13 ms·
What can you do with an Android application with no permissions?
- omgtehlion 15y agoWhat can you read on a page with a tiny grey font?
- bostonvaulter2 15y agoYou should try out Readability: http://www.readability.com/bookmarklets http://www.readability.com/bookmarklets
- omgtehlion 15y agoThank you. But original question still stands...
- rbarooah 15y agoPress the 'reader' button in safari.
- bostonvaulter2 15y agoWow, I did not realize that "no-permission" apps can read any file on the SD Card, I thought they at least needed the standard SD Card permission which I now realize is just SD Card write. I think that Android should implement some path-based security on the SD Card, although I guess that might be hard with their current model where I don't think any of the permissions have any arguments.
- TazeTSchnitzel 15y agoProblem with the SD Card is, AFAIK (might be wrong here) it's FAT formatted, so unless Android adds a security layer on top, there's no file permissions system.
- obtu 15y agoThe default permissions should just block access to the SD card, and let the user pick individual files to open if they want it.
- Tichy 15y agoI suppose not using any apps at all is the only option at this point :-(
- saurik 15y agoYour desktop/laptop has survived without anally granular sandboxing since the day you started using computers, and you've been using apps from all sorts of places (web browsers, plugins, text editors, games) without serious concern. Yes: you shouldn't install apps from people whom you don't feel some reason to trust, but that's always been the case (and seemingly always will, as no one has so far managed to build a sandbox that a teenager hasn't been able to break out of in a few days; Chrome's sandbox, for example, had two unrelated escapes come to light during the recent Pwnium contest).
- Tichy 15y agoWell I had serious concern for my desktop. Games are on an extra computer, and the OS tends to be Linux (preferred) or OS X (grudgingly). Most people's desktops are in fact completely overrun by malware, too. Just look at your relatives computers the next holiday.
- saurik 15y agoThose people also tend to get phished, or open email attachments with .exe extensions. If you buy a game from Best Buy and there is malware in it, someone will have some hell to pay. Lumping together "software I buy from people I've heard of" into the same category as "people get lots of malware" is just fear mongering.
- forgotusername 15y agoBig horking one missing from the list: run native code. From here you can pretty much do anything, since the average handset is shipped with an ancient buggy kernel. The short answer remains: treat software on Play with the same distrustful contempt you would treat random no-name desktop software found in the dark corners of the Internet.
- huggyface 15y agoCan you qualify this? Native code is sandboxed just as managed code is (of course it is). Ancient buggy kernel? Most handsets have very contemporary kernels. But surely you will provide some compelling citations.
- ge0rg 15y agoBasically every device for which some kind of rooting tool exists is vulnerable. It is not too hard to leverage the same exploit used by rooting tools to circumvent the UID based sandbox and to access the data of other applications, including the phone book, security tokens / passwords stored in SharedPreferences etc.
- saurik 15y agoHowever, with a buggy kernel, you don't necessarily need native code to perform the exploit: you just need access to whatever part of the kernel that has the bug (which is often something innocuous). If there is a bug in the filesystem driver where attempting to open file descriptor to paths larger than 1024 bytes long will cause a buffer overflow, I can exploit that just as easily from Java as I could from C.
- huggyface 15y agoBasically every device for which some kind of rooting tool exists is vulnerable. Most if not all rooting tools work via the debug interface. One rather clever app -- if you have USB debugging turned on -- would essentially do a localhost debug connection to exploit this, but generally these are ADB exploits. This has nothing to do with native versus managed, and native provides no additional opportunity than managed. I replied to the original post because there is a pretty prolific belief that native=crazy dangerous. Yet of course the iPhone has entirely native apps, and we've had native sandboxing and rights restrictions since...what...the creation of UNIX?
- deleted 15y ago[deleted]
- lucian1900 15y agoAnd desktop apps can do much more without requiring any permissions at all. While it would be great to have more secure apps everywhere, panicking about it, as has been so common in the media lately, is pointless.
- icebraining 15y agoThere's a point to be made about expectations, though. On a desktop by default you know that apps can do whatever they want, but on an OS with a built-in sandbox and permissions like "internet", you expect it to not be able to access the internet. That may lead to changes in your behavior, like installing any random app with no permissions instead of carefully evaluating them beforehand.
- lini 15y agoThe browser hack is not something new. I remember an article from last year, which showed how to get remote shell with a no-permissions app - https://viaforensics.com/security/nopermission-android-app-remote-shell.html https://viaforensics.com/security/nopermission-android-app-r...
- dfc 15y agoDid you bother to read the article before commenting? Sentences six and seven: "Some previous work had been demonstrated by Thomas Cannon of viaForensics. I wanted to develop that work further through a discussion backed by source code."
- woodall 15y agoReminds me of directory traversal on regular systems[1]. Zip up what ever you find, base64 encode it and send it to some shady server for later harvesting. [1] http://news.ycombinator.com/item?id=2691088 http://news.ycombinator.com/item?id=2691088
- bad_user 15y agoThis goes to show that security and privacy conscious users should always prefer the web version, if the choice is available, as the browser is a better sandbox, even in the context of these tightly controlled mobile platforms and app stores. However, I feel that these default permissions are really not that awful. There's always a balance between giving fine-grained control to the user over permissions and ease of use and these are not orthogonal issues, as the user suddenly ends up with more choices to make. What the user really wants to know ... is this mallware? Is this going to delete my files? Is this going to violate my privacy? ... and that's about it. If Android required separate permissions for absolutely everything you could do in an app, you know what the average user would do if presented with a list of 30 permissions requested, amongst which there would be phrases like "allow the app to open the web browser"? The average user would just click "Yes, please" without reading it (I'm even doing that myself from time to time). And that seems better for technical inclined folks like us, but it really isn't for average users, because it trains them to blindly accept anything while giving the impression of security - and I feel that's worse than no security at all.
- ge0rg 15y agoThe average user would just click "Yes, please" without reading it (I'm even doing that myself from time to time). This is happening most of the times anyway. There is no way to see from the installer screen, why an app requests a certain permission. One example: most launcher replacements require the CALL_PHONE permission, which comes with a big warning. This is technically required if you want to place a contact shortcut on your desktop. A better, security-wise, solution would have been to ask on-demand, when the app actually performs a permissions-requiring action, like it is done in J2ME. I suppose this was not done in Android either for software patent or for convenience reasons. Or maybe it would have gone against the usability of ad networks if you could deny the virtual Golf app access to GPS and internet...
- fpgeek 15y agoAsking on-demand for everything lands you in the usability mess that is Vista's UAC. There are plenty of places where permissions should be more fine-grained, but doing that in a usable way is not easy. Personally, I'd like to see a distinction between "required" and "optional" permissions (with always deny, prompt and always grant alternatives for optional ones). Of course, there would still be a lot of tricky issues to sort out (e.g. how do you encourage developers to expose some permissions as optional not required?), but I think that exposing more permissions for direct user management, while trying to minimize the effort required might might strike a better balance over the long run.
- gwern 15y ago> What can be done with the data once it’s collected? Without the INTERNET permission, how can it be sent anywhere? While it's true that most network access is restricted, there is one network call that can be made without any permissions: the URI ACTION_VIEW Intent opens a browser. By passing data via GET parameters in a URI, the browser will exfiltrate any collected data. In my tests, I found that the app is able to launch the browser even after it has lost focus, allowing for transmission of large amounts of data by creating successive browser calls. Reminds me of ping tunnels: http://en.wikipedia.org/wiki/ICMP_tunnel http://en.wikipedia.org/wiki/ICMP_tunnel
- biafra 15y agoThere is another way to transfer the data off the device. You can make another app, that has the same sharedUserId and that app has the internet permission. That app can see the data of the non-permission app and send the collected data via its internet permission anywhere. Apps with a sharedUserId have the super set of permissions of all apps they share the user id with. The user does not see that when installing either app.
- readme 15y agoThe web browser hack for uploads has been known for over two years and was made public at DEFCON http://www.defcon.org/images/defcon-18/dc-18-presentations/Lineberry/DEFCON-18-Lineberry-Not-The-Permissions-You-Are-Looking-For.pdf http://www.defcon.org/images/defcon-18/dc-18-presentations/L... See page 32 Also, I'd like to add that saying the ability to list packages on the device is a security risk is just silly. That's like saying a Linux box is vulnerable because I can list /usr.
- drucken 15y agoWhile it's true that most network access is restricted, there is one network call that can be made without any permissions: the URI ACTION_VIEW Intent opens a browser. Android has no "Trust Links" permission?
- gcardone 15y agoAccessing the accelerometer requires no permissions but can be used in a twisted way: by training machine learning algorithm, accelerometer data can be used to infer keystrokes. The state of the art of this attack is this: http://www.research.att.com/~miluzzo/pubs/sys015fp-miluzzo-ABSTRACT.pdf http://www.research.att.com/~miluzzo/pubs/sys015fp-miluzzo-A... (to appear in MobiSys '12, full paper available to general public in June). A simpler attack can be found here: http://www.hotmobile.org/2012/papers/HotMobile12-final42.pdf http://www.hotmobile.org/2012/papers/HotMobile12-final42.pdf .