Database Info

Question about android security

So i am just wondering, there are so much different apps for android on the market, and most of them has a lot of access to phone's functions. Now for example i am always logged in to Gmail, and theoretically can a random app scan and copy my gmail's data and send it trough internet? Really curious..

Kblavkalash said:
Now for example i am always logged in to Gmail, and theoretically can a random app scan and copy my gmail's data and send it trough internet? Really curious..
Click to expand...
Click to collapse
This question is not really an issue of Android security this is a question about general security. Can an app look at your gmail app directly and copy data and send it out...not exactly no, an app can't forcibly connect itself to another app to scan data.
However...
That question is actually not relevant because such a task is unnecessary for malicious apps. Lets say you install a malicious app that wants to copy your gmail data. What it will do is not watch the app itself but it will watch the network packets being sent to and from the app, logging and tracking those.
This is not the only way to get the data though because any data saved on your sdcard is accessible from an app if you give it permission to do so.
The MOST important thing to look at when installing an app is the permissions the app is requesting when it installs. This can be confusing as well because some apps will request full internet access because they need it but this can also be used by a malicious app to steal your data.
The important thing to do is research. The more you learn about the app the better off you are.
-------
Just to clarify, this applies to all apps of any kind on any platform including but not limited to Android, iPhones, Blackberry, Windows Phone, WebOS, Windows PC, Mac OSX, Linux or etc. - ALWAYS learn as much as you can and are comfortable with before installing anything...if you are not comfortable with a particular app or learning more about it then don't install it. That is not to say it may be malicous, it is just to say it could be a bad idea for other reasons. (for example, if it is a developer tool or a configuration tool that you don't understand or haven't researched enough to understand...then you could potentially damage your device with something that is a legitimate tool)

Kblavkalash said:
So i am just wondering, there are so much different apps for android on the market, and most of them has a lot of access to phone's functions. Now for example i am always logged in to Gmail, and theoretically can a random app scan and copy my gmail's data and send it trough internet? Really curious..
Click to expand...
Click to collapse
edit

MichaelTunnell said:
This question is not really an issue of Android security this is a question about general security. Can an app look at your gmail app directly and copy data and send it out...not exactly no, an app can't forcibly connect itself to another app to scan data.
However...
That question is actually not relevant because such a task is unnecessary for malicious apps. Lets say you install a malicious app that wants to copy your gmail data. What it will do is not watch the app itself but it will watch the network packets being sent to and from the app, logging and tracking those.
This is not the only way to get the data though because any data saved on your sdcard is accessible from an app if you give it permission to do so.
The MOST important thing to look at when installing an app is the permissions the app is requesting when it installs. This can be confusing as well because some apps will request full internet access because they need it but this can also be used by a malicious app to steal your data.
The important thing to do is research. The more you learn about the app the better off you are.
-------
Just to clarify, this applies to all apps of any kind on any platform including but not limited to Android, iPhones, Blackberry, Windows Phone, WebOS, Windows PC, Mac OSX, Linux or etc. - ALWAYS learn as much as you can and are comfortable with before installing anything...if you are not comfortable with a particular app or learning more about it then don't install it. That is not to say it may be malicous, it is just to say it could be a bad idea for other reasons. (for example, if it is a developer tool or a configuration tool that you don't understand or haven't researched enough to understand...then you could potentially damage your device with something that is a legitimate tool)
Click to expand...
Click to collapse
Good answer, you are right!, but you say do a research before installing, but it's not really possible unless you are a programmer and checking whole code The best rated apps still have many different permission requirement and i have no idea what they are doing.
For example app can request a new password change for example on paypal and steal packets which come to my gmail about new password.^^

Security Apps
Hi,
in my eyes the best way is to use programs like PDroid. You cann adjist the rights of every App regarding send SMS for example.
LBE Privacy Guard may be also an Option. (runs not on my Device - SGS+)
(i use Pdroid 2.0)
you should also read the comments in the store, and the needed rights from the app before install. The best Apps to trust are open source apps.

