LateX

Thursday, May 22, 2014

Exploring limits of covert data collection on Android: apps can take photos with your phone without you knowing.

SHORT VERSION: Android apps can take photos with your phone in background phones without displaying any notification and you won't see the app on the list of installed applications. App can send the photos over the internet to their private server. You can also find video with demo in this post.

Introduction

http://all-free-download.com/free-vector/vector-clip-art/surveillance_camera_clip_art_18240.html (camera)

I discovered this almost by accident while doing a team project for a Computer and Network Security course at my university. The project suggested by college of mine (Predrag Gruevski) was mostly about using cameras on PC's without turning on indicator light. There were already promising findings in this field (iSeeYou paper discussed doing so on old Mac models). Since the project was relatively general each of member of our team took different approach. I initially started with low-level USB hacking, but despite genuine efforts I found nothing really interesting. Further experiments seemed really boring to me, because they in general involved trying various different cameras and hours of starting at LED light hoping the camera light won't blink.

android


I switched my focus to Android. Initial research was promising. There are many apps on Play Store (if you are iPhone user think App Store) that aim at taking pictures without any visual indication (ACLU-NJ Police TapeMobile Hidden Camera and more) but from what I found all of them require app activity to be visible and phone screen to be on. Some of them manage to record video without visible preview. 


Technical Details

What I wanted is to take pictures without user knowing, but at any time, not only when the app is on. I started googling and first thing that I found is that using Camera technically requires a preview to be displayed on screen in order to take video, but background services do not have associated visible activity. But let's not get discouraged an keep trying. I wrote a small camera app for my Nexus 5. My first approach was to create a View object that is not attached to any activity and feed preview to that object. That fails (I literally get "take picture failed" exception). The I remembered something that later turned out to be very relevant. Facebook messages draws to the UI, even when the app is not technically running:


This turned out to be indeed the right track. I attached preview to the screen from the background service and indeed I was able to take a photo! This is not yet ideal - the preview is visible on the screen user can clearly see that something is going on. But then I tried to remove it. Here's a list of approaches:

  • Make preview invisible - failed: Android just ignores this setting for preview
  • Make preview transparent - failed: Android just ignores this settings for preview
  • Cover preview by another view - partially failed: the view on top is still obstructing the screen
  • Make preview 1x1 pixel - successful
The result was amazing and scary at the same time - the pixel is virtually impossible to spot on Nexus 5 screen (even when you know where to look)! Also it turned out that even if you turn the screen completely off, you can still take photos, as long as the pixel is still there. 


Demo


If you cannot see this video here's a direct link: https://www.youtube.com/watch?v=sDzs6y4JVok

How can you protect yourself form malicious apps?


If you are as disturbed by this find as I am you will start asking what can we do to avoid such situations. The bad news is that it's kind of a cat and mouse game - no matter how hard you try attackers can find more ways to obfuscate malicious activity. The good news is there are some ways that seem (at least given my current knowledge hard to circumvent:

  1. Pay attention to permissions (for example does Simple Notepad* really need access to your camera?)
    lock
  2. Keep your Google Account secure - if somebody can access your Google account they can install apps on your phone remotely without you approving it! Set up two step verification. Change your password from time to time. Set up secure password
  3. Uninstall unused apps. 

    battery                    internet
  4. High battery consumption (settings -> battery), and high bandwidth (settings -> data usage) are potential culprits


  5. Look at the background services that are running (settings -> apps -> running) - does Simple Notepad* really require background service
  6. Swiping app out of application list does not switch off background services (if you want to completely switch it off go to App Info (long press app icon inside menu and drag it to app info section) and click force stop - this ensures no background services are running. As @LB points out "force stop" effect is not permanent (technical: The service can be started again by registering and receiving an intent). 
*Simple Notepad is a made up example - I am not referring to any app in particular.


