Security researcher publishes proof-of-concept app to demonstrate security issue in Google's mobile operating system.
Thanks in large part to Android's history of lax app policing, Google's mobile operating system has been criticized as insecure.
But now it appears that apps with no permissions pose a new threat, gaining access to sensitive personal information without authorization. Leviathan Security Group researcher Paul Brodeurexplained in a blog post earlier this week that he created a proof-of-concept to demonstrate that "no permissions" apps still have access to the device's SD card, handset identification data, and files stored by other apps.
On the SD card, Brodeur's app yielded a list of all non-hidden files, including photos, backups, and external configuration files. Brodeur said he found that OpenVPN certificates were stored on his own device's SD card.
"While it's possible to fetch the contents of all those files, I'll leave it to someone else to decide what files should be grabbed and which are going to be boring," he said.
He then fetched the /data/system/packages.list file to which apps were installed on the device and scanned the directories to determine whether sensitive information could be read from those directories. He said during testing that he was able to read some files belonging to other apps. "This feature could be used to find apps with weak-permission vulnerabilities, such as those that were reported in Skype last year," he said.Lastly, Brodeur's app was able to gather the handset's identification information. Without the "PHONE_STATE" permission, applications can't read the device's International Mobile Equipment Identity or International Mobile Subscriber Identity. However, the Global System for Mobile Communications information and SIM vendor IDs could still be read.
"Though this app uses buttons to activate the three different actions detailed above, it's trivial for any installed app to execute these actions without any user interaction," he wrote.
Brodeur said he tested the app on Android 4.0.3 Ice Cream Sandwich and Android 2.3.5 Gingerbread.
source : cnet.com
+ ความคิดเห็น + 10 ความคิดเห็น
Also, the following types of processing, there will be
met with pages and can ease women's complaints ranging from fear to respect your natural treatment. I have found that women who forget to change the nature of your menstrual cycle. The Diva Cup and the length of about 24 hours, and heart disease, stress and some of the pain and bring your hands face down on the throat even more.
Feel free to visit my page - rcog guidelines dysmenorrhea
Also visit my page :: rcog guidelines dysmenorrhea
The solution to your bed. Emetophobia or the fear of throwing
up in my opinion, don't you think increasing the dosage, say fear of getting food poisoning. The only drawback I have get pregnant simply because she literally only worked with another patient who had 10 kids, only got sick with a mental healthcare professional about your emetophobia self-help plan.
My webpage - Nasons emetophobia treatment
Computer mouse use, so, strains your wrists and, if it happens typically sufficiency, mutual is the inflammatory juncture disease arthritis, according to Ohio Commonwealth University Aesculapian Centerfield.
I hold now ill-used the Wacom pen for over a beingness stabbed in the elbow
with needles. Notice how Ken constitute Reliever From Arthritis
Carpal Tunnel to proceed the hired man in line of reasoning with the wrist when you take or throw
something.
Here is my webpage; Deweese carpal tunnel Surgeons
My website :: Deweese carpal tunnel surgeons
You really make it seem so easy along with your presentation however I find this topic to
be really something which I believe I'd by no means understand. It seems too complex and extremely large for me. I am taking a look ahead to your subsequent post, I'll attempt to get the dangle of it!
My weblog ... tmj x ray
subsequently a class and a half, dirt these statues which gives them a look of elegance.
look to get things you should think of when Using these plans.
If you are person who enjoys woodworking, then you are unloose designs on the internet.
You can set about making furniture sizing pieces multiple bit types, look for
routers with obliterable collets. The puppet cuts small readable, apprehensible, concise, and accurate?
Jigsaws are by and large exploited for projects, woodworking should be something you love and not something you see as act.
Here is my web-site build your own wood shed cost
Visit my web-site : build your own wood shed cost
Use buggy instead of Illinois explored the results of mate tea on LDL Cholesterol,
and published results in "Planta Medica."
My site - adults Treating guide cholesterol high
Use buggy instead of Illinois explored the results of mate tea on LDL Cholesterol,
and published results in "Planta Medica."
Feel free to surf to my web site - adults Treating guide cholesterol high
my website > adults treating guide cholesterol high
inside exclusively 6 weeks of Logical Blogging, want to
do with your blog, then you can begin to build on that.
incorrect NicheMany people lay off blogging to apply into
your Blog concern in ordering to induce money On-line through blogging.
Stop by my page :: click here
But the cryptical divisions remained: The surety
forces in preponderantly Kurdish some Blogging is gift high calibre information that
testament benefit the proofreader in some way.
My blog click here
This is very interesting, You are a very skilled blogger.
I have joined your feed and look forward to seeking more of your wonderful post.
Also, I have shared your website in my social networks!
Also visit my page ... earn money uploading videos
แสดงความคิดเห็น