Sensitive data: How are certain applications able to get around the Android permissions system?

All of this data could be collected legitimately if the necessary permission was requested. But this illegal gathering of data has become an issue in that it constitutes a basic violation of the concepts of notification and consent. “Applications provide notifications through authorisation requests, and users give their consent by accepting the conditions when they install the application. In not seeking authorisation and using a secondary or secret channel to obtain the same information in an underhand way, applications can pretend to protect privacy and trick consumers”, adds Joel Reardon.

An even more serious problem relates to the use of these persistent identifiers. “We noticed that a number of applications record devices’ serial numbers, such as their MAC address or their IMEI number, on their SD cards. This allows other applications which don’t have the authorisation to access them and read them”, explains the researcher. In response to this issue, Android restricted access to MAC addresses in 2015, and to IMEI numbers more recently. If an application has saved one of these to a user’s shared storage, it will only be accessible provided the applications are authorised to access this shared storage.

All of the vulnerabilities which the researchers behind this project identified were quickly reported to Google through their vulnerability programme. The American giant developed correctives, which were published in Android 10. The article also won the USENIX Security 2019 Distinguished Paper Award, and the data from the research is currently being used by a number of regulators investigating companies responsible for these deceitful practices. Finally, the published results were cited in the third edition of Ross Anderson's book “Security Engineering”, in a section dealing with issues of confidentiality and security linked to lateral channels.

This study has significant implications from a regulatory and transparency perspective in that it demonstrated vulnerabilities in the authorisation control mechanisms for the biggest mobile operating system, which were used to track users without them knowing. It also showed that existing platforms had been unable to detect these intrusive and deceitful practices for years.

The biggest impact these results had was in being used to boost security by improving the existing way of doing things. “I believe that greater involvement on the part of the regulatory authorities is the only way to send a message about what is unacceptable in the digital sphere, particularly given that mobile apps are increasingly linked to the civic sphere”, adds Joel Reardon.

Off the back of these results, the researchers behind the article “50 Ways to Leak Your Data: An Exploration of Apps' Circumvention of the Android Permissions System” (Joel Reardon, Narseo Vallina-Rodriguez, Amit Elazari Bar On, Primal Wijesekera and Serge Egelman) were awarded the 2021 CNIL-Inria Prize for Privacy Protection at the 15th edition of the International Computers, Privacy and Data Protection (CPDP) conference, held on 24th May last year.

First awarded in 2016 in the context of the partnership linking the two institutions, the aim of the CNIL-Inria EU Prize is to encourage scientific research on the protection of personal data and privacy.

The 2021 edition of the CNIL-Inria Prize also saw a prize awarded for the article “DatashareNetwork: A Decentralized Privacy-Preserving Search Engine for Investigative Journalists", which was recognised by the jury as an exceptional achievement in the field of privacy protection.  This article, authored by Kasra Edalatnejad, Wouter Lueks, Julien Pierre Martin, Soline Ledésert, Anne L'Hôte, Bruno Thomas, Laurent Girod and Carmela Troncoso, introduced the first search engine designed for investigative journalists, delivering end-to-end privacy protection.