[Music]
so we'll be talking about no permissions
needed I am Aditi I've been already
introduced I'll just skip my interest
lies and security privacy and techno
sociology which is basically impact of
tech on humans and Society overall
um
so diving directly into the topic before
beginning I would like to have a show of
hands of how many people have used
Android ever or hacked Android yeah all
of us I think all of us are kind of
familiar with Android which kind of
makes sense because you're here
um so if you have you would have seen
these permission Alex right like one
appears when you're installing the app
where the app asks you a bunch of
permissions then you can go to settings
and see what all Apple missions have
been there and then third one is a newly
introduced one which I really like where
you can decide whether you want to give
permission throughout the time of when
you're using the app or also in the
background and stuff like that uh but we
are here to demystify as to what
permissions actually mean in Android
world right so I'll try to do that in
four simple steps
um the first part of it is why are you
shown this a screen so if you're trying
to code an Android app suppose you're
trying to code a weather app and it
needs your location permission when you
add the function chain of get
geocoordinates or get whatever Android
Studio asks you to add this particular
permission in your Android manifest file
so in Android there is
androidmanifest.xml which is kind of the
Central File where all the permissions
are listed so they are shown up here
it's a user's permission brackets so all
the permissions that the app would be
needing would be listed in here so that
is the first part the app developer
defining that this is the set of
permission I I need in order for my app
to work and when you install Android
picks up the same set and shows you out
in the dialog box that we just saw so
that is the first part the other part is
what happens in Android world right so
if you have an app how Android actually
treats that app
so in Android every app has a package
name right and the funny part is it's
not not even unique right like uh
com.android.chrome identifies Chrome app
but you can as well create an app with
that package name although it would not
install on your device if Chrome already
exists but yeah that that loophole is
there so for Android it identifies every
app with the package name and the
interesting bit here is the user ID so
it assigns a particular user ID to the
app and it has this set of permissions
listed to the app uh so where can you
find the central file it is Data System
slash packages.xml so you need to be
root or if you're an emulator you can do
ADB root and then you can pull this file
out and you can see all the packages all
the apps which are in Android
um and all the permissions associated
with that app
so now you hear you see that it is just
list of strings right like Android
permission or device power what does
this string exactly mean in OS world
so the next bit I'll show is really
interesting file which kind of does this
mapping of the string with a group ID
Now Android is nothing but Linux right
and uids and group IDs kind of make
sense to us because we are familiar with
it in Linux world so you'll see that
each permission is essentially related
to a group ID here for example Bluetooth
admin has a group ID net BT admin and
then there is a separate file which does
the mapping of group ID with the
corresponding group group code which is
a numeric value
so in Linux uids are used to separate
users because Linux was designed to be a
multi-user OS so you had uid so that
users can not interfere with each of
their spaces you do not have access to
access accessory sources of other user
Android kind of repurpose the same logic
for apps so every app basically has its
own uid and a set of permissions which
are listed as gids
so that is in brief how permissions
actually work in kernel land in Android
and usually whenever an app starts
Android has Dalvik VM which it's used
uses to run Java or kotlin code whenever
you launch an app it does not create the
VM it rather focus of a process from
zygot so zygote is a central process
which has root access it has all the
loaded libraries that your app needs in
order to perform and whenever you launch
an app basically it just folks out of
that thread so zygod has everything and
at the time of working it assigns a set
of group IDs that we just talked about
so that is the permissions that the app
would have and capabilities
and also a different uid so at the time
of specialization app basically becomes
its own app like it's the privilege is
reduced and it is reduced to the group
IDs to the permissions that the app
asked for so that is what happens and uh
this book Android security internals I
find it really interesting by Nicole he
has detailed a lot more into what
happens exactly uh in Android kernel and
how security is insured
so having talked about that what are
permissions can an app declare so I was
interested interested in seeing what our
permissions are there on Android system
and to do that you can simply
um try doing PM list permissions Dash F
which will list all the permissions on
your device now note that not all
permissions are same across all the
devices because apps can also create
their own custom permissions which show
up
um and whenever you see in any
permission here there would be a
permission a package sometimes also give
the description but the interesting bit
here is the protection level
so the prediction level can be normal
dangerous privilege signature or
privilege
we'll talk about the normal and
dangerous one more so normal is a set of
permissions
taking a step back Android introduce
permissions to accept to limit access
right like you cannot access resources
like location without declaring a
permission now the permissions that fall
under normal are the ones that
developers need to Define and Android