Kblavkalash said:
Good answer, you are right!, but you say do a research before installing, but it's not really possible unless you are a programmer and checking whole code The best rated apps still have many different permission requirement and i have no idea what they are doing.
For example app can request a new password change for example on paypal and steal packets which come to my gmail about new password.^^
Click to expand...
Click to collapse
Research generally involves a Google search...
Editor's Choice in the market are safe bets, you know, the blue icon.
But then there are the millions of other apps, and frankly, I tend to toe the app name plus xda for instance, Google will show you xda threads about the app, if the posts are normal, you can be sure it's not malicious.
Stuff like that...
Also, fake market comments are really easy to spot and are a dead giveaway
Sent from my GT-I9000 using xda premium

cyanogenmod security and google spyware?

What is different in security for cyanogenmod and normal android?
Is cyanogenmod has google spyware?
Thank you

arexium said:
What is different in security for cyanogenmod and normal android?
Is cyanogenmod has google spyware?
Thank you
Click to expand...
Click to collapse
No, cyanogenmod does not have google apps. For more info: http://wiki.cyanogenmod.org/w/Google_Apps
Even if they don't use google apps, they have their own spyware. For more how to secure your device see this: http://forum.xda-developers.com/general/security/tuto-how-to-secure-phone-t2960077

setmov said:
No, cyanogenmod does not have google apps. For more info: http://wiki.cyanogenmod.org/w/Google_Apps
Even if they don't use google apps, they have their own spyware. For more how to secure your device see this: http://forum.xda-developers.com/general/security/tuto-how-to-secure-phone-t2960077
Click to expand...
Click to collapse
This hard for apply and may be not work for my phone
You know easy way?
You thinks not use smart phone and also not use android better?
Only normal phone and for internet only use computer?
Different idea, if you have only text secure app on phone and cyanogenmod how they spy and see message?
Thank you

arexium said:
This hard for apply and may be not work for my phone
You know easy way?
You thinks not use smart phone and also not use android better?
Only normal phone and for internet only use computer?
Different idea, if you have only text secure app on phone and cyanogenmod how they spy and see message?
Thank you
Click to expand...
Click to collapse
I suggest you take a look here: http://forum.xda-developers.com/showthread.php?t=2550769

setmov said:
I suggest you take a look here: http://forum.xda-developers.com/showthread.php?t=2550769
Click to expand...
Click to collapse
This good, I check it
What you think this one please, Replicant OS?

arexium said:
This good, I check it
What you think this one please, Replicant OS?
Click to expand...
Click to collapse
What phone do you have?

setmov said:
What phone do you have?
Click to expand...
Click to collapse
This lenovo a5000
What you think Replicant OS, good one? I changes phone if this good one

arexium said:
This lenovo a5000
What you think Replicant OS, good one? I changes phone if this good one
Click to expand...
Click to collapse
Honestly I haven't tried it, so I don't know. But, what are you looking for? A secure rom, or just a rom without google apps?

setmov said:
Honestly I haven't tried it, so I don't know. But, what are you looking for? A secure rom, or just a rom without google apps?
Click to expand...
Click to collapse
Yes I want secure ROM even if not work on my phone, I can change phone

arexium said:
Yes I want secure ROM even if not work on my phone, I can change phone
Click to expand...
Click to collapse
Then, I suggest you to be patient. There will be some news soon.

try AFWall Donate version, XPrivacy, AppOps, MyAndroidTools Pro, ChatSecure, Orbot, Network Connections or Network Log App in playstore, override DNS app, SD Maid, Firefox browser...these are all good apps known for supporting end-user privacy or for strong root level management of your system. It really depends on what type of "secure" youre interested in. Android is relatively secure security-wise, but privacy-wise, not so much... actually in its default state, not at all, especially with google inside. Knowing your settings, and config, almost any ROM can be secure.