(hopefully constructive) criticism of Android design decisions

Let me start by the fact that I really like Android SDK (maybe except the fact that it's Java - but I understand the logic behind that decision). It's nice because it gives a developer a lot of power. There are just some things that are possible on Android that simply would not be possible on other platforms.

However given the fact that privacy is recently more and more of a growing concern, it would be nice to adjust accordingly. In my opinion privacy can be achieved by transparency without sacrificing comport. I could imagine use cases where I want app to take photos from background service. But I think it's inexcusable that user is not notified about this face. Android has a very nice notification bar. Users are very used to it. Why not make a use of it here. Same goes for sounds recording location recording etc.

Another thing I think Android team should look into is modern security research. There's lot of ways of using data without direct access. Very simple example would be that can send emails to users without learning their email address - with Google acting as a intermediary.

All of those suggestions can be summarized in on sentence - please put more effort into ensuring users' privacy. 


Sunday, March 16, 2014

Tinder autoliker


Tinder is an app that is a recent craze among dating apps. It is good because it is simple and before you know it you are chatting with potential partner. That's the theory. In practice, like every dating app it is overloaded with males and suffers from shortage of females. This means that males need to like many many girls before they get a match. In fact better strategy is to just like every girl and then discard the ones you don't like once you get a match. But that means that you need to very annoyingly keep on clicking like for entire day. Well, not anymore...

To save my phone's battery and preserve mobility, I spawned an android emulator (part of standard android SDK). I downloaded Tinder 2.2.1 SDK from the web and installed the app by issuing:

adb install tinder-apk-file

which almost got me a working tinder app except, it was stuck at finding matches screen. After a bit of digging and thinking about possible reasons I realized it's missing a location. This could be fixed by issuing:

telnet localhost 5554

and then typing:

geo fix longtitude latitude 

Where latitude and longtitude can be obtained for example here . Don't forget to check that you got the right spot by typing where am i in Google on emulator. After that's done we have a working tinder app on emulator and all we need to do is simulate touches, which can be done by monkeyrunner (in tools directory in android sdk). I was originally using this script but I modified it to randomize click time and click location in case Tinder did some bot detection. To run the script simply type: (sometimes you will get Java errors - just run it second time, they will be resolved):

./monkeyrunner your-script.py 

Below is a simple demo:

Good luck and have fun!

Wednesday, September 25, 2013

A step towards understanding women and people in general.

DISCLAIMER: All the ideas presented here are not based on any scientific research. They are based on my personal observations and some ideas I had, which when combined revealed surprisingly simple model of the way human mind works. Above all remember that everybody's different and that's how you should think about it.



Let's think about what You are. By You I mean your mind, your soul, your intelligence, your consciousness - different names for a part of you that makes you who you are. Let's call it the essence. The exact definition of the essence is area of current research and I apologize but I cannot be more specific. I can only hope that you have similar picture of an essence in your mind as I do. Until recently, I used to think of an essence as something that describes who you are in a very stable almost mathematically consistent way. Recently I changed my views. It's quite a big change and as all big changes it starts with very simple thing



During one of the evening chats with my girlfriend she confessed that she thinks that having a guy friend who does not think about having sex with her at all seems impossible. She said she's curious if there's any friend she has for whom this thought never stroke his mind. Since I am male I immediately know that she's very unlikely to find such a person and I begun to explain why. I said that for all guys there's always this background thought which always causes us to relate our actions to possibility of having sex. Happens with almost every woman we talk to. This is basically an evolutionary instinct that is always present. However since humans are intelligent, we often choose to damp this instinct or tunnel it towards person/people we care about. For example a lot of people choose to direct it towards their partners and make it a catalyst for good sexual experience. I explained to my girlfriend that since we can control it to some degree it should not be perceived as a good or bad thing, it's just there and one should accept that. But the probability of finding a guy who does not have it is small.


