Telecommunications

Uber's Android app caught reporting data back without permission

Uber's Android app is acting like malware, reporting personal data back to the company that it doesn't have permissions for
Uber's Android app is acting like malware, reporting personal data back to the company that it doesn't have permissions for

Security researcher GironSec has pulled Uber's Android app apart and discovered that it's sending a huge amount of personal data back to base – including your call logs, what apps you've got installed, whether your phone is vulnerable to certain malware, whether your phone is rooted, and your SMS and MMS logs, which it explicitly doesn't have permission to do. It's the latest in a series of big-time missteps for a company whose core business model is, frankly, illegal in most of its markets as well.

Taxi-busting ride share app Uber might have an operating model that suits customers better than traditional, regulated taxi services – but the company's aggressively disruptive (and frequently illegal) business practices don't seem to stop at harming the taxi industry.

Its vicious attacks on competitors have included ordering and cancelling more than five and a half thousand rides through its chief competitor Lyft. Its senior Vice President of Business, Emil Michael, casually mentioned at a dinner that maybe Uber could start digging up personal dirt on journalists critical of the company.

These kinds of stories, of course, should be taken with a grain of salt – they're certainly very beneficial to competing services like Lyft.

But there doesn't seem to be a lot of grey area in these latest revelations that Uber is collecting a stack of personal data from users who have its Android app installed, including SMS data that its permissions list doesn't allow.

Security researcher GironSec decompiled the code of the Uber Android app and found it to be collecting and sending the following information back to Uber:

  • Accounts log (Email)
  • App Activity (Name, PackageName, Process Number of activity, Processed id)
  • App Data Usage (Cache size, code size, data size, name, package name)
  • App Install (installed at, name, package name, unknown sources enabled, version code, version name)
  • Battery (health, level, plugged, present, scale, status, technology, temperature, voltage)
  • Device Info (board, brand, build version, cell number, device, device type, display, fingerprint, ip, mac address, manufacturer, model, os platform, product, sdk code, total disk space, unknown sources enabled)
  • GPS (accuracy, altitude, latitude, longitude, provider, speed)
  • MMS (from number, mms at, mmss type, service number, to number)
  • NetData (bytes received, bytes sent, connection type, interface type)
  • PhoneCall (call duration, called at, from number, phone call type, to number)
  • SMS (from number, service number, sms at, sms type, to number)
  • TelephonyInfo (cell tower id, cell tower latitude, cell tower longitude, imei, iso country code, local area code, meid, mobile country code, mobile network code, network name, network type, phone type, sim serial number, sim state, subscriber id)
  • WifiConnection (bssid, ip, linkspeed, macaddr, networkid, rssi, ssid)
  • WifiNeighbors (bssid, capabilities, frequency, level, ssid)
  • Root Check (root staus code, root status reason code, root version, sig file version)
  • Malware Info (algorithm confidence, app list, found malware, malware sdk version, package list, reason code, service list, sigfile version)

While some people are suggesting it might be an anti-fraud measure to help Uber detect and combat fake accounts set up by its competitors, the fact remains – collecting data without appropriate permission constitutes malware and compromises users' personal data.

It's not yet clear whether the iPhone app does the same level of reporting on its users. As for whether Google will move to pull the Uber app from the Play store, that seems unlikely given that Google's US$258 million dollar stake in Uber represents the biggest deal Google Ventures has ever done.

This is the new world we're living in, folks, and if you think Uber's the only one building fat files out of your personal information, you're mad.

  • Facebook
  • Twitter
  • Flipboard
  • LinkedIn
13 comments
Jason Catterall
The latest in a long line of blunders... not entirely surprised.
Mel Tisdale
George Orwell only got the year wrong.
Cédric Blanc
"a company whose core business model is, frankly, illegal in most of its markets as well." Not Biased at all then... Maybe it is an issue Android needs to address, by approving clean apps only, like Apple does.
James_Smith
Loz the blogs analysis might be inaccurate. Check this article http://thenextweb.com/apps/2014/11/27/ubers-app-malware-despite-may-read/
Keith Reeder
"Not Biased at all then..."
Does "biased" mean something different where you're from, Cédric?
Stating a simple fact DOES NOT indicate bias.
measterbro
That explains why Google invested so much
Wombat56
@ James Smith I'm sorry, but I don't buy a number of the excuses in the article you quoted, especially #2 and #8. And for many of the others Uber should explicitly ask the user for the information, not leech it secretly from your phone.
Much of the data types stated above seem surplus to actual needs to operate the service.
Nemo Aristos
The allegation borders on the criminal that Uber is "Malware" the permissions are fairly typical in line with a Smartphone Ridesharing app and are relevant to it's operations, hardly "Malware" Many other apps have similar permissions and are not at any point considered "malware". It is reasonable to assume that the data collected is used maturely and not for nefarious purposes. Hardly malware!
The legality of Ridesharing organisations vary from nation to nation state to state based on antiquated laws relating to Ridesharing or "Carpooling" before the time of smartphones and tablets.
Why take an app like this and assassinate it so thoroughly? As if anything done by Uber is Malware or Illegal in all honesty - Ridesharing apps as Illegal Malware? That's just weird reporting for Gizmag.
Graeme Harrison
Logically, disrupting the taxi industry is LONG OVERDUE. A recent survey of 16 economists (reported by The Guardian) showed 100% agreed that Uber should not be shut down (ie it is beneficial).
But ALL these companies need to clean-up their acts, and comply with EU standards (ie highest) for user privacy.
As to Orwell being correct, except as to the year... George wrote '1984' in 1948 and was only confident in where society was heading (he was so prescient), but he was unsure of the timeframe for the erosion of personal rights, so he just 'reversed' the current year's last two digits (48 to 84) to get a title for the book. He'd be unsurprised that it took longer, but feel self-congratulation as to his 'picking' of the trend towards misuse of state apparatus against the citizenry. Of course Orwell thought the oppression would be done with analogue technology (your TV watching you) and it was digital technology which really enabled it (logging the bytes sent and received by you)... But if you forgive the fact that in the 1940s he was not aware of the transistor, his predictions were still very insightful.
Cédric Blanc
Absolutely, Graeme, The Taxi industry needs a kick up the backside, it doesn't take much skill to drive people around, "quite frankly" (this denotes my opinion, not a fact) the knowledge is obsolete, and I have received a much better service from Uber than black cabs. Can a black cab charge my phone? Can a black cab carry me across London for less than £7, can a black cab let me pay with my phone when I don't have cash, can a black cab let me split my bill with my friends? As a user, that's what I expect, the technology is available, let's use it to provide a better service. Now, I do care about privacy, if it's going to be misused, that's disappointing me no ends. So clean up your act, and be honest Uber!