arexium said:
Yes I want secure ROM even if not work on my phone, I can change phone
Click to expand...
Click to collapse
If you are willing to switch to a Nexus 5 we (Graphite Software) have posted a ROM (Secure Spaces) that allows you to create a separate space (virtual phone) where you can easily configure the settings (enable and disable a number of attributes - bluetooth , networking, adb, etc). Also you can remove the Google Play apps in this personal or hidden space, but allow the owner space to still have Google Apps if you want. This new space is encrypted using ecryptfs and also has pid namespaces enabled in the kernel, plus some additional security features. You can push apps into this space to limit their access to the owner space , or you can think of this space as a private space where maybe you launch only a banking app for example.

ElwOOd_CbGp said:
try AFWall Donate version, XPrivacy, AppOps, MyAndroidTools Pro, ChatSecure, Orbot, Network Connections or Network Log App in playstore, override DNS app, SD Maid, Firefox browser...these are all good apps known for supporting end-user privacy or for strong root level management of your system. It really depends on what type of "secure" youre interested in. Android is relatively secure security-wise, but privacy-wise, not so much... actually in its default state, not at all, especially with google inside. Knowing your settings, and config, almost any ROM can be secure.
Click to expand...
Click to collapse
Sounds like a good start to helping secure my android, but how do you use the apps effectively?
Thanks

talkcc144 said:
Sounds like a good start to helping secure my android, but how do you use the apps effectively?
Thanks
Click to expand...
Click to collapse
All I can say is do what I did. Check them out. Read, follow instructions, experiment. Android may come shipped with some functionalities disabled but the capability is there...in a major way. You just have to take the time to learn. Familiarize yourself with settings, apps, services, device signals.

App uid sharing is a security risk.

Most things that restrict actions in Android use the applications uuid to identity it.
UUID is an immutable representation of a 128-bit universally unique identifier (UUID).
However recently I installed firefox and firefox beta..
Both share the same uuid..
And when I installed firefox beta. It gained all the rights and permissions and internet access that firefox had..
Both applications are installed on my device both run separately
But I cannot secure one with out the other getting the same security access.
If you look at system files many of them have the same uuid
That is a huge security issue with Android..
Is there a way to assign a new uuid to a application
Even if you have to rebuild the apk?
(Almost everything I have is open-source so I can build it from scratch if required)

In android, apps can share the UUID by declaring it in the manifest:
android:sharedUserId
The name of a Linux user ID that will be shared with other applications. By default, Android assigns each application its own unique user ID. However, if this attribute is set to the same value for two or more applications, they will all share the same ID — provided that they are also signed by the same certificate. Application with the same user ID can access each other's data and, if desired, run in the same process.
So if you just resign the APK with a different certificate (you can quickly generate one) they won't share the same ID anymore (because you don't have the mozilla certificate)

And FYI, it is not a security issue. In fact, it is an added security measure. Because apps that need to communicate with each other can share the same memory space and filesystem. The security is based on the signature of the app. So it is as strong as your ability to not leak the certificate

h4oxer said:
And FYI, it is not a security issue. In fact, it is an added security measure. Because apps that need to communicate with each other can share the same memory space and filesystem. The security is based on the signature of the app. So it is as strong as your ability to not leak the certificate
Click to expand...
Click to collapse
Except that many apps can be installed under the same id number.
If they where given a completely unique number for every app installed then I would agree
But that is not the case.
Multiple apps with the same id is just bad security
It's like giving two different people the same identification because they share an office.
I will look into resigning some apks and see what I can find.
Thank you for the info.

nutpants said:
Except that many apps can be installed under the same id number.
If they where given a completely unique number for every app installed then I would agree
But that is not the case.
Multiple apps with the same id is just bad security
It's like giving two different people the same identification because they share an office.
I will look into resigning some apks and see what I can find.
Thank you for the info.
Click to expand...
Click to collapse
Signatures have nothing to do with uid. If you have the same app with a different signature, you will simply not be able to install them together. Uid has to do with app's internal name like com.xxx. Apps with the same internal name will always have the same uid (like firefox stable and beta) and different apps will always have different uid, except for some system apps that come from os makers, which is true for many, if not all os. A third party app will never have any of the system app uid. So, there is no security issue at all.

ukanth talked about the android:sharedUserId attribute.
Android's documentation says that apps have to be signed by the same certificate.
Having the same package name (or a similar one) is not mandatory to share the same UID (example: dev tools & fused location).

