Stefan Mileschin

Even saying no is not enough

Security boffins have found more than 1,000 Android apps that skirted restrictions, allowing them to gather precise geolocation data and phone identifiers behind your back.

Researchers from the International Computer Science Institute found up to 1,325 Android apps that were gathering data from devices even after people explicitly denied them permission. Serge Egelman, director of usable security and privacy research at the ICSI, presented the study in late June at the Federal Trade Commission's PrivacyCon.

Egelman told the conference: "Consumers have very few tools and cues that they can use to reasonably control their privacy and make decisions about it. App developers can just circumvent the system, then asking consumers for permission is relatively meaningless."

Egelman said the researchers notified Google about these issues last September, as well as the FTC. Google said it would be addressing the issues in Android Q, which is expected to release this year.

The update will address the problem by hiding location information in photos from apps and requiring any apps that access Wi-Fi to also have permission for location data, according to Google.

The study looked at more than 88,000 apps from the Google Play store, tracking how data transferred from the apps when they were denied permissions. The 1,325 apps that violated permissions on Android used workarounds hidden in its code that would take personal data from sources like Wi-Fi connections and metadata stored in photos.

For example Shutterfly, a photo-editing app, had been gathering GPS coordinates from photos and sending that data to its own servers, even when users declined to give the app permission to access location data.

https://fudzilla.com/news/mobile/490...e-restrictions