Slashdot Mirror
Many Android VPN Apps Request 'Dangerous' Permissions They Don't Need (zdnet.com)
A VPN researcher found that many Android VPN apps request access to sensitive permissions that they don't need, according to an article shared by WaitingForSupport. ZDNet reports:
The study, carried out by John Mason from TheBestVPN.com, analyzed 81 Android apps available for download through the Google Play Store. Mason said he downloaded and extracted the permissions requested by each VPN app from their respective APK installer files.... According to Mason, 50 of the 81 Android VPN apps he tested requested access to at least one dangerous permission that accessed user data...
Mason said he discovered VPN apps that requested access to read/write permissions for external device storage, wanted access to precise location data, wanted the ability to read or write system settings, and, in some cases, wanted to access call logs or manage local files. "In theory, VPN apps should only need a few permissions to function. INTERNET and ACCESS_NETWORK_STATE should usually be enough," Mason told us. "The use of a large number of dangerous permissions could be cause for suspicion."
Mason said he discovered VPN apps that requested access to read/write permissions for external device storage, wanted access to precise location data, wanted the ability to read or write system settings, and, in some cases, wanted to access call logs or manage local files. "In theory, VPN apps should only need a few permissions to function. INTERNET and ACCESS_NETWORK_STATE should usually be enough," Mason told us. "The use of a large number of dangerous permissions could be cause for suspicion."
VPN's are the tech equivalent of burglar bars and a safe.
You may not have anything of value in there, but it looks like you do.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
The rest exfiltration
Look, Android is total shite—as evidenced by all this nonsense, Androids doesn't even begin to provide an adequate framework with which to compute in a mobile fashion.
HOWEVER, permissions can be managed by users to a degree, and users are free to think about what they are putting on their own systems. So, if people get screwed, I don't really care; you'll go insane trying to save people from their own stupidity.
I put a mobile game out years ago when someone tech savvy reached out to me to say I didn't need a certain permission (I think it was READ_PHONE_STATE). I replied that an API I used required it according to their documentation, and they responded "No it doesn't."
I dug into it and found that they were right and the documentation was wrong. I replied back that I pushed out a fix and thanked them for pointing it out.
Everyone walked away happy. Would be nice if something like that happened with those 50 apps.
It would be great to see a review site that shows what permissions apps are requesting. Maybe I'll build one.
Android. Google. Safe. By definition.
I know these things.
Get your hotdogs. Get your hotdogs.
Google built a shit OS, or people aren't bothering to manage the permissions of the apps they install.
Notice that's not an exclusive "or".
... nearly every app I look at to install asks for permissions that I know are not necessary for the app to perform its function.
The VPN app I use appears as "suspicious" in this analysis because it uses READ_EXTERNAL_STORAGE. So far as I can tell, this is needed to access downloaded files. The way I configure my VPN connection is to download a config file from a website and import it into the app. The config file includes certificates to a) authenticate me to the server, b) authenticate the server to me. Typing in a long binary string for (a) is not going to work, so the app needs to be able to read downloaded files. I think this counts as "core required functionality" rather than "suspicious behaviour"
It's a sign of incompetence. It means the developer doesn't know or understand the Android libraries or how the OS does things. It also can mean the developer is doing things behind the scenes that we may not like - logging location data, getting contact lists for scams, uploading pictures to maybe get selfie porn too put on some porn website.
In either case, developers should be ashamed of themselves - like Torque. WTF does he need access to my contact list?! Or my photos?! What an asshole!
Said the security services, as they created their own VPN companies and android apps. And Samsung, under the guise of 'secure wifi' which really was 'MARKET RESEARCH ALL YOUR PACKETS'!
Seriously, are people completely fucking stupid?
If READ_EXTERNAL_STORAGE is required to simply read a few files from a private configuration directory, the Android security model sucks beyond all possible comprehension.
Which it might. I would know this already for a real OS, only in this case I'm too afraid to even begin to peek under the hood.
I stopped installing apps years ago for precisely this reason: what you don't know can hurt you; I don't want to learn the Android security model without brain bleach, and I don't want to learn the Android security model with brain bleach, either.
Disable apps, no bleach required.
Serious question because in the decade or so of using a VPN on my phones, I've never , ever had to install anything else but OpenVPN or use the built in IPSec clients. Are people really using proxy software whiel calling it a VPN?
Coding is already very hard, but coding security critical components is even more so. At the same time, we have coders that are barely computer literate and could not code anything complicated of their life depended on it. The situation is worse wit "apps". Hence it is no surprise at all that VPN apps are generally speaking an insecure mess.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It's how the permissoin system works: Developer tinkers around, hates getting nagged at so requests the kitchen sink.
Users get only this choice: Swallow the whole thing by saying "yes here's my firstborn", or not get to use the app. Who's going to say no?
Have gnu, will travel.
I don't know why anyone would use apps from the Google Play Store... It's so full of garbage and adware. These days, I pretty much ONLY use apps from f-droid. They do a much better job of tightening up permissions and removing anti-features than anything Google is doing on the app store.
Let's be completely honest:
Many Android #What's your favorite topic again?# Apps Request 'Dangerous' Permissions They Don't Need
And it's not entirely Google's fault. When you download applications for Windows you must also exercise caution and, unlike Android apps, most Windows applications require full access to your PC (some Windows applications even install low level drivers), so with Android you can at least have some control.
What really annnoys me about Android is that often there's a nice nifty app which requires next to zero permissions and no access to the Internet, and then its developer decides he wants to monetize his app (which has suddenly become relatively popular), and this app suddenly starts showing full screen ads and send your private data God knows where.
and google play needs access to everything it asks for?
let's not forgot that some moron at google decided that the only way to get the state of wifi (to tell if you change network, if its connected etc) was to also require location permissions
People should use the stock GPL openvpn package from openvpn.net. Import the settings for your provider.
* Read SD card - so it can import settings
* Full network - duh.
* View network connections - duh.
* Install Shortcuts - place icon on home screen
* Run at startup - for those people who always want VPN running/Network-Kill option.
It actually works without root.
If you don't like using google, get it from the f-droid appstore.
Oh ... sorry apple people. Apple hates the GPL.
That is so true
I wonder how does it correlates with nationality of the VPN provider.
There's only two reasons for this: 1) re-inventing the phone/email applet interface, 2) spying.
Ditto for contact/email list and current location
I got rid of all navigation applets because they accessed all this information, even those with an offline database. I also decided that Skype wasn't worth the loss of privacy it caused.
Android includes cloud-storage interfaces so applets don't have to open a universal network socket. Yet, many applets claim cloud-storage but don't use the built-in interface. Anyone who cares about privacy will check the permissions of an applet before downloading.
I'm quite content going into the VPN menu option on my iPhone and configuring it manually without downloading a VPN app at all.
Nearly all apps available through the Google Play Store are malware - usually spyware. Android OS is privacy-hostile by design.
As that would permit contacting a more local connection point.
But other than that... nothing.
"Flashlight" needs access to:
-Contacts
-GPS Location
-Phone
-Files
-Photos
-IMEI / Serial Number
-SIM Card Contacts
-Data
Nope, nothing untowards here.
Oh ... sorry apple people. Apple hates the GPL.
What uninformed BS.
I use an iphone because it is more secure and private.
I use OpenVPN on ios, connecting to my own OVPN server on Linux. Installing the app and configuration / certificate file was trivial, unlike Android apparently. And the app has no access to my other data.
"A researcher found that many Android apps request access to sensitive permissions that they don't need."
is anybody still not aware of this?
On a long enough timeline, the survival rate for everyone drops to zero.