Members
Stats
  • Total Posts: 43374
  • Total Topics: 16478
  • Online today: 2103
  • Online ever: 51419
  • (01. January 2010., 10:27:49)
Users Online
Users: 5
Guests: 1716
Total: 1721









Author Topic: Suspicious Apps on Google Play Leak Google Account IDs  (Read 3636 times)

0 Members and 1 Guest are viewing this topic.

Pez

  • SCF VIP Member
  • *****
  • Posts: 776
  • KARMA: 117
  • Gender: Male
  • Pez
Suspicious Apps on Google Play Leak Google Account IDs
« on: 16. December 2013., 12:37:23 »
Suspicious Apps on Google Play Leak Google Account IDs

The Google account ID (or account name), which in most cases is a Gmail address, is one of the key identifiers of Android device users. McAfee has confirmed a substantial amount of suspicious apps secretly collect Google account IDs on Google Play. In these cases, the corresponding Google account password is not collected, but leaking only IDs still poses a certain level of security and privacy risk.

Two particular apps, one a dating service app and the other a fortune app, retrieve Google account IDs and send them to their web server just after they launch and without prior notice to users. The total number of download of each app is between 10,000 and 50,000. McAfee Mobile Security detects these apps as Android/ChatLeaker.D.



These two suspicious apps leak Google account IDs.

Another set of suspicious apps, from various categories, shown in the figure below secretly send a device’s Google account ID, IMEI, and IMSI to a single, shared remote web server just after launch and without any prior notice. The aggregate download count of this set of apps amounts to at least several million, probably because they are localized for many languages. It appears the main targets are Japanese users. We detect these apps as Android/GaLeaker.A and its variants.



More than 30 suspicious apps leak Google account IDs, IMEI, and IMSI


We have not confirmed why the app developers secretly collect Google account IDs, or how they use them and how they manage the data securely. And we have not so far observed any malicious activities based on the stolen data. But at least these apps should notify users of the collection and of the intended use of their data–and give them opportunity to decline the data transfer.

Android apps can retrieve Google account IDs with GET_ACCOUNTS permission granted at installation and by using one of the methods of the AccountManager class. This permission is often requested when an app uses the Google Cloud Messaging feature, which is a standard mechanism provided by Google to allow server-to-device push notification. As such, users cannot judge if granting this permission is really safe; some apps request this permission for GCM, but others for collecting account information for potentially malicious purposes.



A GET_ACCOUNTS permission request.


Although the account passwords cannot be retrieved in this case, leaking only account IDs still creates several types of risks.
  • Attackers can share account IDs with other malicious parties including email address collectors.
  • Attackers can directly send spam/scam emails to the address.
  • Attackers can break passwords and illegally access accounts if users employ easy-to-guess passwords.
  • Attackers can identify a user’s personal information on social networking services related to Google account IDs, for example, Google+.

Users should be especially careful about registering SNS/communication services using a Gmail address with services that encourage users to be searchable by their email addresses. If users have enabled the feature and make their profiles public, which is the default on many services, an attacker can easily identify personal information using the email address as a search key.



A User’s real name is suggested based using the Gmail address as a search key.


With the GET_ACCOUNTS permission granted, Android apps can also retrieve account names for services other than Google that have been registered in the device, including Facebook, Twitter, LinkedIn, Tumblr, WhatsApp, and so on. Users will face these same issues once these other account names are stolen.



Account names for various services can be easily retrieved.


We strongly recommend that users review the privacy settings on all the services they employ and disable the “allow search by email address” option unless they really want it. Users should also not expose their account names in public unless it is necessary.


Original article: By Daisuke Nakajima on Dec 16, 2013
Their is two easy way to configure a system!
Every thing open and every thing closed.
Every thing else is more or less complex.

Start Turfing ! http://scforum.info/index.php/topic,8405.msg21475.html#msg21475

Samker's Computer Forum - SCforum.info

Suspicious Apps on Google Play Leak Google Account IDs
« on: 16. December 2013., 12:37:23 »

Samker

  • SCF Administrator
  • *****
  • Posts: 7529
  • KARMA: 322
  • Gender: Male
  • Whatever doesn't kill us makes us stronger.
    • SCforum.info - Samker's Computer Forum
Re: Suspicious Apps on Google Play Leak Google Account IDs
« Reply #1 on: 16. December 2013., 17:49:56 »

The Google account ID (or account name), which in most cases is a Gmail address, is one of the key identifiers of Android device users. McAfee has confirmed a substantial amount of suspicious apps secretly collect Google account IDs on Google Play. In these cases, the corresponding Google account password is not collected, but leaking only IDs still poses a certain level of security and privacy risk.

...

We have not confirmed why the app developers secretly collect Google account IDs, or how they use them and how they manage the data securely. And we have not so far observed any malicious activities based on the stolen data. But at least these apps should notify users of the collection and of the intended use of their data–and give them opportunity to decline the data transfer.

...


IMO, they "only" want to Spam them...  ;)

Thanks P.

Samker's Computer Forum - SCforum.info

Re: Suspicious Apps on Google Play Leak Google Account IDs
« Reply #1 on: 16. December 2013., 17:49:56 »

 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Kursevi kodiranja za ucenike u Sarajevu

Terms of Use | Privacy Policy | Advertising
TinyPortal 2.3.1 © 2005-2023