She did not seem convinced, so I tried to give her an analogy. She often says that she's much more productive at work and in general when people approve what she does. She needs me to say that she looks good, that I like various aspects of her personality. When she does something stupid in front of other people she gets really sad. This is a manifestation of an need of approval and attention that most of women have. It is also evolutionary. The more popular women are more likely to have sex and therefore the total number of people grows. But here is the interesting part. Most of women do not associate this instinct with sex. They don't have to. It's enough that evolution "knows" that popularity leads to sex. Women do not have to. Again this is just an instinct. It's NOT a defining quality. Women can control it, damp it or tunnel it. For example my girlfriend tunnels it towards career. She only feels really good if somebody approves of her achievements, rather than just saying she looks good.



Now this analogy, I made it up as I was saying it and it was quite a realization to myself as well. All this time I was saying that she should not look at what other people think, that should only work for herself and that her becoming better should be enough in itself. Before that sounded reasonable. But now I realize that asking it is like somebody asking me to stop any sexual thought and activities completely. In theory possible, but in practice it is an instinct that is hard to completely cancel, plus it feels good to satisfy it from time to time. I realized I was wrong all the time. From now on I won't try to stop her from seeking approval. Rather than that I will maybe try to remind her from time to time that it's just an instinct she controls. I will also try to tell her about why I like her so much more often.

I was really proud of my discovery - "a step towards understanding women" - that's quite a thing. But I did not stop there. More and more things were falling into pattern.



Emotions. Those are also a bit like instincts - instinctively I should feel negative feelings to somebody who shouts at me. But I am an intelligent human. I understand these emotions. I can choose to damp my negative feeling towards this person and make a realization that that person shouting at me is probably a manifestation of some build up of stress that this person reasonably accumulated. 



Selfishness. Lot of experienced people say that everybody eventually think about themselves. I think this is just another instinct - the better my needs are satisfied the more likely am I to survive and reproduce. Like all the other instincts it can be controlled, damped and tunneled. I can choose not to follow it sometimes. I can decide I want to be less selfish and decide that at a given moment I will do a selfless action. Obviously from time to time I need to be egoistic. That's how instincts work. I sometimes decide to "forget" about skype chat with somebody who wanted to ask questions about my university. "Forgetting" about it gives me more time to spend with my girlfriend. I am conscious this happens and I try to consciously allow or disallow it, keeping in mind I cannot completely block it. 

These observations changed the way I look at the soul, the mind, the essence. I no longer think about it something mathematically consistent. It is this highly variant thing that needs to balance various instincts and signals. Instincts and signals from our senses are so complicated that it's absolutely amazing that the essence assembles them into equilibrium that seems to be a stable thing - You, yourself are very special human being - You stroke this balance in unique way. You stroke this balance in a stable way - when I meet with You I know You and can always tell that it's You by observing your personality. This emerging phenomenon is truly spectacular. I am proud to be an intelligent human being!

DISCLAIMER 2: Making a small step towards understanding women for me required 5 years and 3 months of a relationship. IT IS HARD.


Monday, August 12, 2013

The new humans


Commonly expressed opinion:
People spend too much time in front of their computers and therefore their social life is poor.
This simple conclusion cropped up a lot when I was trying to come up with new uses of technology to enhance social interaction. On my way I consulted many friends and spend quite some time thinking about it. One day I decided to consult my parents. They are both over 60 years old and not that up to date with technology, so as usual I tried to use very simple words and omit unnecessary details. This paradigm shift eventually resulted in me thinking about this problem in completely new way and I thought it is interesting enough to share it here.

Human kind is evolving. We are undergoing a transition from humans to the new humans. The main difference between the new humans and humans is that they are all connected to each other and the surrounding world. It is an undeniable fact that the former are one step higher in the evolution ladder - the new humans are capable of telepathy (the new Skype), telekinesis (flying items controlled over wireless protocols), auto diagnosing (by systems of sensors installed in body).

