---------- Forwarded message ---------- From: Henry Baker <hbaker1@pipeline.com> Date: Fri, Mar 3, 2017 at 6:53 PM Subject: [Cryptography] Uber "Greyball"-ed city authorities w/fake screens To: cryptography@metzdowd.com FYI -- https://www.nytimes.com/2017/03/03/technology/uber-greyball-program-evade-au... 'To build a case against the company, officers ... posed as riders, opening the Uber app' 'Uber had tagged [the officer] ... based on data collected from [his/her] app ... The company then served up a fake version of the app populated with ghost cars' 'When Uber moved into a new city, [an Uber employee] ... would try to spot enforcement officers. One technique involved drawing a digital perimeter, or "geofence," around the government offices ... people were frequently opening and closing the app ... near such locations as evidence that [they] might be associated with city agencies. Other techniques included ... credit card information and determining whether the card was tied directly to an institution like a police credit union.' http://www.cultofmac.com/304401/ubers-android-app-literally-malware/ Uber's data-sucking Android app is dangerously close to malware [updated] By Buster Hein -- 11:22 am, November 26, 2014 Uber has been sideswiped by a ridiculous number of controversies lately, but things are about to get even worse for the ride-sharing service. A security researcher just reverse-engineered the code of Uber's Android app and made a startling discovery: It's "literally malware." Digging into the app's code, GironSec (http://www.gironsec.com/blog/2014/11/what-the-hell-uber-uncool-bro/) discovered the Uber app "calls home" and sends data back to Uber. This isn't typical app data, though. Uber has access to users' entire SMSLog even though the app never requests permission. It also accesses call history, Wi-Fi connections used, GPS locations and every type of device ID possible. The app even checks your neighbor's Wi-Fi and retrieves info on the router's capabilities, frequency and SSID. News of the app's vulnerability was first posted on Hacker News with the charming intro, "TLDR: Uber's Android app is literally malware." (https://news.ycombinator.com/item?id=8660336) One developer commenting on the revelation said there isn't "any reason for Google not to immediately remove this app from the store permanently and ban whatever developer uploaded it. There should probably be legal action." Here's the full list of all the data Uber is collecting through its Android app (we're checking to see if the iOS version works the same way): -- Accounts log (Email) -- App Activity (Name, PackageName, Process Number of activity, Processed id) -- App Data Usage (Cache size, code size, data size, name, package name) -- App Install (installed at, name, package name, unknown sources enabled, version code, version name) -- Battery (health, level, plugged, present, scale, status, technology, temperature, voltage) -- Device Info (board, brand, build version, cell number, device, device type, display, fingerprint, IP, MAC address, manufacturer, model, OS platform, product, SDK code, total disk space, unknown sources enabled) -- GPS (accuracy, altitude, latitude, longitude, provider, speed) -- MMS (from number, MMS at, MMS type, service number, to number) -- NetData (bytes received, bytes sent, connection type, interface type) -- PhoneCall (call duration, called at, from number, phone call type, to number) -- SMS (from number, service number, SMS at, SMS type, to number) -- TelephonyInfo (cell tower ID, cell tower latitude, cell tower longitude, IMEI, ISO country code, local area code, MEID, mobile country code, mobile network code, network name, network type, phone type, SIM serial number, SIM state, subscriber ID) -- WifiConnection (BSSID, IP, linkspeed, MAC addr, network ID, RSSI, SSID) -- WifiNeighbors (BSSID, capabilities, frequency, level, SSID) -- Root Check (root status code, root status reason code, root version, sig file version) -- Malware Info (algorithm confidence, app list, found malware, malware SDK version, package list, reason code, service list, sigfile version) Uber might have a legitimate reason to use most of this info in the app, perhaps for fraud detection or an intelligence-gathering tool. The problem is that the information is being sent and collected by Uber's servers without users' knowledge or permission. Sen. Al Franken sent a letter to Uber CEO Travis Kalanick last week demanding the company account to the public for its data gathering. The letter came as a response to a recent controversy where an Uber executive threatened to spy on and blackmail journalists who wrote unfavorable articles about the company. Uber's "God View" tool, which gives company insiders unlimited access to riders' data, has also been a cause of concern in recent weeks. Cult of Mac asked Uber for comment on the collection and transmission of the data its Android and iOS apps are performing, but haven't received a response. Update: Uber has provided some clarification to the company's data gathering, noting that the blanket access is actually a requirement from Google, which forces Android developers to ask for privacy permissions up front. Uber spokeswoman Lara Sasken released the following statement to Cult of Mac: "Access to permissions including Wifi networks and camera are included so that users can experience full functionality of the Uber app. This is not unique to Uber, and downloading the Uber app is of course optional." Recode notes that Uber-competitor Lyft requests access to the same data on Android. Unlike iOS and Windows, Android developers are encouraged to request access to more user data than their apps actually need. The Uber app on Android exposes some the mobile operating system's weakness in privacy compared to iOS and Windows, both of which allow users to refuse access to data on an case-by-case basis. Additional information on Android permissions can be found on Uber's site here (https://m.uber.com/android-permissions), but not every feature is explained. ----- This article about the Ubar app as malware is several years old, but today's NYTimes article "How Uber Used Secret Greyball Tool to Deceive Authorities Worldwide" explains for the first time one of the real reasons for Uber's prurient interest in its users' data. Now that we know these reasons for Uber's spying, it becomes clear what information collected by Uber's app could be used to track authorities who are trying to catch Uber drivers in illegal activities. Uber's bloated app size (215MBytes on iOS -- probably required for all the fake screens, ghost cars, etc.) can be seen as an all-out assault on every one of its user's privacy. This NYTimes article also explains why Uber wants so desperately to spy on its users *all* the time (http://www.theverge.com/2016/11/30/13763714/uber-location-data-tracking-app-... -- "Uber wants to track your location even when you're not using the app") -- not just when these users are utilizing Uber cars! _______________________________________________ The cryptography mailing list cryptography@metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography