Slashdot Mirror
Android Users' Security and Privacy At Risk From Shadowy Ecosystem of Pre-Installed Software, Study Warns (techcrunch.com)
Researchers behind a large-scale independent study of pre-installed Android apps "unearthed a complex ecosystem of players with a primary focus on advertising and 'data-driven services' -- which they argue the average Android user is likely to be unaware of (while also likely lacking the ability to uninstall/evade the baked in software's privileged access to data and resources themselves)," reports TechCrunch. From the report: The study, which was carried out by researchers at the Universidad Carlos III de Madrid (UC3M) and the IMDEA Networks Institute, in collaboration with the International Computer Science Institute (ICSI) at Berkeley (USA) and Stony Brook University of New York (US), encompassed more than 82,000 pre-installed Android apps across more than 1,700 devices manufactured by 214 brands, according to the IMDEA institute. "The study shows, on the one hand, that the permission model on the Android operating system and its apps allow a large number of actors to track and obtain personal user information," it writes. "At the same time, it reveals that the end user is not aware of these actors in the Android terminals or of the implications that this practice could have on their privacy. Furthermore, the presence of this privileged software in the system makes it difficult to eliminate it if one is not an expert user."
In all 1,200 developers were identified behind the pre-installed software they found in the data-set they examined, as well as more than 11,000 third party libraries (SDKs). Many of the preloaded apps were found to display what the researchers dub potentially dangerous or undesired behavior. The data-set underpinning their analysis was collected via crowd-sourcing methods -- using a purpose-built app (called Firmware Scanner), and pulling data from the Lumen Privacy Monitor app. The latter provided the researchers with visibility on mobile traffic flow -- via anonymized network flow metadata obtained from its users. They also crawled the Google Play Store to compare their findings on pre-installed apps with publicly available apps -- and found that just 9% of the package names in their dataset were publicly indexed on Play. Another concerning finding relates to permissions. In addition to standard permissions defined in Android (i.e. which can be controlled by the user) the researchers say they identified more than 4,845 owner or "personalized" permissions by different actors in the manufacture and distribution of devices. So that means they found systematic user permissions workarounds being enabled by scores of commercial deals cut in a non-transparency data-driven background Android software ecosystem. The researchers address the lack of transparency and accountability in the Android ecosystem by suggesting the introduction and use of certificates signed by globally-trusted certificate authorities, or a certificate transparency repository "dedicated to providing details and attribution for certificates used to sign various Android apps, including pre-installed apps, even if self-signed." They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."
In all 1,200 developers were identified behind the pre-installed software they found in the data-set they examined, as well as more than 11,000 third party libraries (SDKs). Many of the preloaded apps were found to display what the researchers dub potentially dangerous or undesired behavior. The data-set underpinning their analysis was collected via crowd-sourcing methods -- using a purpose-built app (called Firmware Scanner), and pulling data from the Lumen Privacy Monitor app. The latter provided the researchers with visibility on mobile traffic flow -- via anonymized network flow metadata obtained from its users. They also crawled the Google Play Store to compare their findings on pre-installed apps with publicly available apps -- and found that just 9% of the package names in their dataset were publicly indexed on Play. Another concerning finding relates to permissions. In addition to standard permissions defined in Android (i.e. which can be controlled by the user) the researchers say they identified more than 4,845 owner or "personalized" permissions by different actors in the manufacture and distribution of devices. So that means they found systematic user permissions workarounds being enabled by scores of commercial deals cut in a non-transparency data-driven background Android software ecosystem. The researchers address the lack of transparency and accountability in the Android ecosystem by suggesting the introduction and use of certificates signed by globally-trusted certificate authorities, or a certificate transparency repository "dedicated to providing details and attribution for certificates used to sign various Android apps, including pre-installed apps, even if self-signed." They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."
This is why I'm kind of over Android.
It's so fragmented it isn't funny. Every OEM wants to put their own branded shit and get a cut of your money and track you. Every hardware manufacturer makes side deals with companies you will never know about and have no means to uninstall. You certainly don't have a chance to give your consent -- the assholes who built it took that away.
There is no single thing called Android, it's different from every source .. and most of those sources are greedy sacks of shit who care neither for your security nor your privacy.
The vanilla Nexus Android was a nice idea, but even Google seems to have abandoned that idea.
For me, Android is a pile of shit precisely because it is so fragmented and everything is full of proprietary and third party shit.
When my Nexus 7 tablet dies, either I won't replace it with anything, or I'll just buy a low-end iPad.
At the end of the day, mobile has just become a cesspool of tracking, ads, and analytics. And I really see little value in most of it -- not the apps and not the devices.
Until I can be sure I'm getting a clean device which isn't selling my information to a bunch of ad companies and parasites, I'll do without the fucking device entirely. But at this point, I'd never buy another Android device again.
At the end of the day, Android has really just ushered in a new era of shitty, privacy violating devices which steal your data and upload to who the fuck knows.
So, fuck Android. It has utterly failed in my opinion. All it's really done is welcome in more useless assholes to your mobile experience.
Android is pretty much at the vanguard of the race to the bottom which modern computers have become -- social media, ads, analytics, and stealing your personal data -- it's fucking parasites all the way down.
Fuck all of it. It's a marketing departments dream, and a privacy advocate's nightmare.
Since when does Google have a good enough reputation to be damaged by association with malware?