We are not quite there yet, but it is blindingly obvious what direction we are going. First, we started with desktop computer, but it was annoying to have to come back home each time we needed to use it. Then laptops were invented - just find a convenient place to seat and you are connected. Sadly, laptops are quite big and inconvenient to carry around. So the mobile revolution happened parallel to usability revolution. Just take your phone out of your pocket and you are connected. Moreover you no longer need to be a computer genius - everything's just few taps away. Currently we are slowly switching to virtual glasses (like Google Glass), so that we no longer need to reach into our pocket - everything we need is just there; but you still need to wear glasses. What will happen next? Where does it stop? Probably in a few generations we will arrive at the stage at which we are permanently connected. Possibly just some mass produced implant that is easily integrated with our brain using DNA nano-robots or whatever new technology we come up with. Naturally, this all comes at a price, but covering those issues would require separate post.



There's no coming back in evolution. Ask yourself this question: would you rather lose an eye or be permanently disconnected from internet for life. Losing an eye is quite terrible, you are twice as close to becoming blind as you were before, but it's not too bad either. You cannot accurately estimate some distances, but you still see all the things around you etc. Losing connection to internet deprives you of global perspective. You become much less than you were before. For me the answer is quite obvious, but it feels unnatural to prefer technological advancement to crucial human body organ.

Getting back to the statement from the beginning of the post. I claim that it is not that technology makes our social life poor. It greatly enhances our ability to socialize - we can keep in touch over great distances, be up to date with what was happening to our friends (and that's just a single website - Facebook). Technological advancement by itself is not the problem. Humans, currently undergoing evolution, are still adapting to the new situation. This ticket to evolution is not purely biological - it is technological and technology is still imperfect. This is confusing and time-consuming and therefore impacts various areas of our life, including social interaction. We are lost in the new reality that unveiling in front of us. And that's the real problem.

How to fix it? There are two ways. First one is simple, but inefficient: wait for humans to adapt. It is also dangerous - facing such a dramatic changes we are risking loosing parts of our identity being consumed by the process. The humans will make inefficient choices - spending too much time consuming low quality content (reddit, 9gag), accepting information without verification (internet pseudo-statistics), inability to think for themselves (example only using internet jokes in conversations: "you don't say", "that escalated quickly" etc.). There's also second solution. Investing significant resources in proper education on use of technology. This way a greater number of people will start using technology in a responsible way and transition will be less devastating to other areas of our lives. Our choices right now are impacting how the new humans civilization will shape. Let's not screw it up!




Monday, July 29, 2013

Trip to Hawaii (part 2)

Day 3 - flight to Maui

Early in the morning we went to give back our car to Enterprise and went by taxi to the airport. Our taxi driver turned out to be an ex Vietnamese War soldier. Apparently there's lot of them in Hawaii and they spawned quite high percentage of current population there.





Flight to Maui was very short and comfortable, Hawaiian Airlines rules! In the plane we learned from the newspaper that some people in Hawaii make their living from searching for wedding rings and other jewelry on the shore using a metal detector. The one that was interviewed by a newspaper claims that he tries to find the owners first at local hotels (but does he?). We got some photos of both islands from bird's-eye view:

O'ahu

Maui (can you see wind turbines?)


We got to Hawaii and having learnt from our mistakes we got a car immediately. We drove to the city where we stayed (Lahaina). On our way we saw marvelous views, example:


  






Upon arrival to the hotel we were greeted by an extraordinary nice french lady, that explained a lot about what we can see in Maui, asked us about our plans and borrowed us Maui travel guide. 




We dumped our stuff in the room and went to restaurant near the hotel (for which we got 15% discount from the hotel lady). 
We ordered what was listed in a menu as "Today's catch". It was really tasty, but quite expensive. Which eating we notice we start to sweat. Maui was much hotter than O'ahu. My personal hypothesis: Maui is a much wilder island and there's not so much carbon dioxide emissions, so the sun is not blocked. 


