Friday, March 29, 2024

More than 1,300 Android Apps Steals user Data Even After the Permission Denied

Smartphone plays a vital role in day-to-day activities, it has access to sensitive resources such as sensors, camera, Microphones, and GPS. For an end-user, it is crucial to protect the phone from unauthorized access.

The Android phones are the most-popular and most-used phone operating system, starting from Android 6.0 users grant and revoke app permissions at run time for third party applications.

Security researchers from IMDEA Networks Institute, U.C. Berkeley & ICSI AppCensus, Inc discovered that apps can evade the permission model and gain access to the sensitive data without user consent.

The apps can gain access to the sensitive area through both covert and side channels, more than 88,000 apps from U.S. Google play, out of the 1,325 apps found violating the permission systems.

According to the report, side channels present in the implementation of the permission system allow apps to access protected data and system resources without permission; whereas covert channels enable communication between two colluding apps so that one app can share its permission protected data with another app lacking those permissions. Both pose threats to user privacy.

The Attacks are grouped into five different types of covert and side-channel attack to extract the sensitive data from the device.

IMEI (Salmonads & Baidu)

Five apps that developed in third party developers platform Salmonads platform found to contain IMEI, even though they don’t have permission to access it.

Further analysis revealed that the application contains Salmonads SDK that exploits covert channels to read this information. The largest Chinese search engine Baidu uses the same SDK.

Network MAC Addresses

Android protects access to the device’s MAC address by default, researchers observed that apps transmitting the device’s MAC address without having permission to access it.

The Unity cross-platform game engine used in several Android mobile games spotted sending the MD5 hash of the MAC to Unity’s servers.

Router MAC Address

Access to the WiFi router MAC address (BSSID) is protected by the ACCESS_WIFI_STATE permission. Our analysis revealed two side channels to access the connected WiFi router information: reading the ARP cache and asking the router directly.

Geolocation

More than 70 apps sending location data to 45 different domains without having any of the location permissions.

For instance, Shutterfy and EXIF Metadata send precise geolocation including the latitude and longitude to its server, even though the permission was not provided.

“While this app may not be intending to circumvent the permission system, this technique can be exploited by a malicious actor to gain access to the user’s location.”

The bugs have been reported by researchers to Google the last September and they got bug bounty disclosing the issues and the fixes will be available with the release of Android Q.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

Chinese Video App VidMate Stealing Personal Data, Drain Battery, Fake Ad Click to Generate Revenue From 500 Million Android Users

4 Million Android Users Infected by Malicious Beauty Camera App From Google Play that Steals Personal Pictures

GPlayed – New Malware Posed as Google Play App to Spy & Steal Data From Your Entire Android Phone

Newly Discovered Android Malware Stealing Data from Messaging Applications WhatsApp, Viber, Facebook

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles