Android Users' Security and Privacy At Risk From Shadowy Ecosystem of Pre-Installed Software, Study Warns (techcrunch.com) 27
Researchers behind a large-scale independent study of pre-installed Android apps "unearthed a complex ecosystem of players with a primary focus on advertising and 'data-driven services' -- which they argue the average Android user is likely to be unaware of (while also likely lacking the ability to uninstall/evade the baked in software's privileged access to data and resources themselves)," reports TechCrunch. From the report: The study, which was carried out by researchers at the Universidad Carlos III de Madrid (UC3M) and the IMDEA Networks Institute, in collaboration with the International Computer Science Institute (ICSI) at Berkeley (USA) and Stony Brook University of New York (US), encompassed more than 82,000 pre-installed Android apps across more than 1,700 devices manufactured by 214 brands, according to the IMDEA institute. "The study shows, on the one hand, that the permission model on the Android operating system and its apps allow a large number of actors to track and obtain personal user information," it writes. "At the same time, it reveals that the end user is not aware of these actors in the Android terminals or of the implications that this practice could have on their privacy. Furthermore, the presence of this privileged software in the system makes it difficult to eliminate it if one is not an expert user."
In all 1,200 developers were identified behind the pre-installed software they found in the data-set they examined, as well as more than 11,000 third party libraries (SDKs). Many of the preloaded apps were found to display what the researchers dub potentially dangerous or undesired behavior. The data-set underpinning their analysis was collected via crowd-sourcing methods -- using a purpose-built app (called Firmware Scanner), and pulling data from the Lumen Privacy Monitor app. The latter provided the researchers with visibility on mobile traffic flow -- via anonymized network flow metadata obtained from its users. They also crawled the Google Play Store to compare their findings on pre-installed apps with publicly available apps -- and found that just 9% of the package names in their dataset were publicly indexed on Play. Another concerning finding relates to permissions. In addition to standard permissions defined in Android (i.e. which can be controlled by the user) the researchers say they identified more than 4,845 owner or "personalized" permissions by different actors in the manufacture and distribution of devices. So that means they found systematic user permissions workarounds being enabled by scores of commercial deals cut in a non-transparency data-driven background Android software ecosystem. The researchers address the lack of transparency and accountability in the Android ecosystem by suggesting the introduction and use of certificates signed by globally-trusted certificate authorities, or a certificate transparency repository "dedicated to providing details and attribution for certificates used to sign various Android apps, including pre-installed apps, even if self-signed." They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."
In all 1,200 developers were identified behind the pre-installed software they found in the data-set they examined, as well as more than 11,000 third party libraries (SDKs). Many of the preloaded apps were found to display what the researchers dub potentially dangerous or undesired behavior. The data-set underpinning their analysis was collected via crowd-sourcing methods -- using a purpose-built app (called Firmware Scanner), and pulling data from the Lumen Privacy Monitor app. The latter provided the researchers with visibility on mobile traffic flow -- via anonymized network flow metadata obtained from its users. They also crawled the Google Play Store to compare their findings on pre-installed apps with publicly available apps -- and found that just 9% of the package names in their dataset were publicly indexed on Play. Another concerning finding relates to permissions. In addition to standard permissions defined in Android (i.e. which can be controlled by the user) the researchers say they identified more than 4,845 owner or "personalized" permissions by different actors in the manufacture and distribution of devices. So that means they found systematic user permissions workarounds being enabled by scores of commercial deals cut in a non-transparency data-driven background Android software ecosystem. The researchers address the lack of transparency and accountability in the Android ecosystem by suggesting the introduction and use of certificates signed by globally-trusted certificate authorities, or a certificate transparency repository "dedicated to providing details and attribution for certificates used to sign various Android apps, including pre-installed apps, even if self-signed." They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."
Re: (Score:2)
The article wasn't suggesting the problem was the existence of pre-installed software per se. It was about that pre-installed software behaving perniciously. The Weather app on iOS does not do that.
Re: (Score:2)
What have they got to hide? (Score:4, Interesting)
I like the recommendation put forth in the summary:
They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."
Re: (Score:2)
...and do so in a manner that is "accessible and understandable to users."
Yes, quite unlike this concise summary, that's used up all my daily attention points reservoir. I typically skip linking to tfa to save time (and face: This Is Slashdot!)
But. FD. I cheat and rtfs once in a while... Cheezus. I'd rather face the embarrassment of fully confirmed ignorance than wade through this.
Re: (Score:2)
This more than anything else.
When I get a new phone, the first step is to disable every unnecessary pre-installed app; but, distinguishing what is unnecessary from what will completely brick the phone is generally hard. What is "Mobile Services Manager"? "Gboard"? Why would "NFL Mobile" EVER be pre-installed? How about "Standard Home"?
Why are they so ashamed of their pre-installed apps that they won't even tell you what they do?
This is why Android sucks ... (Score:2, Insightful)
This is why I'm kind o
Google has damaged its reputation. (Score:2)
Cell phone companies want bad operation so they can sell more new cell phones.
Re:Cell phone companies want bad operation so they (Score:3)
Re: Cell phone companies want bad operation so the (Score:1)
Hey Mr. Getangryoninternet, using an absolute word like "never" alongside a fuzzy word like "adequate" results in a fuzzy assertion. You have taken this very fuzzy assertion and constructed a silly straw man around it by pretending its some absolute statement of truth. Maybe read better, or learn how and when razors apply.
Re:Google has damaged its reputation. (Score:5, Insightful)
Since when does Google have a good enough reputation to be damaged by association with malware?
you forget (Score:2)
You forget that there are negative infinities. Their reputation can always be damaged more.
Worst culprit for Android devices are carriers. (Score:1)
Have an AT&T smartphone on contract that came with an At&t store app that allows me to download apps without having the data count against me. It is essentially cost free data connection (it uses At&t Lte connection when available).
They suggest apps to you as a feature and use that and the free data aspect to monitor everything you do on your phone and where you use it. They can sideload whatever they want even if you turn off that feature in Android OS.
You have to read all the legal stuff when
Re: (Score:2)
The more things change... (Score:3)
I remember the days when new PC's used to come laden with so much junk-ware that you had to format the hard drive just to make it usable. The same thing has happened to Android phones, except that most people can't wipe the slate clean and set up the phone cleanly.
First app to get removed was Facebook (Score:2)
Samsung Galaxy S8 on Verizon, purchased August 2018.
Got rid of that adware, spyware, crapware right away.
Re: (Score:2)
AT&T forced Facebook and other apps onto the phone and made them unremoveable as part of a 'security' update. I think they meant 'AT&T Financial security'.
The Pixel with Googlefi does not have as good of a data service. In areas it'll refuse to work. In a few spots I was able to use a manual service switch app that showed it was using a Sprint tower that refused to pass data at all, and switching manually to T-mobile got things going again. The color and
You pays your money and you makes your choice (Score:1)
At the launch of the various Apple services yesterday, it was notable that security and privacy was discussed for each and every one, and the promises were pretty unequivocal: Apple will do as much as it can to not look at your data (e.g., on-device processing for categorising credit card transactions). Although this story is about third party pre-installed apps, there's a general principle thing going on: Apple makes its bucks from selling you devices, has a vested interest in getting app developers to beh
One word: LineageOS (Score:2)
don't buy crap (Score:2)
nothing new here, i suppose everybody already knows this.
just another confirmation not to buy anything else but;
- an android one phone
- or a phone that allows custom roms