We took a short walk along main street in Lahaina - there was a lot of art galleries, organized tour stands (btw. some of the tours had very weird age requirements - the minimum age of 30 years old - especially the ones called swimming with dolphins). We also saw Chinese art museum which also had cinema room showing 40s movies of Tomas Edison:


At the end of the street there was a Forrest Gump themed restaurant:



After that we decided that we will end the day by just snorkeling on some beach. After short internet research we chose Kapalua bay, which later turned out to be an excellent choice. The water was crystal clear, there was almost no people, small waves - ideal for snorkeling. We saw plenty of sealife: crab colonies on the stones near the shore, large schools of big and colorful fishes further from it and finally as we were just about to leave the beach we saw giant 1-1.5 meter long turtle! It was very friendly and it was not swimming away even when we got close to it and touched it. Also which we were swimming we saw a Hawaiian wedding on the beach!





We ended the night by going to another local restaurant where we ordered cookie pizza and a milkshake.





Day 4 - way to Hana

The day before while walking around Lahaina we noticed some people trying to sell this t-shirts:


Naturally, we decided to go for it. The road was awesome. It felt like need for speed game. The views were spectacular and we had a few interesting stops on our way. I loved it. Agnieszka not so much:




Also here are some of the views we saw on the way:









Our first stop were beautiful private gardens, that somebody decided to make available for public, but places smoothie and fruit stand at the entrance. It sounds like the business is great all the time we same them they were busy serving customers. We ourselves ordered an pineapple smoothie and it was delicious.


 We walked on short 1 mile trail inside the garden and while the trail itself was interesting...





...the final attraction was amazing - the twin waterfalls:




Next stop we attempted to visit local lava cave (which as we learned is owned a one person and he makes my out of it by lending flashlights) and botanic garden, but first one was too much time, second one was closed. 

We also visited local airport near Hana, but it wasn't too exciting:



On our way we noticed a lot of fruit stands, which would be boring on it's own if not the fact there was no person guarding it. You just come take fruit, put money in the box and leave. That would definitely not pass in Poland :)


At that point we decided that it would be nice to swim a bit, so we headed for the interestingly named black sand beach. We weren't dissapointed - it was a beach and the sand was black. I also personally like the strong waves - stronger than any other place in Hawaii that we visited:





That and getting some gas in Hana was one of our last stops after which we decided to head back after getting some gas and buying a dragonfruit:



 Not to repeat the way we decided to go south of Hana. The way was much more curvy and wild and also as we later learned much more dangerous due to falling rocks. To add to it when it rails the rocks usually fall down and block the road (as we later that day learned from the local taxi driver) and while it was raining when we drove there, nothing like this happened to us. 












On our way back we passed a road that is periodically closed due to river that sometimes appears. We also almost hit some animals, which we frequently passing the road and almost invisible at night. 

We finished out day by ordering a Hawaiian Plate at Da Kitchen Cafe in Kahului, which despite good opinions on yelp we did not like. In town they had a festival, but sadly it finished before we arrived.

Day 5 - the volcano

In the morning we checked out of the hotel and we proceeded to visit a volcano. The way to volcano was awesome and so were the views:



For some reason it is very popular there to bike down the way from the top of volcano:

 

At the very top it looked like mars surface you see in the movie - large plains of red stone. There was also an astronomical observatory, which was apparently due to its remote and high location one of the best ones in the world:




After staying for a short while on the top of the mountain, we headed back to Enterprise to give back our car. Rest of the day we spend walking around Kahului. Started with a walk along the beach, where we saw a lot of kite surfers:



When we got to the downtown, we went to Thai Restaurant, we tried to mail some postcards, but Post Office was closed. We ate some homemade pineapple icecream - the best icecream I ever eaten in my entire life. After that we tried to sunbathe for a bit, but the sun was hiding behind the clouds.


So we went back downtown and watched a movie - Pacific Rim - it was very bad and nobody should ever watch it. After the movie we took the cab to the airport and flight back to O'ahu, spend the night on the airport and flew back home.

In general the trip was amazing and I highly recommed it to anybody. If I were to change one thing I would chose less known island to visit, because it seemed like the less known it was, the nicer it was to visit.

The end