Firefox and firefox beta..
Two similar apps
Same uid last time I installed both..
So a unscrupulous developer could create a separate app with separate functions with the same uid and if you installed it where would you be?
And god knows that no one ever has an issue with developers creating unscrupulous apps that try to get data from your device.

nutpants said:
So a unscrupulous developer could create a separate app with separate functions with the same uid and if you installed it where would you be?
Click to expand...
Click to collapse
He could only do that if both apps were his, and if both apps were his, he doesn't gain access to anything that he didn't already have access to.

nutpants said:
Firefox and firefox beta..
Two similar apps
Same uid last time I installed both..
So a unscrupulous developer could create a separate app with separate functions with the same uid and if you installed it where would you be?
And god knows that no one ever has an issue with developers creating unscrupulous apps that try to get data from your device.
Click to expand...
Click to collapse
Your scenario is impossible. Firefox can only obtain permission from another firefox and both must be made by the same developer. And Firefox cannot get permissions from apps made by others.

optimumpro said:
Your scenario is impossible. Firefox can only obtain permission from another firefox and both must be made by the same developer. And Firefox cannot get permissions from apps made by others.
Click to expand...
Click to collapse
Firefox is an example.
But a similar situation could come from any developer.
Develop one good popular app
And one data mining, soul stripping life stealing app with the same uid and maybe even a hidden icon..
Personally I give apps only the access the need. Not what they ask for.
With marshmallow everyone can restrict information
But you can not when two apps share the same uid.
For example Firefox stable had no serious privacy holes
Firefox beta could. It's beta.
Two apps one uid..
Bad idea..

nutpants said:
Firefox is an example.
But a similar situation could come from any developer.
Develop one good popular app
And one data mining, soul stripping life stealing app with the same uid and maybe even a hidden icon..
Personally I give apps only the access the need. Not what they ask for.
With marshmallow everyone can restrict information
But you can not when two apps share the same uid.
For example Firefox stable had no serious privacy holes
Firefox beta could. It's beta.
Two apps one uid..
Bad idea..
Click to expand...
Click to collapse
"Develop one good popular app. And one data mining, soul stripping life stealing app with the same uid and maybe even a hidden icon."
But that doesn't make any sense. If there is another (bad) app by the same developer with the same com.name, it will install only on top of the good one and it will be a totally different app. By the way, beta firefox shouldn't have the same uid as stable (unless they, as a big developer, have a special arrangements with Google, so that their certificate is preinstalled, but you don't really think that firefox would need another app to steal your data, they can do it anyway). Also, what's the point of having both firefox beta and stable? It is bad for system. Firefox is known to stay in the background after you exit it, unless you literally kill it with a specially configured back button. So, now, you have 2 web browsers in the background.

optimumpro said:
"Develop one good popular app. And one data mining, soul stripping life stealing app with the same uid and maybe even a hidden icon."
But that doesn't make any sense. If there is another (bad) app by the same developer with the same com.name, it will install only on top of the good one and it will be a totally different app. By the way, beta firefox shouldn't have the same uid as stable (unless they, as a big developer, have a special arrangements with Google, so that their certificate is preinstalled, but you don't really think that firefox would need another app to steal your data, they can do it anyway). Also, what's the point of having both firefox beta and stable? It is bad for system. Firefox is known to stay in the background after you exit it, unless you literally kill it with a specially configured back button. So, now, you have 2 web browsers in the background.
Click to expand...
Click to collapse
Check out Firefox and firefox beta..
Different names, different app.Same developer, Same uuid
Both together on your device at the same time.
Unless there is something wrong with my nexus
You can get both from Google play and see for yourself.
Which means that any developer could do it.
The next question would be how secure is the app signing method. Can it be duplicated? Coerced ? Or just commandeered by the fbi on the off chance some one committed a crime that could support terrorism.
Uuid sharing bad idea.
How does Android assign the uuid to each app?
And yes I test beta apps to see if they have fixed bugs that are present in stable
I support open source every chance I can.

