Database Users

Protecting Privacy - Compiling TaintDroid into Kernel to find leaky apps

Most people don't yet know that many Android software leak all sorts of information to the internet with only scant user acknowledgement (basically what you accept when you install the app).
Due to this and the fact that there are already privacy information harvesting apps for Android on the marketplace - a team of security experts have created TaintDroid:
What is TaintDroid?
From the project's web page: "A realtime monitoring service called TaintDroid that precisely analyses how private information is obtained and released by applications "downloaded" to consumer phones."
From: http://appanalysis.org/index.html
How can I install TaintDroid?
As TaintDroid is currently compiled into the kernel, you cannot easily install it, but you have to cook your own kernel. Instructions (for Nexus 1) are available at the project web site: http://appanalysis.org/download.html
How does TaintDroid work?
Here's a video demonstrating how TaintDroid works once it is installed and configured:
http://appanalysis.org/demo/index.html
Why would you want to install this?
There can be many reasons for installint TaintDroid:
- You want to learn about privacy features and play with Android kernel
- As it is currently impossible to differentiate between innocent and sneaky Android apps based only on what access rights they request, you may want to dig in deeper
- You are worried about what apps are doing behind your back and you want to know which apps to uninstall
- You want to help create Android a more secure and privacy-protected platform, instead of the swiss cheese it currently is
What can you do?
As compiling kernels is mostly beyond the reach of mere mortals currently, consider cooking TaintDroid into your kernel, if you are cooking one yourself and offering it available for others to try and use.
Hopefully increased awareness and usage will bring this program eventually into other modders and perhaps even Google's attention and something more easily accessible is offered for the public at large.
BTW, I'm just a user, interested in getting TaintDroid on my own Galaxy S. I'm not affiliated with the research program, but I like what they are doing. This information is purely FYI.

+1 for the idea
Sent from my GT-I9000 using XDA App

+1
Since we cannot expect information gatherer Google to come up with a good privacy protection mechanism soon I think we are forced to take measures ourselves.
I also learned that several of my bought applications are constantly forcing me to enable synchronisation and/or 3G internet. They either randomly uninstall (Asphalt 5), their icons disappear (for example: Mini-squadron) or won't start, with (Schredder Chess) or without a message. Angry Birds Beta2 lite (free game) and Hungry Shark are 2 more examples. So much for an incentive to buy games...
It would be great if applications used a well-defined mechanism to check their validity on-line, and not have this sneaky, lingering attack from all sides to any privacy or battery consumption aware user.

I can not cook Kernels, but this is something i want to use.
Not that i am worried, but i dont know what apps are sending when you open them. Thats something i want to know!
I am sure i am not the only one.

+1
Yes please... This should be in all android phones... as a security option you could turn on!!!

Antonyjeweet said:
Not that i am worried, but i dont know what apps are sending when you open them. Thats something i want to know!
Click to expand...
Click to collapse
And do some of these applications only send stuff when you open them?
--
From a user perspective it currently is really difficult to judge applications that need to start at boot-up and deal with many facets of your computer (Launchers, tools combining lots of divers features).

Do you know some ROM where Taindroid is included?

I've posted in hardcore and laststufo kernel threads to ask if they could add it.
We just need more people wanting it so they think about adding it

exadeci said:
I've posted in hardcore and laststufo kernel threads to ask if they could add it.
We just need more people wanting it so they think about adding it
Click to expand...
Click to collapse
glad you did that

+1 support the idea. hope some of our hardworking kernel builders will add this in.

My concern is how much another real time service will affect battery life. For people trying to make the leanest, fastest kernel I'm not sure it's viable.

I have been wanting TaintDroid built into android by default since the day it was announced, but I really do not think google cares about this, so please, please ROM cookers out there (Maybe Doc?), lets add this into our galaxy S roms.

Well, this seems to work only on android 2.1

Make it so.
+1
Combined with walldroid (or other firewall) this could put back power into users hands. Would really love to see this inside hardcores kernel. Maybe as an option for the stable releases?

+1
This should be the next standard in aAndroid

idea about spoofidroid application
how about a program to spoof or make the phone send fake:
GPS location,
IMEI,
phone number,
simcard id,
etc... information to applications that ask without permission.
this way you can feed these application with information they want but without breaking your privacy. (both end sides are more than happy)
-----
nice option to have:
1) enable/disable auto generate different id every time.
2) allow list / ban list of application to have real or fake id.
3) enable/disable notify for application request.
-----
there are all ready applications that fake your simcard PLMN mobile network codes without the need of kernel rights, but you need to enable disable the flight mode to restore the default code.
===========
good luck to spoofidroid or similar applications.

Jumba said:
My concern is how much another real time service will affect battery life. For people trying to make the leanest, fastest kernel I'm not sure it's viable.
Click to expand...
Click to collapse
I hope there will be developers out there who prioritize privacy/security over speed/battery and storage usage.

I'm the project lead of the TaintDroid system. We are currently working on a few extensions of TaintDroid but unfortunately are short on engineering resources to port TaintDroid onto other systems than Nexus One that we originally developed. We'd greatly appreciate it if XDA developers would take on this effort! Many ongoing projects would hugely benefit from having easy-to-run TaintDroid ROM available for many different devices and upcoming Android systems let alone user benifit.
Thanks,
Jaeyeon
Research Scientist @ Intel Labs Seattle

Ettepetje said:
I also learned that several of my bought applications are constantly forcing me to enable synchronisation and/or 3G internet. They either randomly uninstall (Asphalt 5), their icons disappear (for example: Mini-squadron) or won't start, with (Schredder Chess) or without a message. Angry Birds Beta2 lite (free game) and Hungry Shark are 2 more examples. So much for an incentive to buy games...
Click to expand...
Click to collapse
beta2 lite? i think that was malware, make sure it came from rovio otherwise it's fake and you should delete it.

It's really scary to see with the lookout app how many apps can access to your imei, telephone number "Read Identity Info", can access your contacts, track your position, and can send out all this data.
Here a HTC Desire user, asking for some privacy.
Best regards!

Contest: Win a ARM CORTEX M0 Development Board

We're giving away a STM32 F0 DISCOVERY development board.
Contest
Enter your idea in this thread
add pictures, links, video or whatever else you can add.
Do anything you can (except create new accounts) to get people to click the thanks button
Contest ends Saturday, 23 June 2012
Winner gets a STM32f0 Discovery board
Rules
Anyone caught creating new accounts will be disqualified. There are automated systems in place for detecting this which alert admins and senior moderators to pay attention to your new account for review.
One post per person. Multiple posts will be deleted. No exceptions
Use of social media (Google+, Twitter, Facebook, Youtube) are encouraged.
TLDR
You have one week. Put your idea in this thread, then get on your favorite social media service to get people to click that thanks button on your post.

I'm going to use it to educate myself.

I'm going to use it to write a High performance micro kernel (i will later fix up for cortex-A8, HD2 ) and for testing the ARMASM code i write, (which i currently test on my only phone, HD2 and it's painful to do so thanks to HTC's SPL, MPU, NAND fatigue and the fact that i need it working the next day).
It has Thumb (2) support so i will try my hand at that too, thumb2 promises quite a lot of code density with somewhat the same performance.
Also I'd be porting the Little Kernel to it, which already has support for cortex-M3

I'll use it to make the word a better place........just joking ......mass destruction awaits if i get that........so don't give it to meh.

Basically because I have no idea how to use a development board, I'm gonna use it to learn how to use one and also learn to code which is something I have been looking into. So yeh....

i will use it to develop a better wireless usb card. i already have one. a arthos 2255. i would like to mod these too together for use with any O.S. my idea would be that you just plug and play. kida like a gui. you plug it in and a window comes up and you can see the progress of it emulating it self into your system O.S and any hardware without internet. might have to put bigger a storage device. but it can be done.. AND I WILL DO IT!

Nerdie stuff
Well im going to mod my phone and learn how to be a android developer

I want to add it to my LEGO collection >
I am joking around ... I love u developers

I'm going to find out what it is.

Unboxing video and then blend it
Sent from my XT910 using Tapatalk 2

What I'll do with it...
I would try and create a WiFi cracker with it by connecting a WiFi midule to it and also try to run the Android OS on it, and finally I would do some home automation on it, DLNA and remote controlling various things.
Please hit thank you!
I really really want this...

I will build full framework that connects your Discovery to internet (home network => public IP, if you have one), runs web server, gathers data from all over the house via NRF24L01-based wireless network (another small ATTiny based modules with humidity, temperature, .. sensors, controlling lights and power etc) and provides them on web page.

I would give it one of the devs for the lg optimus thrill/3d because I'm not a dev but it would probably help development for my device greatly and mabie we could get some good stuff going on this phone

I would use it to play around with android.

*se-nsei. said:
I'm going to find out what it is.
Click to expand...
Click to collapse
Hahaaha, I'm in the same boat with you

I would use it to develop a custom AOSP-based image for use as a low-cost media tablet, with IR, DLNA, Remote Control and a TV tuner for the ultimate lounge room accessory.

A Real Car-puter
I would use it, in conjunction with an application board, to build a carputer...not one that allows you to listen to or watch pirated media. One which will automate things such as wipers and headlights. For the wipers, my car has only one intermittent setting so I would like to add in more settings. Maybe also look into rain sensors at some point but not initially. Headlights will be controlled by time (automatically coming on at night)and light sensors to turn on lights during daytime hours when lighting conditions are poor or if I am driving through a tunnel). Also use speed limit information hacked from gps maps to light up my dash gauges with different colours depending on my current speed and the posted speed limit (Red > 5% over speed limit, green for 10% under to 5% over the speed limit blue > 10% under the speed limit and no colour for missing speed limit information.
I know the usage is light for such a board but it leaves room for expansion and the projects I have here seem to be a good starting point for learning with.
Future projects could include controlling things such as ignition, doors and windows, heating etc from my phone and eventually building a customised alarm system. Also, some sort of laser mounted to a servo that will project a line/image onto the road to give following drivers a guide to what distance they should be from you depending on the speed you are travelling.
Good luck to everyone that enters.

