Thursday, July 25, 2024

More than 1,300 Android Apps Steals user Data Even After the Permission Denied

Smartphone plays a vital role in day-to-day activities, it has access to sensitive resources such as sensors, camera, Microphones, and GPS. For an end-user, it is crucial to protect the phone from unauthorized access.

The Android phones are the most-popular and most-used phone operating system, starting from Android 6.0 users grant and revoke app permissions at run time for third party applications.

Security researchers from IMDEA Networks Institute, U.C. Berkeley & ICSI AppCensus, Inc discovered that apps can evade the permission model and gain access to the sensitive data without user consent.

The apps can gain access to the sensitive area through both covert and side channels, more than 88,000 apps from U.S. Google play, out of the 1,325 apps found violating the permission systems.

According to the report, side channels present in the implementation of the permission system allow apps to access protected data and system resources without permission; whereas covert channels enable communication between two colluding apps so that one app can share its permission protected data with another app lacking those permissions. Both pose threats to user privacy.

The Attacks are grouped into five different types of covert and side-channel attack to extract the sensitive data from the device.

IMEI (Salmonads & Baidu)

Five apps that developed in third party developers platform Salmonads platform found to contain IMEI, even though they don’t have permission to access it.

Further analysis revealed that the application contains Salmonads SDK that exploits covert channels to read this information. The largest Chinese search engine Baidu uses the same SDK.

Network MAC Addresses

Android protects access to the device’s MAC address by default, researchers observed that apps transmitting the device’s MAC address without having permission to access it.

The Unity cross-platform game engine used in several Android mobile games spotted sending the MD5 hash of the MAC to Unity’s servers.

Router MAC Address

Access to the WiFi router MAC address (BSSID) is protected by the ACCESS_WIFI_STATE permission. Our analysis revealed two side channels to access the connected WiFi router information: reading the ARP cache and asking the router directly.


More than 70 apps sending location data to 45 different domains without having any of the location permissions.

For instance, Shutterfy and EXIF Metadata send precise geolocation including the latitude and longitude to its server, even though the permission was not provided.

“While this app may not be intending to circumvent the permission system, this technique can be exploited by a malicious actor to gain access to the user’s location.”

The bugs have been reported by researchers to Google the last September and they got bug bounty disclosing the issues and the fixes will be available with the release of Android Q.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

Chinese Video App VidMate Stealing Personal Data, Drain Battery, Fake Ad Click to Generate Revenue From 500 Million Android Users

4 Million Android Users Infected by Malicious Beauty Camera App From Google Play that Steals Personal Pictures

GPlayed – New Malware Posed as Google Play App to Spy & Steal Data From Your Entire Android Phone

Newly Discovered Android Malware Stealing Data from Messaging Applications WhatsApp, Viber, Facebook


Latest articles

ShadowRoot Ransomware Attacking Organizations With Weaponized PDF Documents

A rudimentary ransomware targets Turkish businesses through phishing emails with ".ru" domain sender addresses....

BreachForumsV1 Database Leaked: Private messages, Emails & IP Exposed

BreachForumsV1, a notorious online platform for facilitating illegal activities, has reportedly suffered a massive...

250 Million Hamster Kombat Players Targeted Via Android And Windows Malware

Despite having simple gameplay, the new Telegram clicker game Hamster Kombat has become very...

Beware Of Malicious Python Packages That Steal Users Sensitive Data

Malicious Python packages uploaded by "dsfsdfds" to PyPI infiltrated user systems by exfiltrating sensitive...

Chinese Hackers Using Shared Framework To Create Multi-Platform Malware

Shared frameworks are often prone to hackers' abuses as they have been built into...

BlueStacks Emulator For Windows Flaw Exposes Millions Of Gamers To Attack

A significant vulnerability was discovered in BlueStacks, the world's fastest Android emulator and cloud...

Google Chrome 127 Released with a fix for 24 Security Vulnerabilities

Google has unveiled the latest version of its Chrome browser, Chrome 127, which is...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles