EFF warns of Android 'Stygian hole' as update kills access to privacy settings

Cellcom

find my iphone

first iphone

samsung s4

iphone 5s

iphone 5s

iphone 5c

iphone 5

The Electronic Frontier Foundation (EFF) has criticised Google for removing code from the newest version of Android that gave users detailed control of privacy settings in apps.

Separately, the security company FireEye warned that it had discovered "widespread" problems in South Korea where Android users had downloaded an app which surreptitiously stole their text messages and sent them to cybercriminals in China - while posing as a settings app.

Android version 4.4.2 removes what Peter Eckersley, the technology projects director for the EFF, calls a "vital" privacy feature which lets users install apps while also preventing them from accessing their location or address book. The feature was accessible in version 4.3 of Android, but was removed in a tussle played out in the code's development between Google programmers.

The privacy feature was accessed using a free app called App Ops, which was able to access system-level privacy settings for any app.

'Alarming news'

The EFF called the removal "alarming news for Android users", adding: "The fact that they cannot turn off app permissions is a Stygian hole in the Android security model, and a billion people's data is being sucked through. Embarrassingly, it is also one that Apple managed to fix in iOS years ago."

The security and privacy problems around Android's permissions model were highlighted recently by the US Federal Trade Commission, which fined the maker of a torch app called Brightest Flashlight Free that had more than 50m downloads while secretly passing device data and location information back to advertisers.

Google told the EFF that the exposure of the privacy settings in Android 4.3, released in mid-November, was "experimental". Sources familiar with Google's thinking say the feature was unsupported and untested, and that average users wouldn't have understood the need for third-party software to activate it, or known how to find it. Apps denied permissions by user settings might also have stopped working if they needed those settings, sources suggested.

But the trail of changes in the source code of Android suggests that the exposure of the privacy settings was not accidental. On 1 August Dianne Hackborn, an Android program manager at Google made a code change in Android to "completely remove app ops activity" - which was thenreversed the next day by another programmer, Dave Burke, who moved to Google from the UK in 2012.

Android code change removing 'App Ops' access: the green text comments out the functional elements. Photograph: /Public domain

The changes made by Hackborn and Burke show that the functionality for App Ops controls already exists in Android.

'Not ready for prime time'

Commenting on the move, Koushik Dutta of CyanogenMod, which provides a custom installable version of Android, told the Guardian: "Almost every OEM [device maker] has their own implementation of this privacy enabling feature, and obviously Google wants this functionality in AOSP proper. Judging by the code commit messages on the feature, it was apparent that App Ops was not deemed ready for prime time, and Google is generally wary of introducing anything that would break third party applications."

Dutta added: "prior to 4.4.2, there was no way to access App Ops directly. A third party application would need to launch the hidden system menu. This was an unintentional hole, so that was addressed in the Android update. During our conversations with the Android team they hinted it would be back in some form or another, as the permission model in Android is a little dated and lacking."

The CynagenMod team built their own version of App Ops called "Privacy Guard" earlier this year, and have rebuilt it on top of the existing permissions infrastructure. "The Privacy Guard feature is still enabled and available within CyanogenMod," said Koush.

Steve Kondik, also on the CyanogenMod team, told the Guardian: "I think the bigger implications lie with the companies whose bottom line might be affected because of this - the ones that might depend on snarfing up your data for whatever nefarious reasons."

The EFF's Eckersley had previously called the privacy tools in 4.3 "awesome", saying that the existing model had faults - "installing an app was an all-or-nothing proposition, and there were few practical ways to protect yourself against the apps you'd installed, or even really see what they were up to."

It noted that even though the permissions are specified, it's hard for average users to know quite what they mean: "how are users supposed to know what 'read phone state and identity' means? Why isn't it split into multiple permissions, one of which is 'let the app track me'?"

But its blogpost noting the effective downgrade was published just a day later. "A moment ago, it looked as though Google cared about this massive privacy problem. Now we have our doubts," wrote Eckersley. "The only way to dispel them, frankly, is for Google to urgently reenable the App Ops interface, as well as adding some polish and completing the fundamental pieces that it is missing."

Privacy criticism

Both Apple and Google have previously been criticised for not blocking apps from pulling data such as address book contents and location data from the phone operating system. But Apple introduced a "privacy" setting system in iOS 6, released in September 2012. That lets users determine on a per-app basis whether to allow them access to those details, and what information apps can present on the lock screen and elsewhere.

By contrast Android apps present the user with a list of system functions that it will access - but do not give reasons why they will be accessed, nor any way to deny them without rejecting the app completely.

FireEye said that the malware it had discovered, dubbed MisoSMS, which poses as "Google Vx" - including a Google-style letter logo - pretends that it will only seek to "control how and when the screen locks". But once the user gives it "administrator" permission, the app shows a dialog suggesting that it is faulty and has to be removed. Once the user presses a confirmation dialog, the app instead makes itself invisible and begins sending emails with the contents of any text messages received by the owner.

The app is itself being spread via text message with embedded URLs which encourage the recipient to download the app on various pretexts, such as security or fashionability. If the victim allows it to be installed, it will start to steal information from the phone.