×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Skype For Android Can Leak Data To Malicious Apps

Soulskill posted about 3 years ago | from the we-know-what-you're-really-doing-with-skype dept.

Communications 79

An anonymous reader writes "It appears that Skype account information on an Android phone remains readable by all in a standard installation, at least for certain versions of Skype out in the wild. That allows another potentially malicious app to know everything about you that Skype knows (contacts, history of whatever you've chatted about or who you called, phone numbers, personal information). Skype is said to be working to fix for what appears to be a simple file permissions issue. This sheds some more light on how much private information everybody gives away for free by just owning a phone with half a wrong chmod."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

79 comments

I wonder... (-1, Flamebait)

Anonymous Coward | about 3 years ago | (#35830398)

With all the grief slashdot gives the Apple App Store, when was the last time anyone read about a malicious or flawed app leaking personal information. Maybe the "walled garden" isn't so bad afterall.

Re:I wonder... (1)

Jeremiah Cornelius (137) | about 3 years ago | (#35830418)

"Half a wrong chmod"

What DOES that EVEN MEAN!?

Re:I wonder... (1)

WrongSizeGlass (838941) | about 3 years ago | (#35830436)

"Half a wrong chmod"

What DOES that EVEN MEAN!?

It means they meant it to be one thing but it is another. The first half (intent) was correct, the 2nd half (execution/implementation) was incorrect. Therefore 'half wrong'.

Re:I wonder... (1)

Jeremiah Cornelius (137) | about 3 years ago | (#35830460)

Parse?

My head bursteth asunder!

im going to take away your unix card (1)

decora (1710862) | about 3 years ago | (#35831122)

chmod is a unix command to modify file permissions.
android is based on unix(linux).
the android chmod doesnt work properly.

Re:im going to take away your unix card (1)

Jeremiah Cornelius (137) | about 3 years ago | (#35831256)

I know both of these things - I first used chmod about 1981.

The sentence doesn't make sense.

Re:im going to take away your unix card (1)

CCarrot (1562079) | about 3 years ago | (#35833502)

I know both of these things - I first used chmod about 1981.

The sentence doesn't make sense.

How about replacing "half a wrong chmod" with "a half-assed implementation of chmod". Better?

I agree, the description in the summary is goofed.

Re:im going to take away your unix card (1)

Jeremiah Cornelius (137) | about 3 years ago | (#35834136)

I might be thick, but I'm not stupid. :-)

I think your explanation is beginning to help me figure this out. With arguments of 7,6,5, or 0 in three positions? I wondered if they meant someone stuck a wrong digit in a command - but that would still be a ridiculous way to say it.

its like half-wrong potato chips (1)

decora (1710862) | about 3 years ago | (#35835698)

half-wrong button holes, half-wrong tube socks.

i thought everyone knew what these meant!

Re:its like half-wrong potato chips (1)

Jeremiah Cornelius (137) | about 3 years ago | (#35835992)

Half-wrong button holes?

Is that when you have part of a petunia on your lapel, when the rest of the swells at Epsom are sporting gardenias?

Re:I wonder... (1)

ThePangolino (1756190) | about 3 years ago | (#35830464)

The problem here is not with the app store. Nor is it with Skype's developers ability to produce neat code as one may think. In this case the problem is just some Anonymous Coward's troll attempt.

Re:I wonder... (4, Interesting)

h4rr4r (612664) | about 3 years ago | (#35830484)

Trading liberty for safety, is that what you are suggesting?

Re:I wonder... (0)

Anonymous Coward | about 3 years ago | (#35830624)

No, more like trading a "feature" that is not really a feature for 99% of users for a more secure app store that has far more commercial support than Android especially when it comes to games, multimedia, etc.

Re:I wonder... (1)

h4rr4r (612664) | about 3 years ago | (#35830768)

I bet more than 1% of android users have some sort of emulator installed or other app that would not be approved on the app store. Flash is another good example. That sorta kills your 99% number.

Re:I wonder... (1)

node 3 (115640) | about 3 years ago | (#35850716)

Doubtful. But also mostly irrelevant. There's no way even 10% of Android users have an emulator installed (emulators are allowed in the App Store, btw), and out of all reasonably potential customers, the 99% number is quite reasonable.

Anyway, even if it's 90%, the point is still valid.