nutpants said:
Check out Firefox and firefox beta..
Different names, different app.Same developer, Same uuid
Both together on your device at the same time.
Unless there is something wrong with my nexus
You can get both from Google play and see for yourself.
Which means that any developer could do it.
The next question would be how secure is the app signing method. Can it be duplicated? Coerced ? Or just commandeered by the fbi on the off chance some one committed a crime that could support terrorism.
Uuid sharing bad idea.
How does Android assign the uuid to each app?
And yes I test beta apps to see if they have fixed bugs that are present in stable
I support open source every chance I can.
Click to expand...
Click to collapse
Signing process cannot be replicated. However, if you use Google services (including Googleplay), then it is possible to have Google sign a modified application to take over your phone, but this could be defeated completely by removing google services and google services framework and using roms and apps that you have compiled by yourself. Moreover, before compiling, you will have to re-generate all build keys (test key, platform key and media key). In this case, the only way to take control over your phone would be over the air through the operator's sim card and if that fails, then through the king of all - baseband/modem...

nutpants said:
Check out Firefox and firefox beta..
Different names, different app.Same developer, Same uuid
Both together on your device at the same time.
Unless there is something wrong with my nexus
You can get both from Google play and see for yourself.
Which means that any developer could do it.
The next question would be how secure is the app signing method. Can it be duplicated? Coerced ? Or just commandeered by the fbi on the off chance some one committed a crime that could support terrorism.
Uuid sharing bad idea.
How does Android assign the uuid to each app?
And yes I test beta apps to see if they have fixed bugs that are present in stable
I support open source every chance I can.
Click to expand...
Click to collapse
Just to clear the record: previously I said that signatures make no difference to uid. This was not entirely correct.
Signatures identify a unique developer. Package name/internal app name identify a unique application. The only way an app can get a shared uid is if it has the same signature, i.e., made by the same developer. In other words, an app cannot have a shared uid with an app by another developer.
Now, security: apps using a shared uid share data/database with each other; they also share the same permissions. This creates no additional security threat.
Your example of a dev creating a good app and then adding a bad/data stealing app that would have the same permissions as the good one. This absolutely makes no sense, as data stealing features could be easily implemented in the good app. In addition, the bad app cannot have higher level permissions than the good one.
If you, however, don't want to have shared uid for 3rd party apps, there is an easy way do that: all you need is to sign any third party app with your own signature, which will prompt android to assign a different uid.

optimumpro said:
If you, however, don't want to have shared uid for 3rd party apps, there is an easy way do that: all you need is to sign any third party app with your own signature, which will prompt android to assign a different uid.
Click to expand...
Click to collapse
So if I sign firefox beta, it will automatically have a different uuid,
What happens is I also sign the original Firefox also?
Will that cause the uuids to again be the same or will they both be different?
Can a apk be signed from an Android device?
Is there any other way to change how Android assigns uuids to apps?
(Ie force Android to assign new uuids to every app, extract the rom and change the uuids on the apks so every apk have a truly unique id (which I would expect form something called universal unique id)
Why would anyone ever want a uuid to be shared with another app (Even system apps)?
Thanks for the info btw..