manifest but they do not ask they do not
need user intervention so you can as
well Define normal permissions but it
would not be shown in a prompt to user
right they'll just stay there
um dangerous are the ones like location
for which you are shown prompt for and
then there are other like signature or
signature or system uh these are usually
very restricted permissions you cannot
not every app can Define it and there
are usually signatures involved or the
app needs to be in system so usually
system apps or custom apps of the oems
use those kind of permissions
uh but I was not interested in data
collected after defining this permission
I was interested in data collected
without defining any permission on
Android
so I created an app I called it Jon Snow
app uh you know nothing and this is the
Android manifest of that app so you see
that there is no user's permission here
like it's not using any permission and
that was the whole idea that without
using any permission what all
information can I extract
so I'll just show the app right now
uh so you can see that it's like no
permissions requested it's grayed out
a rare occasion on Android
and when I say what do you know
I'll give you the basic details like
manufacturer model uh supported 32-bit
stuff like that
and then I asked it and a hardware
details fingerprints and stuff like that
and it also shows you whether you know
configurations like ADB is enabled or
not
um
here USB Mass Storage Wi-Fi is on or not
airplane mode is on or not data roaming
boot count HTTP proxy a bunch of system
settings essentially
so it was okay it was interesting some
information about my system which is
fine it also tells you settings which
are very personal to you like
accessibility settings right uh
inversion of colors or parental controls
on your device whether they're
established or not whether you have
touch exploration or not uh most
interestingly it was also able to know
all the apps that I'm using right so um
the names of the apps banking apps or
any other things
and this bit is the favorite one because
it is also able to gather information
which is kind of not like does it
doesn't need that kind of information so
information like when is your wake-up
alarm set up to so I'll be waking up in
six hours I would know any app would
know that or whether I'm listening to a
song or not based on you know the audio
status uh microphone is mute or not
battery is charging or not uh clipboard
what is the last thing you copied right
so if you forwarded a chat from your
loved one to someone else this app which
has no permission sitting on your device
will be able to read that message or any
link that you shared anything that you
copied basically and along with that app
widget so whatever widgets you installed
on your mobile phones other than the
apps
so it was able to collect all this
information and honestly it was just a
first go so I went to Android studio and
like Global setting system settings and
I tried to access everything that
Android Studio was letting me access
without finding a permission and this
was what I was able to get in the first
go
and why does it matter so I think and
this is a kind of broader problem in
privacy that we say that these are data
points and these are just system
settings and you know we need it but if
you put a human behind these data points
you can easily make inferences about
someone so if you have like apps you use
there has been research around that that
just on the basis of the apps you use
you can find out the gender of a person
or ethnicity or age group or addictions
health problems if you're using banking
apps they will know which bank your
money goes into lifestyle apps where do
you shop your clothes from and stuff
like that because there's an app for
everything so appnium kind of indicates
your preference or your choice in life
similarly device controls right
accessibility health conditions whether
you're a child or not these can be shown
based on whether your parental controls
are established or not clipboard data
Bluetooth on right so there are all
these uh things and the most importantly
is that all this set of information
since it's so much can be easily used to
do device fingerprinting so there has
been talks around
um apps basically using a thing called
advertising ID so they collect
everything from your whatever you are
performing on the app they collect that
information they add a unique identifier
which can profile you which is
advertising ID and it sends it over to
advertising server so that is how they
maintain a profile of you right and the
talks around advertising ID was that
users should be able or given the right
to remove that link of profiling and the
ID used to identify that person but that
link does not hold like that choice is
no more there when your device can be so
easily fingerprinted and for browser
fingerprinting we still have had more
discussions but for Android device
fingerprinting there has been no
solution as such for now
um other challenges that I see in
existing permission model is permission
redaligation
in Android since it is the because of
the rich functionality it offers it
allows for IPC which is inter-process
communication so it can easily happen
that app is taking location permission a
b is taking Gallery permission and then
both of them are talking to each other
through like custom content Uris or
other ways in which Android allows
information to be accessed across apps
and I did a little bit of experiment I
would not go in deep because we have
very less minutes here but what I tried
to do was can I find which app is
talking to which app on my Android
device and I was able to do that by
hooking into the looking into the binder
calls so Android allows for IPC through
binder and binder does a lot of logging
so for every process that keeps process
logs which get erased after some time
and those logs have the information of
whether which process was interacted to
from this process so I kind of try to
