9 ms·
Battery power alone can be used to track Android phones
- SifJar 12y agoThe article mentions that the required permissions are "very common permissions", and then in the next paragraph says that 179 apps on the Google Play store require those permissions. As of July 2014, there were 1.3 million apps in the app store [1]. That's ~0.014% of the apps on the store. Not exactly "very common" in my mind. Although the remark that they are "unlikely to raise suspicion" is valid, especially for the typical consumer, who probably isn't reading the permissions anyway. [1] - http://en.wikipedia.org/wiki/Google_Play#Android_applications http://en.wikipedia.org/wiki/Google_Play#Android_application...
- octo_t 12y agoI can see a popup message of 'we tune our app based on your current power levels' or similar being quite persuasive in this regard too.
- leereeves 12y agoThe typical consumer would probably just give the app access to the GPS. The hard part is getting them to download it. Interesting research but not the most practical attack.
- zipperhead 12y agoThat's the problem with android. The 'typical user' has no control over individual app permission - it's literally all or none. If you install the app you give it access to the GPS, as long as it has specified that permission.
- wongarsu 12y agoRooted Cyanogenmod actually has privacy settings which enable you to restrict some permissions on a per-app basis. For example I don't allow Facebook Messenger access to GPS and Android asks me before Messenger gets camera access.
- hackuser 12y ago> Rooted Cyanogenmod actually has privacy settings which enable you to restrict some permissions on a per-app basis Why only "some"; why not all?
- dagar 12y agoI honestly don't understand why this is a problem. Isn't it enough that the app says it requires my location when I install it? If you don't like the required permissions no one is forcing you to install it.
- Sidnicious 12y agoPopular apps can essentially request any permission and you'll still download it — are you really going to forgo having Facebook on your phone because it asks for a couple of slightly-objectionable permissions? On iOS, the average user has a chance to download that mainstream app and deny it access to their contacts.
- robotresearcher 12y ago> are you really going to forgo having Facebook on your phone because it asks for a couple of slightly-objectionable permissions? That sounds like you meant it as a rhetorical question, but "yes" is a reasonable answer.
- hahainternet 12y agoI've no idea why you have been downvoted. I also do not have apps on my phone which ask for permissions I do not like.
- thesteamboat 12y agoIt sounds to me like the question was supposed to read > are [most people] really going to forgo having Facebook [...] There will certainly always be people who do pay attention to permissions for privacy or security reasons, but they seem* vastly outnumbered by the people who don't. * Just an intuitive sense, I have not looked for data to back this up.
- lighthazard 12y agoThe point is valid, but it still doesn't address the 'general population' problem - how do you get the users to care about their security/privacy? Giving fine-grain control over permissions is a fantastic idea.. but then you realize that the 'general population' that you made this for will never touch those settings, so it's no different than telling users what permissions an application will take. Also, the development cost of 'does this feature exist?' for each permission is pretty high.
- onion2k 12y agoPresumably this is an attack that would be targeted at an atypical user - someone security conscious enough to not give GPS permission to apps they install, and who would have switched off location services that would use wifi instead. In those circumstances you might assume that any tracking would be beyond the capabilities of anyone who didn't have direct access to the phone network. This proof of concept demonstrates that would be an incorrect assumption.
- romaniv 12y agoI am ver surprised there is still no mass outrage over Android permissions. 1. They are not properly named or explained. And no, this shouldn't be on some obscure website. This should be right there, in the menu that asks for them. 2. There is no way to filter apps in the play store by permissions. This isn't just a privacy thing. Apps that require the least permissions are often least bloated and the most skillfully written. It's obvious that both of these thing are deliberate, it's obvious that this is an issue, and no one cares.
- Sidnicious 12y agoAlso, there's no way to download an app but deny it some permissions. iOS gets this right: apps don't get to ask for any permissions when you download them, they have to request them at runtime and the user can deny any of them (and the app is still expected to function)
- TazeTSchnitzel 12y agoThis was briefly added in Android 4.something, but Google removed it.
- digi_owl 12y agoAppops. Supposedly there as a test system for apps. I guess to see if they would crash in case of malformed data from sensors etc. Some OEMs, like Huawei, offer similar functionality on their products.
