinking that information could be useful to an app so why shouldn't everyone be able to read it?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
TBH they are both pretty shitty platforms.
“Common sense is not so common.” — Voltaire
No spyware in AOSP. But when people say Android they are referring to about two dozen forks of it. And it's really tough to generalize about such a diverse set.
All I know is that Android dev tools are free, and I can post my shitty apps on the Plat Store. Unlike Apple that enforces arbitrary and ever changing standards and keeps taking my stuff down. Maybe if I were a professional company instead of a hobbyist the App store would be more manageable but for hobbyist hackers, Android is the easier platform to target.
P.S. I don't think you're sorry at all.
“Common sense is not so common.” — Voltaire
whoohoo someone is thinking of me!
“Common sense is not so common.” — Voltaire
+1 informative
Sample app with 'zero' permissions and still can access wifi mac (even when wifi is switched off) https://github.com/haninaguib/...
No spyware in AOSP. But when people say Android they are referring to about two dozen forks of it. And it's really tough to generalize about such a diverse set.
All I know is that Android dev tools are free, and I can post my shitty apps on the Plat Store. Unlike Apple that enforces arbitrary and ever changing standards and keeps taking my stuff down. Maybe if I were a professional company instead of a hobbyist the App store would be more manageable but for hobbyist hackers, Android is the easier platform to target.
P.S. I don't think you're sorry at all.
Perhaps your Apps keep getting taken down precisely because the ARE Shitty (Your words).
And the Dev Tools ARE free for iOS, too, if you have a Mac.
I just assumed this behavior was in the original Android spec.
Tools are included free with a 99 USD per membership year fee...
“Common sense is not so common.” — Voltaire