Google has recently made a significant change to the management process for permissions on Android devices, unfortunately security experts noticed that the change could advantage bad actors that intend to conduct attacks against the mobile platform.
Google has decided to group 145 permissions allowed for
Android apps in into 13 categories and groups app permissions into “
groups of related permissions”, the change was studied to favor the Android user in the choice of the proper permissions to grant their apps.
If a user approves a single permission for the app, with the new process, he approves the whole respective permission groups
The choice to update the way users can manage app permission has introduced the following potential
privacy and security issues:
- Hiding permissions behind the group names
- Auto-updating app process doesn’t trigger any alert is a new permission belonging to the same group is added.
If an app need to read user’s incoming
SMS text messages, it requires the “
Read SMS messages” permission, with new improvement the user is approving all SMS-related permissions.
With new policy, the app developer can include additional permissions from ‘SMS-related permissions Group’ in every moment, this means that future update including the added permission will not trigger any warning before installation.
“When an app updates, it may need to use additional capabilities or information controlled by permissions. If you have automatic updates enabled, you won’t need to review or accept these permissions as long as they are included in a permissions group you already accepted for that app.If the app needs access to an additional permissions group, you’ll be asked to accept the update, even if you’ve set an app to update automatically. If you prefer to review each update manually, you can change your update settings.” states Google.
Authors of malware could benefit of the mechanism to give new permissions to their malicious applications without arousing suspicion in the victims.
The colleagues at TheHackerNews
tested the process during the installation of the official application FIFA World Cup 2014.
During the installation the app has required for group permissions in left image, on the right-side image are proposed the related group permissions.
When a user grant specific group permissions to an app, it can be secretly updated later to gain extra permissions belonging to the same “groups of related permissions”. A malware developer could exploit the mechanism to add permissions usually used by malicious code to access user’s personal information, network access and SMS management.
Below the functionality that most of all are abused:
- GPS Location and Network-based Location
- Read Phone State and Identity
- Automatically Start at Boot
- Modify/Delete SD Card Contents
- Read/Send SMS Messages
- Read/Modify Contacts
Despite the change made by Google, users can anyway verify manually the permissions requested by each app update, users are invited to disable automatic updates and verify app permissions manually.
