4 ms·
> Unity (the cross-platform game engine) using a UNIX ioctl call to obtain the MAC address of the WiFi network interface. 748 apps were found to be gathering an
by panpanna 7y ago
> Unity (the cross-platform game engine) using a UNIX ioctl call to obtain the MAC address of the WiFi network interface. 748 apps were found to be gathering and sending the MAC address in this way without holding the ACCESS_NETWORK_STATE permission.
Can anyone from unity comment on this?
- jackewiehose 7y agoUnity is not necessarily doing something wrong. As a library/platform-wrapper, it is their job to provide stuff like that. If such syscalls are meant to be forbidden, the OS has to prevent them. (I'm not from unity)
- dmitrygr 7y agoOne does not accidentally develop a complex side-channel attack. It was a deliberate effort to circumvent user wishes. I wish google had the balls to ban apps that do this for a few weeks from the Play Store. That would teach them fast.
- jackewiehose 7y agoUsing ioctl() is not a complex side-channel attack. It's a legitimate (and maybe only) way to do certain things on linux. Since unity is cross platform, I could imagine they just peeked at their existing code base when implementing the android version.
- dmitrygr 7y agoExcept, according to the article, they first try the proper Android API. And then only do this thing if the api tells them they have no permission.
- jackewiehose 7y agoThat paragraph in the article isn't about Unity, it's about the "OpenX SDK" and that is indeed a very shady behavior (I guess it's right that uMatrix completely blocks all access to www.openx.com).