Re:I wonder... (1)

MightyYar (622222) | about 3 years ago | (#35830696)

Trading liberty for safety

LOL, I don't think Ben Franklin was talking about toys.

Re:I wonder... (1)

h4rr4r (612664) | about 3 years ago | (#35830794)

Maybe you use it as a toy, some of us do real work on these devices. I doubt Ben would have been a huge fan of people not being able to use tools they bought.

Re:I wonder... (1)

MobileTatsu-NJG (946591) | about 3 years ago | (#35830852)

Maybe you use it as a toy, some of us do real work on these devices.

Then you value not spewing your business's data to strangers, right?

Re:I wonder... (1)

h4rr4r (612664) | about 3 years ago | (#35830896)

When did I say business data was on the phone?

I do not use skype, and frankly would rather go without a smartphone than have one I cannot control.

Re:I wonder... (1)

MobileTatsu-NJG (946591) | about 3 years ago | (#35830932)

When did I say business data was on the phone?

I must have misunderstood "doing real work" on your phone, my apologies.

Re:I wonder... (1)

h4rr4r (612664) | about 3 years ago | (#35831178)

My real work involves tools like ssh, the data stays on the servers bucko.

Re:I wonder... (1)

MobileTatsu-NJG (946591) | about 3 years ago | (#35831348)

My real work involves tools like ssh, the data stays on the servers bucko.

And this whole thing isn't giving you pause for thought at all?

Re:I wonder... (1)

h4rr4r (612664) | about 3 years ago | (#35831932)

Considering this is about data on the SD card and I don't keep keys there, no it does not.

Re:I wonder... (1)

MightyYar (622222) | about 3 years ago | (#35834414)

some of us do real work on these devices

Okay, I've seen "Odd Jobs". Some people have weird jobs and I don't doubt your claims that you get work done on a toy. Some people make money setting up model railroads, too. But for most, I still stand by my assertion that it's a toy. It is certainly designed as a toy. That you can use it as a tool is great, and yeah, for you maybe Ben's advice holds. For the other 99.999% of the smartphone buying public, applying Franklin's statement is very inappropriate.

As an aside, Ben never got to see microelectronics or mass production. Ben lived in the day where a reasonably educated elite could have a firm grasp of every single scientific book published at the time. It was almost an expectation in some circles. Of course Ben wouldn't be "a huge fan" of people not being to use tools they bought... in his day, anyone could learn to build or alter the tool.

Re:I wonder... (1)

node 3 (115640) | about 3 years ago | (#35850688)

Liberty? Apple isn't a government. You don't sign away any rights to them. Things like iPhones and iPads let you do *more* with them than you could do without them. How does liberty come into play at all?

Re:I wonder... (1)

nitroscen (811508) | about 3 years ago | (#35830526)

With all the grief slashdot gives the Apple App Store, when was the last time anyone read about a malicious or flawed app leaking personal information.

Would this really have been more detectable with Apple's approval process? It's been a while, but I've heard of apps getting passed Apple's approval process that should not have - apps that had hidden functionality even. Flaws like this probably get overlooked all the time. In fact, Android may have an advantage here. I don't know how iOs apps communicate with each other, but Android apps are sand-boxed with very specific ways they have to communicate. I'm out of date on my iOs information, though. I'd love to hear comments from some iOs developers.

This flaw not possible in iOS (1)

SuperKendall (25149) | about 3 years ago | (#35830776)

Would this really have been more detectable with Apple's approval process?

No, because a permission based flaw is not possible in IOS, the directory your application goes into is not readable by other applications. It's not something the app sets up, but the system.

However I'm not convinced this is a flaw in Android either, I thought it sandboxed apps in the same way.

A potential flaw that may still exist in Android is if you have apps installed on external storage like an SD card - then I am not sure if the contents are really sandboxed.