nutpants said:
So if I sign firefox beta, it will automatically have a different uuid,
What happens is I also sign the original Firefox also?
Will that cause the uuids to again be the same or will they both be different?
Can a apk be signed from an Android device?
Is there any other way to change how Android assigns uuids to apps?
(Ie force Android to assign new uuids to every app, extract the rom and change the uuids on the apks so every apk have a truly unique id (which I would expect form something called universal unique id)
Why would anyone ever want a uuid to be shared with another app (Even system apps)?
Thanks for the info btw..
Click to expand...
Click to collapse
In order to have a shared uid, both apps must have that permission in their manifests. Having this benefits performance and minimizes space on the device. Since android apps run in a sandbox/virtual machine, you can imagine the slowdown if you have system apps with unique uids.
You shouldn't sign the other firefox with the same key , as you will defeat your purpose.
I am not aware of a procedure to sign the app on the device, however, you can search xda. You can certainly sign the app on linux or windows. You can also generate multiple keys for signing.

security app

Are security apps really necessary?
I tried CM security and AIO, however, both of them make my phone lagging.

cm good app

OnLuxy said:
Are security apps really necessary?
I tried CM security and AIO, however, both of them make my phone lagging.
Click to expand...
Click to collapse
If you are downloading tons of apps and visiting shady websites, absolutely. If you only use a handful of apps that don't require tons of permissions, you'll be OK. I don't use anything on my rooted S3.
Also, find a good browser that allows you to disable flash. I use one called Privacy Browser and I got it off FDroid. Not Play Store. Its lightweight on your system and basic. 80% of the websites I visit don't require flash to operate. But one click turns it on if I need it. It only needs a data connection and able to create shortcuts for permissions.
If you need an antivirus/malware app, I always recommend ESET NOD32. I've been using it on my home PC's for years. The definitions are constantly being updated and has saved me a few times. Its lightweight on your system too.

KernelCorn said:
If you are downloading tons of apps and visiting shady websites, absolutely. If you only use a handful of apps that don't require tons of permissions, you'll be OK. I don't use anything on my rooted S3.
Also, find a good browser that allows you to disable flash. I use one called Privacy Browser and I got it off FDroid. Not Play Store. Its lightweight on your system and basic. 80% of the websites I visit don't require flash to operate. But one click turns it on if I need it. It only needs a data connection and able to create shortcuts for permissions.
If you need an antivirus/malware app, I always recommend ESET NOD32. I've been using it on my home PC's for years. The definitions are constantly being updated and has saved me a few times. Its lightweight on your system too.
Click to expand...
Click to collapse
Thanks for your suggestion. I suppose I can go with ESET, I like explore new apps with my Samsung

OnLuxy said:
Are security apps really necessary?
I tried CM security and AIO, however, both of them make my phone lagging.
Click to expand...
Click to collapse
No especially if you are careful. Do not install crappy apps, use Firefox (bêta) + advanced mode of uBlock Origin, a firewall (+ additional security/privacy apps if you are rooted).

I don't want to update the app, thank.you

Hello everyone.
I'm writing today to see if anyone is willing to help a newbie out with this:
There is a certain app that I feel got ruined with its latest update, and I'd much rather stay with an older version.
Is there a way to tell the playstore to not offer me updates for that particular app anymore? I guess I could just ignore the notifications, but they bother my OCD.
I'm using an unrooted aosp phone under android 10, if it matters.
Best regards.

If you don't use wifi, disable it then set Playstore to only auto update by wifi.
I keep invasive Playwhore disabled except when I rarely needed it.
Use ApkExport to make an installable copy of that version of the apk, just in case.
APK Export (Backup & Share) - Apps on Google Play
Manage and extract your apps.
play.google.com

You can make the same application with different application name with AppCloner. It won't offer update like that.

dedq said:
You can make the same application with different application name with AppCloner. It won't offer update like that.
Click to expand...
Click to collapse
Can renaming allow you to easily run multiple versions of the same app?

blackhawk said:
Can renaming allow you to easily run multiple versions of the same app?
Click to expand...
Click to collapse
It can without any problems.