First, I would learn how to use it then use it to get the Robitics merit badge(im in scouts) and show other scouts how to do it. I would also integrate it somehow into my science project that will help people(still have some planning to do :/) for school.
Good Luck

I'm going to use it to build a giant robotic Obama

im going to use it for education and i will be using it for my 2 final years of high school making automated systems in my engineering and IT Classes!

Map app looking for suggestions and/or some help

Basically for my final project were working with an external company that want stuff done for free or very close, this includes an android app.
The app I'm going to try to make will be private for the company to give out locations using google maps and gps/geolocation.
The app will be distributed through the site we are developing to certain users and not featured on the marketplace due to privacy issues.
Problem is I've never developed for android or any mobile platforms and have an extremely basic knowledge of Java but i mainly develop for web and windows using c# so naturally I have a few questions for people with experience in android development.
And it will be compatible from android 2.0 onwards
1. Is it possible to have the app powered by google maps?
2. Any suggestions of how one user will be able to upload gps coordinates to this app?
3. Rough idea of how long it would take e.g. few hours, few days, few months?
4. Overall is it possible, any problems I might run into?
5 Any Advice, tips,or better suggestions?
Thanks a lot for reading this far, any answers or help would be greatly appreciated.

altering gps

Im a java programmer new to android. Im currently doing some research into geo location based services and privacy and want to develop an app that can counter the privacy concerns.
I want to develop a security app for a college project that can alter my gps co-ordinates on my device, thus fooling all other apps on my phone into thinking I’m somewhere else, may be another country or just a mile away.
I am aware that there are apps out there in the play store to do this, but I'm not sure how I could implement it myself.
I believe there are classes and methods that can be used. such as Location and setMockLocation. I could use some advice or a point in the right direction.
I believe these methods and classes are normally used for testing purposes but I wonder If I could use them to say fool a service into thinking I’m in my city, but not in my neighbourhood.
Any help, advice would be greatly appreciated

I know this is a late response but better late than never.
I'm sure your intent is benign, but this is precisely the sort of thing frowned upon by the community. Think about it. If an app is allowed to spoof a location, all sorts of fraud could take place. Also, i would assume that any classes provided by Java/crapdroid would be "read only" when it comes to GPS.
That being said, what you can try doing is manually switching off the GPS radio, and then hard-coding a location in your app. For example something like:
int main(void) {
SomeClass.setLocation("Seattle");
}
Normally this is bad practice, and inflexible.
The other thing you can do is sort out your location (city, state, country) based on IP address and adding logic in your app to use that info without ever touching the GPS.
I would also urge you to use GPS location sparingly for 4 primary reasons
1.) You are never guaranteed the user has a device with a GPS radio. Even if s/he has one, there is no guarantee that such radio is turned on in the first place
2.) We don't live in a perfect world. GPS location may not be accurate. For example it may say "Seattle" if you're in the Seattle metro area but that could mean anywhere from Tacoma to Bellingham (a pretty large area)
3.) GPS uses power. This may be a mute point somewhat, but its still valid.
4.) Location services are not always provided by a GPS radio. usually android settings allow for a "hybrid" location approach based in part on your GPS radio, and in part on cellular radio triangulation, and / or relying on your wifi and/or cellular data. This links to point 2 above as well.
Hope this helps in some way

Since my original post, I have pursued my objective, and successfully spoofed the location of my device, Android provides a number of possible ways to do this. I font think the intent is frowned upon at all. My app provides privacy. It cant really be used to commit fraud. Any good forensics investigator would still be able to determine if a location had been spoofed.
There are at least 50 similar apps available on google play store. You should try one

[Advice] Developing a 'kiosk' app - which watch / approach for a prototype?

Good evening - I'm a long time lurker at XDA and have gleaned a lot of useful information from this site, so thanks for that.
I have a client who is looking to build prototype for a device containing only one app, for a very young market, which will be the only app runnable on the device (think a smartwatch tamagotchi) - the priorities are that there's bluetooth, wifi and an accelerometer fully accessible to the app, and that the watch be relatively cheap. Now, while I've been a developer and sysadmin for a number of years, this is my first Android or wearable project, so I wanted to see if anyone had any useful tips on approaches to take, and devices to try for this prototype. (Also, I know the idea of locking down a device like this might be an anathema to people posting here. See this as an academic exercise in what's possible.)
As far as the approach goes, it seems to me I have a few options:
- Get a watch already running Android Wear, develop the app using Google's APIs and see if I can the modify the OS to boot into a single app.
- Get a (probably cheaper) watch which I can then flash with a ROM built by someone else, but will still allow me to access the accelerometer, then lock this down
- As above, but build my own ROM, containing only my app.
As far as devices go, we've had a look at some £20 Chinese wonders with MediaTek MT2502 chips, but I couldn't see how I'd get into them to flash a new ROM and I could't find anyone here using the same model. I've been looking at the MOTOACTV, which I see has many fans, but am also quite happy to consider other (particularly cheaper) alternatives, as long as I'll be able to develop something for them, get to the accelerometer and eventually send data to a server.
Sorry for the long post. Any advice?