Re:This flaw not possible in iOS (3, Informative)

nschubach (922175) | about 3 years ago | (#35830798)

If they store data on the small internal memory it's supposed to be private and only readable by a single app, but if you put the app on the SD card Google considers that data public:
"The SD card system is intended to be a shared resource that all apps can access. The functionality you described is the purpose of internal (app private) storage."
http://code.google.com/p/android/issues/detail?id=16019 [google.com]

Which, of course, I think is poor security-wise... so feel free to add your own comments and star that if you think the same. ;)

It doesn't help that Google considers user settable security "would vastly increase the complexity associated with writing applications"
http://code.google.com/p/android/issues/detail?id=3778#c44 [google.com]

Re:This flaw not possible in iOS (1)

SuperKendall (25149) | about 3 years ago | (#35831152)

"The SD card system is intended to be a shared resource that all apps can access. The functionality you described is the purpose of internal (app private) storage."

That's what I thought although I kept hoping it was not true. That to me seems like a huge, huge oversight since there are many Android devices that basically force you to install apps on external media. It's only a matter of time before you start to see cross-app attacks where code infects other apps, or pulls what should be private data from them. I wonder how much stuff Android banking apps store locally... at least most of that would probably be encrypted. With a key the app held that could also be looked up.

Re:This flaw not possible in iOS (1)

Spykk (823586) | about 3 years ago | (#35831474)

Which, of course, I think is poor security-wise... so feel free to add your own comments and star that if you think the same. ;)

Removable media generally uses FAT for portability. How exactly do you intend to store permissions information? What happens when you put your SD card in your computer and copy some files to it?

Re:This flaw not possible in iOS (1)

nschubach (922175) | about 3 years ago | (#35832672)

You don't have to store permissions information on the file system. Just create a symlink in the internal storage to the appdata folder on the SD Card. Heck, you could call the directory /external and when the dev needs to save something on the SD card they just save it to 'external' which would symlink to /sdcard/data/appname If the user ever decides to change where the app stores it's data, update the symlink.

The developer would then only have to do:
FileWriter f = new FileWriter("external/myFile.txt"); // ...that would create the file on the SD Card.

Re:This flaw not possible in iOS (1)

adolf (21054) | about 3 years ago | (#35838240)

Removable media generally uses FAT for portability. How exactly do you intend to store permissions information?

UMSDOS [wikipedia.org] .

What happens when you put your SD card in your computer and copy some files to it?

Is this a trick question?

Re:This flaw not possible in iOS (1)

jrumney (197329) | about 3 years ago | (#35852506)

Skype doesn't allow installing on the SD Card (at least the version I tried and promptly uninstalled a few months ago due to it being a resource hog and a battery drain), so even if your hypothetical permission problem for apps installed on SD exists, I don't think it is the problem here. Skype seems to not really be written as an Android app, but as a native app with a thin Android wrapper. I suspect that is the real problem - the install asks for a bunch of permissions that the app should not really need, since the app has not been designed to fit into the Android sandbox from the start.

Why is this news? (1)

Anonymous Coward | about 3 years ago | (#35830400)

This just in, information written readable by other apps is readable by other apps!

Um... (0)

mysidia (191772) | about 3 years ago | (#35830442)

That allows another potentially malicious app to know everything about you that Skype knows (contacts, history of whatever you've chatted about or who you called,

News flash. Malicious apps are not constrained by file permissions.

If your device is pwn3d by an app, nothing Skype does can really protect you.

How come there wasn't an article about how Windows PCs can leak data to malicious applications? The same flaw exists in Skype for Windows. Nothing stops KeyloggerXP (or whatever) from gathering all info entered into the PC that it wants, and all files in the user's profile are (of course) owned by the same user, including the skype files, and malicious apps can change file permissions anyways, and defeat other security (by way of privilege escalation).

Seems like phones more secure than desktops (0)

Anonymous Coward | about 3 years ago | (#35834216)

On a desktop OS (be it Win or Linux), every app can read any data belonging to any other app... you just get protection between users.
And I have not heard many people complaining about it.

While I give kudos to Android for allowing for greater isolation, is it really needed?

Igor

Re:Seems like phones more secure than desktops (1)

praxis (19962) | about 3 years ago | (#35834542)

That depends on what you mean by the phrase "data belonging to any other app".

You haven't heard people complaining about it because most programs have gotten pretty good at storing user data in non-world-readable directories. The mentality is finally becoming a bit more mainstream that "apps" store user data in the user's non-world-readable folder. When they deviate, people start to take notice. Contrast this with 10 years ago where on Windows--while such protections were available--they required knowledgeable configuration and many "apps" were written with assumptions that such protections were not exercised and could not run in sanely configured environments.