- heywire 12y agoIt is possible to "activate" this functionality on some phones as well. I have it enabled on my Samsung Galaxy S4, which is rooted, but otherwise is running the stock ROM (though not by choice).
- on_and_off 12y agoIt was a test tool and supposed to be hidden : you had to enter its Intent directly in order to launch it (if I remember well, they had also forgotten to hide it as a menu choice when creating a widget shortcut to the settings in one android subversion). Even if they repackaged it as a proper app (it really showed that AppOps was a test tool, the interface was pretty primitive), I don't see the point. Permission revocation is not that useful against an app like Facebook that will use its permissions to access your private data as soon as it is installed. What we need here is granular permission granting. Apps start with only inoffensive permission (bluetooth access ? internet ? I guess some reflection on what these base permissions should be would be needed) and only gain access to your private data (mail, contacts, calendar, ...) if they ask for it and you grant it to them. That way, apps can only collect your data if you let them.
- egeozcan 12y agoSo what makes this specific to Android phones? Developers can't (get permission to) access this information on other platforms?
- psykovsky 12y agoI think it's their research that makes it Android specific, as in, they only researched Android.
- tomkinstinch 12y agoIt's available on iOS: https://developer.apple.com/library/ios/documentation/UIKit/Reference/UIDevice_Class/#//apple_ref/occ/instp/UIDevice/batteryLevel https://developer.apple.com/library/ios/documentation/UIKit/...
- feld 12y agoNo it's not. That does not expose voltage and current. The research paper says they're doing this ... ... by repeatedly reading the following two files: /sys/class/power_supply/battery/voltage_now /sys/class/power_supply/battery/current_now
- tomkinstinch 12y agoNot at a simplistic level, no, but voltage you could derive from the discharge curve of a characterized battery (since we know fraction of charge remaining), and current could probably be approximated by looking at the rate of discharge.
- joosters 12y agoOriginal research paper: http://arxiv.org/abs/1502.03182 http://arxiv.org/abs/1502.03182 PDF link: http://arxiv.org/pdf/1502.03182v1.pdf http://arxiv.org/pdf/1502.03182v1.pdf
- jawns 12y agoThis snippet (from the PDF) reveals the effectiveness of the technique: "To evaluate the first algorithm for distinguishing routes we recorded reference profiles for several different routes. We used a dataset of 43 profiles for 4 different routes about 19 kilometers each. Driving in different directions along the same roads (from point A to B vs. from point B to A) is considered two different routes. We perform a leave-one-out cross validation, each time using one of the profiles for testing. Figure 5 is a confusion matrix, which shows a high success rate in classifying the routes. The achieved successful classification rate in this case was 93%." So, given a bunch of known routes (like a stretch of highway), this algorithm is able to match your phone's battery-usage signature to one of those routes, sort of like how a service like SoundHound is able to identify a piece of music based off of a few seconds' recording.
- ttty 12y agoBut that if the battery discharges exactly the same. I think that is not the case, for example the battery when is at 50% might discharge (doing the exact thing) differently than when is at 20%. Maybe the battery is not well calibrated or the internal part of the battery are more wasted than others.
- PJDK 12y agoThis is really selling a quite interesting intellectual effort on meaningless paranoia. Who would have any interest in tracking people in this manner? Any government based group can grab the data much more conveniently via the phone towers. Anyone else? Well you've got to trick someone into downloading this thing, so it's probably not that good for targeting a specific individual. If you can think up some nefarious scheme which involves grabbing lots of peoples locations, just get permissions to use GPS or cell location, way more apps have that privilege. I'm not sure what you do with it afterwards though. New research reveals people can be tracked just by watching where they go...
- throwawayaway 12y agoI am sure that advertisers would like the data if unavailable via other means, redundancy is being offered by this technique.
- tomp 12y agoDon't mobile devices store their battery usage over time (and also the per-app breakdown of energy usage)? I don't know what precision the stored data is in, but if it's precise enough, you could reconstruct past movements using it. E.g. when you arrive into a country, the border control could "track" your steps back for a day or so.
- JoachimS 12y agoNot sure if the "Who would have any interest in tracking people in this manner?" is really relevant. Based on the collect all, hoover all metadata etc that seems to be going on, _anything_ remotely possibly useful seems to be interesting. And the big thing is that this data can of course (and will be) correlated with things like cell tower location, wifi hotspots all kinds of other metadata.