use that log and make a mapping so
there's a script which you can share for
people who are interested so you can
know which apps are talking on your
device but do not go more in detail here
let's talk about some other stuff so
what else is problematic then there's a
thing called common libraries right so
you use libraries for crash dumb
collection you use libraries for logging
and those libraries whenever they are
integrated they have the same kind of
access that the app has so whatever
permissions the app has access to the
library also has and the library is a
third party thing altogether right so
they can take again location from one
app and that library is part of another
app so it can take images from the other
app and basically collect and file you
uh how many minutes are left I'm sorry
oh thank you
okay
so uh that is something which is
happening right like Library collecting
data or apps interacting with each other
and these are active problems which
Android is trying to figure out how to
solve as a platform but I think there
are broader conceptual concerns as well
when it comes to privacy
um
for example scoping of data and
granularized controls
um let's take this case allow SMS
messaging to send and view SMS message
right so when you give this SMS Read
permission it can basically read any SMS
that comes to you and the thing that I
find problematic in this model is that
you're kind of giving access to the
storage so you when you allow the
permission you basically give the keys
to your storage but you do not know what
will end up in your storage right like
what kind of SMS is it holding
confidential information is there a
choice in which we can restrict that no
only SMS from now on or the OTP that
your app needs you should only read that
we cannot Define that choice right so
today when you give lead SMS just
because an app needs to read an OTP you
basically expose the whole SMS stack so
it can contain any SMS it can contain
any pii and that is essentially
additional information that you're
giving off which you don't need to
essentially but we don't have a choice
to restrict that
uh another interesting thing is what
happens to my previously collected data
if I revoke permission so the revoke
permission flow itself is not very well
designed you can go and say that do not
I don't give this permission anymore but
that revocation how is it reflected on
server side have people deleted your
data because you do not want them to use
it anymore that flow is again not there
happening
um and then this is a really interesting
thing that talking about data and it's
not related to Android it's just in
privacy in general whenever you share
information you do not share just your
information right so if you are sharing
suppose you're giving excess of your
gallery your gallery will not hold just
your pictures you're making decision for
other people in your circle whose
pictures are also there in your gallery
and it is interesting it is obviously
complex to solve but
um it kind of gives you like if you
think about the question of can you
actually control uh what amount of your
personal information goes online today
the answer is very difficult you cannot
in a way because if you just talk about
um say contacts for example so let's say
Alice pop and Carol are here in MCH 2022
and they Alice shared the contact to Bob
uh so that they can connect but later on
Bob happens to have a crowdsourcing app
and that contact got uploaded onto the
cloud
the next day Alice found out that hey my
contact is in there and I do not like it
so she raised a request and said that
please take my contact off RPI off the
cloud and they might entertain that
request and take it off but then the
data which has already left Alice's
device has now reached a bob and Bob
happened to share it with Carol and then
Carol happens the app and it again end
up online so basically can you control
the answer is no once you have given the
permission or once you have shared the
basically it goes out of your out of
your reach
so these are the kind of problems that
we are seeing in Android and
um there are initiatives there are talks
around privacy sandbox in Android which
can can potentially help us address it
but there's no significant piece of work
which answers the solution answers the
question or provides a solution right
now
so these are some of the challenges by
platform design and we have not even
touched about the gdpr angle of it so we
have not talked about apps which take
permissions you have given permissions
to them you have trusted them to handle
your data with respect but they end up
exposing it right so there have been
articles these are all fetched from
wired and they keep on happening every
month there are some article or the
other indicating that this app has
leaked information out there and that
kind of shows
at a resist back or an improper process
system or policies around handling user
data
so I would just like you to take a
minute now and think more info about to
use it's stored and monitored online
like can you think about today sitting
here what all information about you
would be online
and when I think about it I am I
basically have no clue and I would not
and I would not blame you because no one
asked you anyway right they just
uploaded it the permission models are
messed so you have a lot of information
whether you believe it or not about you
online and you're being tracked and the
data is being used so that is all I had
to talk about thank you so much for
attending attending the talk and yeah
a DTU thank you so much
um should we take some questions if you
have the time awesome there's two
microphones in the middle folks uh for
the last time let's uh have some
questions
okay Frontline please
does it work yes
all right so far these pop-up messages
I've considered them to either be a
placebo
or one of the ways Google tries to for
the the competition I'm a bit of a cynic
with the uh
these uh these pop-up questions
so
let's reverse it for a moment which of
the pop-up questions you think actually
work
um can you explain what do you mean by
pop-up questions
the uh the pop-up questions for
permission
the permission boxes okay so which
happens work which ones work
um so
see the intention of having them in the
first place was to provide some sort of
controls what we're talking about is
that they are not enough or there is a
lot which can be worked upon so we had
things like for example initially in
order to access Wi-Fi anyone could have
access to your Wi-Fi and then there was
a study that just based on the Wi-Fi
someone can you know interpret the
location of the person so they made that
in order to access Wi-Fi they added the
condition that you need to declare
location permission right so they are
taking his steps in the direction and I
do believe that if I am giving location
permission it kind of gives me a little
bit more like control around whether my
information is going out or not so I
would say that the ones which are there
do work in some capacity but they are
like still loopholes or things that need
to be addressed because even if you give
the permission it is the first level of
control that works but once the data has
gone out after that what happens to our
data there's a lot of you know scope of
flowing data flowing across which you do
not control so
all right and this is again the cynic in
me how much of this is uh intentional
um
it is intentional in a way that if
you're using Google products uh the
advertising model itself would need uh
you know in order to give you the right
ads they need to profile you but at the
same time they claim that you can um you
know remove the advertising ID or you
have the rights to get off the system
not get personalized ads so the talks we
are talking about like the things we're
talking about here is how effective are
those controls right so the choice
should be there the model is
unfortunately unfortunately advertising
model so it is intentional of course but
then do you have a choice to be off grid
that that choice is something that we
are discussing here
thank you
at first thank you for your talk of
course
um I have too few quick questions first
about the uh sandbox about the modern
Androids with the work profiles like
there are different apps which are able
to sandbox or use the work profile as a
Sandbox I was wondering about the
different permission models like is
there is it as secure as they say or is
there a data being shared between the
work profile and the normal personal
profile
um so I have not worked a lot with work
profiles they have introduced it
recently but based on whatever I've read
in the documentation they have ways in
which you can share information across
but again you have to be explicit about
and then they have some sort of
permission model around it
I think it's logically a separate space
so they have kind of tried to create the
same different users kind of stuff like
you have in Linux another layer on top
of that that you cannot share resources
altogether and when I try to create in
an app and work profile it was actually
difficult to have that communication so
I would say that yeah it does work but
I've not done a thorough City to say
yeah it's fully secure in the way they
are claiming it to be and one last
question is about the global permission
model because some phones have also like
you say like you you cannot declare a
specific permission for the apps like
which apps are installed on your device
but there are Global permissions like
allow apps to view other apps installs
on the device if you turn it off no app
will be able to uh to use it okay can
you tell me some more about how these
are these vendor specific or are they
built in hours or like how do they work
um the global affirmations yeah I do not
know how to do that's probably not the
official term but they are in the
settings app they are like setting allow
apps to view other apps on your device
or allow apps to know which other apps
are installed on the device that's the
thing which doesn't have a app to app
specific permission but you can turn it
off
oh okay uh so you think that a
particular permission is given to all
different apps and then you can select
which apps have their permission or not
no it's more like there's one setting in
the privacy app like turn off that apps
will be able to view apps insults on the
device and when it's off no app on the
device can view which other apps are in
cells on the device oh okay so you're
talking about yeah yeah so the editor
permission I think in after Android 10
or Android 11 where you need to define
the permission in order to see other
apps installed but this thing worked on
the latest model as well and if the
permission so there is some permission
around the extracting the code so from
an app you can also extract the code of
other app that is how usually uh apps
scanning or code scanning tools work on
device so they have added some
restrictions around whether you can
acquire the code the binaries of the
other app through your app but the
package names or the name of the apps
can be attained and and if there was a
permission I think this one worked
without permission but the permission
that they have added also normal so it
would not be taking users uh you know
user won't be shown the prompt to allow
let an app read other apps it will just
work in background I'll show it later
yeah sure let's let's discuss it off
after this
okay
all right uh thank you for the very
interesting talk
is there any way you you could
turn all those permissions off you show
that that even an app which has no
permissions at all
has a lot of permissions anyway
so could you turn off those permissions
for example to delete them from an XML
file
um
because I have no smartphone and that's
yeah and that's and that's that that's
of course a a good way not to be
profiled that way
but it becomes much more difficult uh
time proceeds because uh everyone
expects you to have one
