F-Secure: Android adverts pose security risk

 

Gallery

By Stewart Mitchell

Posted on 10 Jan 2012 at 13:44

Android adverts could prove a privacy risk, according to a security company, because of the way the operating system handles permissions granted to advertisers via apps.

Research from F-Secure showed that the way adverts are bundled within applications in Android could leave end users exposed, because there is no way to give an application access to data without granting advertisers the same rights.

"When the user accepts and grants permission for the main app to install, the user is also by extension allowing the ad modules to use those same permissions,” F-Secure said in a blog post. “Sometimes, the permissions are only used by the ad module, not the main application.”

According to the security company, this leaves users in a “grey area” where they can't be sure exactly what information they are allowing an effectively unknown company to access on their handsets.

We had a case where the main app was clean, but the ad module collected confidential user information and sent it out to a remote server

The company used an example showing the permissions tab of an ad-supported app downloaded from the official Android Market, with a very generic description of the permissions:

“Wouldn't it be clearer to the user if the Permissions tab indicated how the permissions were used by both the main app and the ad module?" the company said. "Or better still, there was a separate permissions tab for the ad module?

“This would give the user a clearer idea of what the main app/ad module will do, and they would be in a better position to choose whether they want to proceed with the installation.”

The company cited a recent example of an app found in the Android Market that sniffed and sent phone data to remote servers after being given permission during installation.

“We had a recent case, where the main app was clean, but the ad module was the problem: it collected confidential user information and sent it out to a remote server,” F-Secure said.

“Most advertising services need some info from the phone in order to serve 'targeted' advertisements, but we considered that the module was asking for rather too much info.”