So, these days, on the desktop most "apps" can read "data belonging to any other app", but no one complains or cares because the data they *do* care about is stored in a location with more sane access controls. When "apps" deviate these days, they generally get called out on it.

Phew (3, Funny)

tripleevenfall (1990004) | about 3 years ago | (#35830462)

I'm glad I have an android phone, lord knows I couldn't deal with those insecure iphones and blackberries ;)

I don't think anyone ever claimed BB was insecure (2)

Sycraft-fu (314770) | about 3 years ago | (#35830564)

In fact that is one of the major selling points, they really put security at the top of the list. Extremely fine grained per app access controls, FIPS compliant encryption, secure wiping and so on. There is little to criticize in that regard, and is one of the reasons the US government loves the things so much (seriously, find a government agency that doesn't use Blackberries for all their employees).

Re:I don't think anyone ever claimed BB was insecu (2)

h4rr4r (612664) | about 3 years ago | (#35830746)

And they let tinpot dictators read your texts and IMs.

Oh wait, that sounds not that good on second though.

Re:I don't think anyone ever claimed BB was insecu (1)

lgw (121541) | about 3 years ago | (#35831920)

Yes, that's probably another reason governments like these things - well spotted!

Re:I don't think anyone ever claimed BB was insecu (0)

Anonymous Coward | about 3 years ago | (#35845746)

Yes, various middle eastern governments can securely monitor all your traffic. And the only thing different from the western governments is that they're admit they're doing it.

Re:Phew (0)

Anonymous Coward | about 3 years ago | (#35831082)

This is by far the biggest problem facing Android. Openness is a double edged sword.

I hear they are working on encryption but good grief, a lot of this stuff should have been done in Android 1.0

Re:Phew (3, Insightful)

JustinCaseAP (2042248) | about 3 years ago | (#35831184)

Why does it have anything to do with the OS? The app developer more or less "chose" to share information, even if they did not do it on purpose. No reason proper permissions nor encryption could not of been used.

Re:Phew (0)

Anonymous Coward | about 3 years ago | (#35831776)

Most mobile OS's segregate applications by default and it requires much more work on the part of the developer if they want to break that.

Android on the other hand works more like a desktop OS, leaving most of the security details up to the developer. Not the greatest model to use with embedded mobile systems and a practically wide open app store.

I mean I love my Android based phone because I like hacking on it but I don't consider it very secure at this point in time.

Re:Phew (1)

bonch (38532) | about 3 years ago | (#35836614)

It has to do with the ecosystem built on the OS; in other words, the lack of strict quality control.

Re:Phew (1)

markkezner (1209776) | about 3 years ago | (#35832402)

You're blaming a flaw in a particular application on the OS. If this was a problem with the OS, wouldn't all apps that use SQLite be exposing their data?

Something looks a little fishy here (3, Informative)

bl8n8r (649187) | about 3 years ago | (#35830476)

# ls -l /data/data/com.skype.merlin_mecha/files/jcaseap

The dude is in as root (via adb shell?).  note the '#'.  I guess he's still got a point about 666 on private files.  As long as you have execute perms on the directory, you can read files tagged o+r.

Someone can't read (3, Informative)

JustinCaseAP (2042248) | about 3 years ago | (#35831148)

I'm that dude, and the POC doesn't use root. It has app level UID. I was showing the permissions with a root shell, because that is what I have adbD running as on my daily phone.

Re:Someone can't read (0)

Anonymous Coward | about 3 years ago | (#35837520)

Why would anyone install your POC app without you providing source for it?

Also, encryption is useless if the user has decided to root their phone. It's only a superficial defense.

Re:Something looks a little fishy here (1)

GweeDo (127172) | about 3 years ago | (#35832456)

Yes, in his example at the bottom he is using a root shell, but the application (which is shown in the video) isn't running as root.

Skype permissions (3, Insightful)

Anonymous Coward | about 3 years ago | (#35830504)

When you open Skype in the android market, it requests a skyscraper-high list of special permissions. When I saw that, I immediately decided to forget about it. There's no way that it could possibly need that much information to do its job, and now it looks like its even worse that I thought. Sucks that it leaks info like that, but kudos to Google for at least making the risk somewhat visible.

Hang on (0)

Anonymous Coward | about 3 years ago | (#35830524)

I'm not Android expert, but I thought each application was given their own UID and could only see their own directory. Is that not the case?

Re:Hang on (2)

geminidomino (614729) | about 3 years ago | (#35830656)

Not when the file perms are 666 (read/write by user, group, and everyone).

Re:Hang on (2)

alostpacket (1972110) | about 3 years ago | (#35831128)

Which is also not the default, Skype set them this way on purpose. According to a comment in TFA, they use some native libraries to access those DBs that run under a different user than the app does because they are trying to obsfucate the Skype protocol. I'm not sure how true all that it but it seems logical/feasible enough.

Re:Hang on (1)

CharlyFoxtrot (1607527) | about 3 years ago | (#35831242)

Which is also not the default, Skype set them this way on purpose. According to a comment in TFA, they use some native libraries to access those DBs that run under a different user than the app does because they are trying to obsfucate the Skype protocol. I'm not sure how true all that it but it seems logical/feasible enough.

Sounds like the sort of behavior that would cause Apple to exclude it from their AppStore. Of course, that would be evil, right ?

This is completely wrong (0, Troll)

madradioctiverat (2041862) | about 3 years ago | (#35830594)

To read a subdirectory under /data/ you need exec premissions [goo.gl] on /data, but you don't have them. He was using root shell, thus the story is moot.

Re:This is completely wrong (1)

Desler (1608317) | about 3 years ago | (#35830642)

You can't actually expect the Slashdot editors to actually know enough to filter out these crap stories, right? What's more important is that it has a catchy headline and thus will drive page and ad clicks!

Re:This is completely wrong (1)

CharlyFoxtrot (1607527) | about 3 years ago | (#35831270)

You can't actually expect the Slashdot users to actually know enough not to respond to a goatse troll, right ?

Re:This is completely wrong (1, Informative)

JustinCaseAP (2042248) | about 3 years ago | (#35830842)

To read a subdirectory under /data/ you need exec premissions [goo.gl] on /data, but you don't have them. He was using root shell, thus the story is moot.

Being the OP of the article, you are completely wrong. I had no problem reproducing it on stock, unrooted phones. Research, then comment. Test it? Still doubt? Once its fixed I will release source.

Really Annoying on Verizon (1)

Is0m0rph (819726) | about 3 years ago | (#35831084)

I don't even want Skype on my phone (LG Ally) but Verizon forces it on you along with a bunch of other crap (CityID, etc.) you can't make them not run at boot up, can't uninstall them, can't move them to the SD, etc. You can kill them with a task killer or manage apps but they start back up.

Re:Really Annoying on Verizon (1)

h4rr4r (612664) | about 3 years ago | (#35831230)

Sure you can remove them. Root it and use titanium backup to remove the apps.

Re:Really Annoying on Verizon (0)

Anonymous Coward | about 3 years ago | (#35831372)

Great...except what if your phone can't be rooted. Some of the Android phones are getting some pretty crazy lockdown and it continues to become more difficult to root those phones. (I personally will be looking to make sure I CAN root my phone before I buy my next one.)

Re:Really Annoying on Verizon (1)

h4rr4r (612664) | about 3 years ago | (#35831666)

You answered your own question already it looks like. All phones can currently be rooted. Replacing the kernel on some phones is not possible, but you can always make an kernel module so that you can chainload another kernel. Replacing the kernel is not needed to gain root, only for custom roms.

Re:Really Annoying on Verizon (1)

Is0m0rph (819726) | about 3 years ago | (#35860840)

I will definitely do that after the warranty is through. The LG Ally can be rooted easily and use new kernels but unfortunately they also seem to break frequently. I'm on phone #3 and my wife's is on #3. Rebooting issues and the ear piece going out seem to be frequent issues.

it just plain sucks (0)

Anonymous Coward | about 3 years ago | (#35831214)

twice I tried to use it for a conference call and the app was so bad it made me wonder why it was even released. Crashes, sporadically refuses to let me answer calls,... so never mind it being insecure, it just plain sucks.

Oh noes! Linux has the same bug! (0)

Anonymous Coward | about 3 years ago | (#35831750)

Holy shit, you guys, I just checked the source code for Linux and it turns out that files with read permission set can also be accessed by anybody there. Somebody better fix this bug fast!
Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...