so
is there a way to uh to turn profiling
off
currently no
thanks for your question though um maybe
in addition to the question of the
previous gentleman if you use an open
source Android distribution instead of
the one that comes pre-installed with
your phone would that then solve these
problems or at least improve them or
does that doesn't even matter
I think it depends on if you want to
play around with Android OS you can as
well create yourself like I have known
people taking care of the analytics
module or how the collection happens and
making changes somewhere there and
having a custom OS version like the
vanilla one but blocking certain things
and then it's flashing that on their
mobile and using it to be more secure so
I've seen people doing that uh if you're
using oems I think those are even more
bizarre because a lot of oems like oems
by OEM I mean Samsung and other other
device manufacturers they are coming up
with pre-installed apps right so a bunch
of them more than what you need or what
Android vanilla Android offers a lot of
them are like just custom apps which
actually work or run at the system level
itself seeing everything that you're
doing on device so
um OEM would be like the least
preference building your own Android OS
which will take a bunch of work but
building that and then customizing it is
a good option if you are interested in
that you can do that that will
definitely help or reduce it in some
extent but again you have to be
conscious of the apps that you're
installing right so if the apps itself
is collecting your information uh the
change that you would be doing on kernel
level is restrict them to collect the
information so if you're able to do that
in the source code awesome uh if you're
not then you have to be conscious of the
apps that you're installing all right
thank you okay thank you
uh hello thank you for the wonderful
talk and this is indeed quite scary to
talk about uh to think about I was
wondering uh what's your impression of
the iOS model in that regard I maybe I
have missed the part but personally I've
been quite impressed with like
occasional granularity of permissions
that I have been asked for
yeah so I guess iOS I would say
um
so there's a catch here right anyway if
you're using Google or Apple the first
thing you're doing as soon as you buy
the devices is showing your confidence
in the company so they will be taking
the data for sure but now the question
comes whether the data is just with the
company or is it going with advertisers
or trackers so in iOS I found that they
I think recently they introduced a
feature in their setting in privacy
settings uh to stop tracking from across
all the apps and that has actually made
a lot of other companies who rely on
data really angry because they are not
able to get the right information to
profile and do their work so they have
added that and I actually respect them
for doing that they also have features
like for example in Instagram if you're
sharing photo rather than giving access
to your whole Gallery they ask you to
pick the photos so those are the kind of
controls which can potentially be there
in Android as well but we do not see
them and Android much so my preference
would be a little bit towards iOS not an
official statement though yeah
thank you
I think the approach you're taking with
the uh the app that has no permissions
and seeing what it can do is interesting
and it's shocking to see how many data
points you can still retrieve yeah
um this is a bad point of course for
Androids compared to Linux but on the
other hand if you look at a normal Linux
distribution
it tends to run all the apps as the same
user with access to all the same data
now if you combined the two and take a
Sandbox on the Linux in which you run
each app in its own sandbox it would be
interesting to see how much information
your app would still report
you might know you can run APK files on
your desktop or on other mobile
operating systems that have a sort of
emulation layer for running APK files it
would be interesting to see how your app
has in that
uh so you think you're talking I did not
fully understand it but is your question
around application sandboxing and
whether that because Android does it in
some ways I'm trying to understand so
instead of taking Androids take a Linux
distribution yeah and a program like
Mbox which can run Android applications
take your application run it in there
and see how much is still revealed
because if you do that you have a
separate sandbox on Linux for every app
yeah I think yes uh that is interesting
there are two questions two things that
come to my mind right now here uh one is
the way so Android had that as I got in
forking off Zygarde because of memory
optimization and like it's a smaller
chip they want to make it work in
Pockets like it is a thing which will be
there and a lot of apps so they have
done optimizations around that right so
it's like all the things that I am
taking are kind of global common
utilities basically the information that
I got from and it's already loaded in
zygot and it's working on zygots you
already have that permission right so if
you are trying to completely sandbox it
it might work but it might not be
performant or efficient or might
conflict with the initial ideologies of
why they chose it to be working another
thing is in Android there's a lot of
cross app interaction which is
intentional right like if you're going
to Whatsapp you want to add a contact
you're talking to another app there and
that is intentional that offers Rich
functionality uh and convenience to user
so it cannot completely piece and box is
still right so that is the problem okay
thank you yeah okay I'm sorry but we are
out of time now so I'm afraid no more
questions uh perhaps the DT would uh
hang around afterwards maybe if folks
have any others
um thank you once again Aditi please for
the last time everyone let's give it
easy a big round of applause
thank you
[Applause]