The truth about those 'data-mining' Android apps

If you've read much Android news over the past few days, you've probably seen some pretty shocking stuff. You know, things like:

"Over 1m Android Users' Details Compromised Thanks To Malicious App"

"Data Stealing Android App Fooled the Masses"

And my personal favorite:

"Android Gets Hacked Again, Millions Affected Unknowingly, Advantage: Apple"

These headlines, as you probably know, are talking about a series of Android wallpaper apps mentioned in a report by mobile security firm Lookout. Lookout (which, it should be noted, markets its own security app for Android) presented the information at the Blackhat security conference in Las Vegas last week.

Unfortunately, much of what the company found has been twisted and manipulated into some very misleading -- and very inaccurate -- claims.

UPDATE (8/4/10): Google says the applications were not security threats.

[This story is from the new Android Power blog at Computerworld. Follow @AndroidPower on Twitter or subscribe via RSS to make sure you don't miss a beat.]

Dissecting the Android App Alert

Android Data-Mining AppsAccording to Lookout, some wallpaper apps within the Android Market were "gathering seemingly unnecessary data" from users' devices. This data included phone numbers, subscriber ID numbers, and voicemail numbers. The applications, Lookout says, were transmitting the data and storing it on a server in China.

It's hard to deny that that sounds slightly shady. Of course, it's nothing compared to how the story initially sounded when tech blog VentureBeat reported it. VentureBeat said the Android wallpaper apps were harvesting all sorts of other, far more sensitive details -- things like users' browsing histories, text messages, and passwords. That information is flat-out wrong; VentureBeat has since retracted it. But the story continues to live on, thanks to the countless blogs that picked up on VentureBeat's report without any independent confirmation. The echo chamber effect can be a dangerous force.

But back to the data these wallpaper apps actually were collecting: What was going on? According to the apps' developer, Jackeey Wu, the collection was all being done in the name of legitimate functionality.

In a conversation I had with Wu over e-mail, he told me the information he stored was used to identify a device so the application could keep track of its user's preferences.

"They can favorite the wallpapers more conveniently and resume [their] favorites after system-resetting or changing the phone," Wu says.

Analyzing the Explanation

Other Android developers I've spoken with say that explanation makes sense in theory -- but that the same effect could have been achieved in a far better way. Ultimately, this whole fiasco may have been more about poor programming choices than attempted data theft.

"I don't think the developer is doing anything malicious," says Arron La, who created the popular Advanced Task Manager app for Android. "His feature to do application backups -- resume favorites, settings, or something to that extent -- makes sense. He [just] implemented it in a very poor way."

La says the apps could have used users' Google login IDs instead of their phone numbers and device IDs. Those values would differentiate devices and allow settings to be retained, he explains, without raising red flags over privacy. La also says the info could have been stored on the users' SD cards instead of remote servers, which would have further alleviated any concerns.

"The permission he is reading is not totally bad but can be dangerous," La says. "Users should look at why anyone would want to do things this way."

Lookout's CEO agrees. John Hering says there's nothing in the wallpaper apps' approach that immediately strikes him as being malicious. Rather, he says, it looks like the developer simply collected more user data than he needed to -- and that's something the Android community should be aware of and work to avoid.

"Some developers are writing code in a way that they think makes sense but inadvertently exposes user data," Hering tells me. "I think we need to have context and think about this in a way of how we can fix it and make it better."

[Related: Beware of sketchy Android 'agents']

Android Apps and Security: The Big Picture

Google has temporarily pulled the wallpaper apps from the Android Market while it investigates. Regardless of what the final verdict ends up being, however, the implications that this incident should have us all longing for Apple's "walled garden" approach are just plain silly.

(UPDATE [8/4/10]: As mentioned above, Google has concluded its investigation and determined that the apps were doing nothing that put users at risk.)

First of all, let's face it: Apple's App Store approval process is more about protecting its own interests than protecting those of its users. Despite the fact that the company's app police routinely ban everything from political satire to swimsuit photos, plenty of shady programs have made their way through those closely guarded gates. You might be kept safe from the evils of Google Voice and MSNBC.com cartoonist Daryl Cagle's Tiger Woods cartoon viewer -- and, of course, the unthinkable atrocities of porn -- but that's about it.

Here's the thing: When you accept freedom of choice, you also accept a certain level of responsibility. Sure, you may occasionally encounter something "objectionable" within the walls of the Android Market. You also might encounter such materials when browsing the Internet. But no one's suggesting we lock down the Web.

Filtering or censoring the Web would be ridiculous, right? Well, the same notion applied to a smartphone is no less absurd. Like with the Net, it all comes down to being cautious and intelligent about what you do. Before you download something, you evaluate it carefully. You look and see what other people are saying about it. In the case of the Android Market, you even have the advantage of being able to review exactly what types of data it'll have access to (you know, that little warning screen that pops up before your download begins?). If something looks questionable, you click away.

"The Android permission architecture was created to ensure users that this type of information would not be collected if they do not want it to be," says Kevin Payne, developer of the highly rated Astro File Manager application for Android. "The final decision is still with the users to ensure they understand application permissions and use them responsibly."

Of course, if you prefer having some random panel prescreen your content and decide what's fit for you, you know where you can go. In fact, you have two very distant but eerily similar options.

source