Your browser is obsolete!

The page may not load correctly.

The rules of ”basic hygiene”

Правила гигиены

Other issues in this category (78)
  • add to favourites
    Add to Bookmarks

Allow, agree, approve: How we let applications steal our data

Read: 1552 Comments: 0 Rating: 0

Tuesday, March 15, 2022

You’ve probably noticed that before launching, every application requests a suspicious amount of access. And it's one thing when a video call program needs to access a camera, microphone and contact list, and entirely another when a simple child's game has the same list of requests. Simple software usually does not need to have access to this level of data to work correctly, and such a “demanding” application could turn out to be some kind of sophisticated fake that skilfully collects your personal information. In today's issue of the Anti-virus Times, we will remind you about configuring permissions and some privacy policy subtleties.

#drweb

Allow, but verify

As a rule, the more features a software program has, the more permissions it requires to work correctly. Usually we agree to all terms and conditions indiscriminately, not expecting dirty tricks. Ah well, some new game on a smartphone is asking for all kinds of access! Without looking, most users will press the “agree to everything” button, just to plunge into the virtual world as soon as possible.

However, this approach is accompanied by irreparable losses. When it comes to applications for mobile devices, it is not uncommon for fake games to appear in official catalogues like Google Play or AppGallery. For example, just recently this big story happened: a trojan was built into dozens of games that were downloaded by more than 9 million users. Android.Cynos.7.origin was integrated into apps primarily designed for children. It asked for permission to view the phone book, but, in reality, it stole not only the contacts but also the mobile phone number, device location information, technical specifications, meta data, and a heap of other important information. Read more about this incident in our recent news post.

Sadly, such stories regularly happen in the world of mobile gaming. Attackers penetrate even the games of well-known developers, but more often they use another poven scheme: they declare to the marketplace that an application is technically “clean” and safe and hide trojans in it after its release. For example, very often popular catalogues like Google Play unknowingly distribute malicious applications.

What data do the applications' authors get?

Often when a program is first launched, a notification (the end-user license agreement) pops up on the screen. Usually almost nobody reads it—users quickly scroll through it and confirm their agreement with the rules. But its text remains unknown. Perhaps by agreeing thoughtlessly, you allowed the software authors to freely distribute your confidential data.

Remember the story about the changes made to WhatsApp's privacy policy? Then users refused en masse to use the messenger as a protest against the forced change in data storage methods. In short: Facebook bought WhatsApp in 2014, and seven years later, they decided to legalise the exchange of social network users’ personal information with a subsidiary, that is, with the messenger. Users were really scared, and many of them still ignore WhatsApp just because of this story.

You should carefully read the end-user license agreement and the privacy policy of companies. This applies not only to those programs where you enter your personal data but also to any others. Companies like Facebook will most likely not use your data in some illegal way (well, or we won’t find out about it), but some small, obscure developers will only be happy to gain access to all the information that they can collect from your device. That data may include both your logins and passwords for the services or applications you use and your banking data. In addition, malware that has penetrated your smartphone can even show your location using a special permission to access the GPS settings.

#Android #hacking #malware #games #application_stores #mobile #personal_data

The Anti-virus Times recommends

  • Read the privacy policy before installing an unknown application.
  • Give applications only those permissions they need.
  • Scan the applications installed on the smartphone or any other device that your child is using.
  • Don't forget to update Dr.Web regularly and renew your license. Our products block all the ways used by threats to spread, even the most unexpected ones.
  • Read our news posts about cybersecurity—what if malware has already infected your device, but for some reason you haven’t yet installed Dr.Web?
  • Install programs only from official sources, but remember that attackers can get into those places as well.
  • Be careful and use software only from developers you trust.

[Twitter]

Tell us what you think

To leave a comment, you need to log in under your Doctor Web site account. If you don't have an account yet, you can create one.