- digi_owl 12y agoMakes one wonder what STASI could come up with had it still been operating...
- jchrisa 12y agoI'm thinking about when Whistler decodes the kidnapper's route in Sneakers.
- raverbashing 12y agoI think this has the potential to be as good as the location of MH370 by satellite data Basically, locate the user over a wide range of possible locations. I wouldn't loose my sleep over this, really
- marypublic 12y agoSeriously? Have you not heard of side channel and timing attacks? This is called information leakage and is a big deal. Because it is not common/easy now doesn't mean it won't be in the future. The nature of information disclosure (whether data or metadata) is that people find "impractical" methods of accessing information we might prefer they not have, then make them practical. It may also be the case that the researchers cannot make it practical, but that doesn't mean there aren't actors who can and possibly have already done this. This is a very useful article OP, thank you for posting
- S_A_P 12y agoMaybe I am a bit dense here, but how does battery drain map to a location? What would they be cross referencing to gather location? All I can gather is that they would also need to know what tower you were talking to, and then based on the drain they could probably guess where you were based on some heuristic. Meaning, if you are talking to tower x, and the battery drain is high, you could guess that you are either far from the tower or indoors somewhere. It still seems to me that this is dubious at best. I get that technology is always changing, but wouldn't it just be easier to exploit a security hole?
- wongarsu 12y agoAs you move, your distance to the closest cell tower changes. You also move past signal obstacles, so the change in signal strength isn't linear. They claim that these changes are characteristic enough that you can track movement that way.
- S_A_P 12y agoI get that part and to some degree understand. Maybe I am misinterpreting the "track your location" as something more accurate than "this person is in a 10 mile radius of this tower". For instance, wouldn't you need to know details of how different buildings are constructed? If you are in a busy downtown area, tracking with this method seems impossible. I could see if it was a remote area with few buildings to sift through.
- wongarsu 12y agoYes, it's not as trivial as just grabbing the data and running a generic algorithm. Ideally you would want to measure all routes where you want to track people. Kind of like how google knows where every wifi access point is and uses that for location information. Also, you need people to move. Because you only have power data, you only know the aproximate signal strength if the person isn't moving.
- S_A_P 12y ago
- xer 12y agoJust ask the user for their location right away. Most don't care anyway.
- yablee 12y agoIsn't the assumption that "the noise of playing music,social media, etc" is not correlated with the phone's location, pretty weak? I know I have distinct patterns of when I scroll up twitter or listen to music, which depend on where I am..
- lm2s 12y agoWhat a sensasionalist headline... The results of the study can only be achieved under a very controlled environment and even then they're not accurate. From a practical point of view this is irrelevant when there are other ways of getting a user location that are far more accurate and easy. But from an academic point of view I can see the interest.
- Fando 12y agoBBC lol.
- lumisota 12y agohttp://www.phdcomics.com/comics.php?n=1174 http://www.phdcomics.com/comics.php?n=1174
- triangleman 12y agoThe p-value of 0.56 is a joke right?
- Dylan16807 12y agoI read it as rho. (Isn't scientific notation fun like that)
- the_imp 12y agoIt's not a p-value, it's Spearman's rho, or rank correlation coefficient. It's a value in [-1,1] and when deviating from zero indicates a statistically dependent relationship: http://en.wikipedia.org/wiki/Spearman%27s_rank_correlation_coefficient http://en.wikipedia.org/wiki/Spearman%27s_rank_correlation_c...
- wcdolphin 12y agoThis is a 'tour de force' study for sure, but has a very limited scope (and reliability)- First, it only works if the attacker knows both the route(s) ahead of time and the power consumption profile of the routes, which requires careful mapping of the region with a recording device. Second, its accuracy degrades drastically depending on the number of apps running -- they only tested with background apps, which already rendered the method only slightly better than a random guess, with an arbitrary app running in the foreground the power consumption goes bananas and so does their method. Storm in a glass of water, if you ask me.. (But you wouldn't know this by reading that abstract alone ;)) -@r2r
- scarygliders 12y agoThe first thing that popped into my head to get around this technique - and in one fell swoop would defeat all others - was : "Switch the phone off and remove the battery". Of course, as soon as you turn the phone back on again, your adversary can pinpoint your location. I guess the best overall solution would be to eschew having a phone at all.