Android Apps can Pinpoint Device Details

Wednesday, January 29, 2014 @ 04:01 PM gHale

The popularity of Android devices continues to grow for users and for attackers.

While it may be hard to believe, there is a good chunk of Android applications that can find and open photographs on mobile devices, track locations, learn email addresses and leak address books and phone logs, researchers said.

After conducting an analysis of 836,021 Play Store Android applications, researchers at Bitdefender found over 35 percent of the apps can track a user’s location, with almost three percent being able to access the location even when the app is running in the background without the user’s knowledge. More than 6 percent of these apps can also send the device location over the Internet.

Android Bootkit Going Global
Trojan Pushes Malware onto Androids
Mac Trojan Updated and Active
Trojan Slowed, but not Gone

In addition, three percent of the apps can reveal email addresses over the Internet: 1,749 uploaded the address over an encrypted connection, with 1,661 doing so over an unencrypted connection that could easily end up intercepted.

“Our latest study shows that most smartphone or tablet owners have at least one app – and probably several – that could be used to siphon sensitive information from their phones,” said Catalin Cosoi, chief security strategist at Bitdefender.

Unauthorized permissions may provide access to a device’s location, address books, telephone logs and geographic data from photos uploaded to the mobile versions of social networking sites. Facebook and Twitter both clear photos of metadata before publication, but a third party could duplicate the info as it travels across the carrier’s mobile network and stores it for further processing. This can also happen when third-party ad providers take data from the phone to use for targeted advertisements. In this case, the ad network only serves as a vector.

Bitdefender’s analysis also found over five percent of the apps analyzed could locate and open photos on a phone, with almost 10 percent including permissions to read contact lists.

Leave a Reply

You must be logged in to post a comment.