Over 1,300 Android Apps Caught Collecting Data Even If You Deny Permissions

Smartphones are a goldmine of sensitive data, and modern apps
work as diggers that continuously collect every possible
information from your devices.

The security model of modern mobile operating systems, like
Android and iOS, is primarily based on permissions that explicitly
define which sensitive services, device capabilities, or user
information an app can access, allowing users decide what apps can
access.

However, new findings by a team of researchers at the
International Computer Science Institute in California revealed
that mobile app developers are using shady techniques to harvest
users’ data even after they deny permissions.

In their talk “50 Ways to Pour Your Data” [PDF] at
PrivacyCon hosted by the Federal Trade Commission last Thursday,
researchers presented their findings that outline how more than
1,300 Android apps are collecting users’ precise geolocation data
and phone identifiers even when they’ve explicitly denied the
required permissions.

Researchers studied more than 88,000 apps from the Google Play
store, 1,325 of which were found violating permission systems
within the Android operating system by using hidden workarounds
that allow them to look for users’ personal data from sources like
metadata stored in photos and Wi-Fi connections.

Location Data — For instance, researchers found a
photo-editing app, called Shutterfly, that collects location data
of a device by extracting GPS coordinates from the metadata of
photos, as a side-channel, even when users declined to grant the
app permission to access location data.

“We observed that the Shutterfly app (com.shutterfly) sends
precise geolocation data to its own server (apcmobile.thislife.com)
without holding location permission.”

Moreover, it should be noted that if an app can access the
user’s location, then all third-party services embedded in that app
can also access it.

Phone Identifier — Besides this, researchers found 13 other
apps with more than 17 million installations that are accessing
phone’s IMEI, a persistent phone identifier, stored unprotected on
a phone’s SD card by other apps.

According to researchers, third-party libraries provided by two
Chinese companies, Baidu and Salmonads are also using this
technique as a covert channel to gather data they otherwise didn’t
have permission to access.

Mac Address — Other apps were found using the MAC address
of the Wi-Fi access point to figure out the user’s location. Apps
that function as smart remote controls, which otherwise do not need
location information to function, were found collecting location
data in this way.

In their study, researchers successfully tested these apps on an
instrumented versions of Android Marshmallow and Android Pie.

Researchers reported their findings to Google last September,
and the company paid his team a bug bounty for responsibly
disclosing the issues, but unfortunately, the fixes will be rolled
out with the release of Android Q, which is due later this
summer.

The Android Q update will address the issues by hiding location
data in photos from third-party apps as well as making it mandatory
for apps that access Wi-Fi to have permission to access location
data.

Until then, users are advised not to trust third-party apps and
turn off location and ID permission settings for apps that do not
actually need them in order to function. Also, uninstall any app
you don’t regularly use.

^[1]