Saturday, December 2, 2023

More than 1,300 Android Apps Steals user Data Even After the Permission Denied

Smartphone plays a vital role in day-to-day activities, it has access to sensitive resources such as sensors, camera, Microphones, and GPS. For an end-user, it is crucial to protect the phone from unauthorized access.

The Android phones are the most-popular and most-used phone operating system, starting from Android 6.0 users grant and revoke app permissions at run time for third party applications.

Security researchers from IMDEA Networks Institute, U.C. Berkeley & ICSI AppCensus, Inc discovered that apps can evade the permission model and gain access to the sensitive data without user consent.

The apps can gain access to the sensitive area through both covert and side channels, more than 88,000 apps from U.S. Google play, out of the 1,325 apps found violating the permission systems.

According to the report, side channels present in the implementation of the permission system allow apps to access protected data and system resources without permission; whereas covert channels enable communication between two colluding apps so that one app can share its permission protected data with another app lacking those permissions. Both pose threats to user privacy.

The Attacks are grouped into five different types of covert and side-channel attack to extract the sensitive data from the device.

IMEI (Salmonads & Baidu)

Five apps that developed in third party developers platform Salmonads platform found to contain IMEI, even though they don’t have permission to access it.

Further analysis revealed that the application contains Salmonads SDK that exploits covert channels to read this information. The largest Chinese search engine Baidu uses the same SDK.

Network MAC Addresses

Android protects access to the device’s MAC address by default, researchers observed that apps transmitting the device’s MAC address without having permission to access it.

The Unity cross-platform game engine used in several Android mobile games spotted sending the MD5 hash of the MAC to Unity’s servers.

Router MAC Address

Access to the WiFi router MAC address (BSSID) is protected by the ACCESS_WIFI_STATE permission. Our analysis revealed two side channels to access the connected WiFi router information: reading the ARP cache and asking the router directly.


More than 70 apps sending location data to 45 different domains without having any of the location permissions.

For instance, Shutterfy and EXIF Metadata send precise geolocation including the latitude and longitude to its server, even though the permission was not provided.

“While this app may not be intending to circumvent the permission system, this technique can be exploited by a malicious actor to gain access to the user’s location.”

The bugs have been reported by researchers to Google the last September and they got bug bounty disclosing the issues and the fixes will be available with the release of Android Q.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

Chinese Video App VidMate Stealing Personal Data, Drain Battery, Fake Ad Click to Generate Revenue From 500 Million Android Users

4 Million Android Users Infected by Malicious Beauty Camera App From Google Play that Steals Personal Pictures

GPlayed – New Malware Posed as Google Play App to Spy & Steal Data From Your Entire Android Phone

Newly Discovered Android Malware Stealing Data from Messaging Applications WhatsApp, Viber, Facebook


Latest articles

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles