Protecting Privacy - Compiling TaintDroid into Kernel to find leaky apps

Search This thread

vasra

Senior Member
Jun 3, 2009
375
50
Most people don't yet know that many Android software leak all sorts of information to the internet with only scant user acknowledgement (basically what you accept when you install the app).

Due to this and the fact that there are already privacy information harvesting apps for Android on the marketplace - a team of security experts have created TaintDroid:

What is TaintDroid?
From the project's web page: "A realtime monitoring service called TaintDroid that precisely analyses how private information is obtained and released by applications "downloaded" to consumer phones."
From: http://appanalysis.org/index.html


How can I install TaintDroid?
As TaintDroid is currently compiled into the kernel, you cannot easily install it, but you have to cook your own kernel. Instructions (for Nexus 1) are available at the project web site: http://appanalysis.org/download.html

How does TaintDroid work?
Here's a video demonstrating how TaintDroid works once it is installed and configured:
http://appanalysis.org/demo/index.html

Why would you want to install this?
There can be many reasons for installint TaintDroid:

- You want to learn about privacy features and play with Android kernel
- As it is currently impossible to differentiate between innocent and sneaky Android apps based only on what access rights they request, you may want to dig in deeper
- You are worried about what apps are doing behind your back and you want to know which apps to uninstall
- You want to help create Android a more secure and privacy-protected platform, instead of the swiss cheese it currently is

What can you do?
As compiling kernels is mostly beyond the reach of mere mortals currently, consider cooking TaintDroid into your kernel, if you are cooking one yourself and offering it available for others to try and use.

Hopefully increased awareness and usage will bring this program eventually into other modders and perhaps even Google's attention and something more easily accessible is offered for the public at large.

BTW, I'm just a user, interested in getting TaintDroid on my own Galaxy S. I'm not affiliated with the research program, but I like what they are doing. This information is purely FYI.
 

Ettepetje

Senior Member
Aug 30, 2010
317
76
+1

Since we cannot expect information gatherer Google to come up with a good privacy protection mechanism soon I think we are forced to take measures ourselves.

I also learned that several of my bought applications are constantly forcing me to enable synchronisation and/or 3G internet. They either randomly uninstall (Asphalt 5), their icons disappear (for example: Mini-squadron) or won't start, with (Schredder Chess) or without a message. Angry Birds Beta2 lite (free game) and Hungry Shark are 2 more examples. So much for an incentive to buy games... :rolleyes:

It would be great if applications used a well-defined mechanism to check their validity on-line, and not have this sneaky, lingering attack from all sides to any privacy or battery consumption aware user. :)
 

Antonyjeweet

Senior Member
Jun 28, 2009
60
0
Oss
I can not cook Kernels, but this is something i want to use.

Not that i am worried, but i dont know what apps are sending when you open them. Thats something i want to know!

I am sure i am not the only one.
 

_JKay_

Retired Recognized Developer
Aug 12, 2010
5,495
14,689
+1

Yes please... This should be in all android phones... as a security option you could turn on!!!
 

Ettepetje

Senior Member
Aug 30, 2010
317
76
Not that i am worried, but i dont know what apps are sending when you open them. Thats something i want to know!
And do some of these applications only send stuff when you open them?
--

From a user perspective it currently is really difficult to judge applications that need to start at boot-up and deal with many facets of your computer (Launchers, tools combining lots of divers features).
 

exadeci

Senior Member
Jul 21, 2010
855
316
Sydney
I've posted in hardcore and laststufo kernel threads to ask if they could add it.
We just need more people wanting it so they think about adding it:D
 

sunwee

Senior Member
May 8, 2009
517
60
+1 support the idea. hope some of our hardworking kernel builders will add this in.
 

Jumba

Senior Member
Nov 16, 2008
1,155
704
Johannesburg
My concern is how much another real time service will affect battery life. For people trying to make the leanest, fastest kernel I'm not sure it's viable.
 

SpaceCaseDave

Member
Sep 19, 2007
43
1
I have been wanting TaintDroid built into android by default since the day it was announced, but I really do not think google cares about this, so please, please ROM cookers out there (Maybe Doc?), lets add this into our galaxy S roms.
 

subZYX

Member
Oct 25, 2010
14
1
Make it so.

+1

Combined with walldroid (or other firewall) this could put back power into users hands. Would really love to see this inside hardcores kernel. Maybe as an option for the stable releases? ;)
 
Dec 24, 2006
38
13
idea about spoofidroid application

how about a program to spoof or make the phone send fake:
GPS location,
IMEI,
phone number,
simcard id,
etc... information to applications that ask without permission.

this way you can feed these application with information they want but without breaking your privacy. (both end sides are more than happy) :D

-----
nice option to have:
1) enable/disable auto generate different id every time.
2) allow list / ban list of application to have real or fake id.
3) enable/disable notify for application request.

-----

there are all ready applications that fake your simcard PLMN mobile network codes without the need of kernel rights, but you need to enable disable the flight mode to restore the default code.
===========
good luck to spoofidroid or similar applications. :D
 
  • Like
Reactions: jyjung

jyjung

New member
Dec 29, 2010
1
1
I'm the project lead of the TaintDroid system. We are currently working on a few extensions of TaintDroid but unfortunately are short on engineering resources to port TaintDroid onto other systems than Nexus One that we originally developed. We'd greatly appreciate it if XDA developers would take on this effort! Many ongoing projects would hugely benefit from having easy-to-run TaintDroid ROM available for many different devices and upcoming Android systems let alone user benifit.

Thanks,

Jaeyeon
Research Scientist @ Intel Labs Seattle
 
  • Like
Reactions: underv0ltage

behelit

Senior Member
Sep 7, 2008
259
12
Melbourne
I also learned that several of my bought applications are constantly forcing me to enable synchronisation and/or 3G internet. They either randomly uninstall (Asphalt 5), their icons disappear (for example: Mini-squadron) or won't start, with (Schredder Chess) or without a message. Angry Birds Beta2 lite (free game) and Hungry Shark are 2 more examples. So much for an incentive to buy games...

beta2 lite? i think that was malware, make sure it came from rovio otherwise it's fake and you should delete it.
 

alojo

Senior Member
Feb 24, 2011
279
41
OnePlus 8 Pro
It's really scary to see with the lookout app how many apps can access to your imei, telephone number "Read Identity Info", can access your contacts, track your position, and can send out all this data.

Here a HTC Desire user, asking for some privacy.

Best regards!
 

Top Liked Posts

  • There are no posts matching your filters.
  • 1
    idea about spoofidroid application

    how about a program to spoof or make the phone send fake:
    GPS location,
    IMEI,
    phone number,
    simcard id,
    etc... information to applications that ask without permission.

    this way you can feed these application with information they want but without breaking your privacy. (both end sides are more than happy) :D

    -----
    nice option to have:
    1) enable/disable auto generate different id every time.
    2) allow list / ban list of application to have real or fake id.
    3) enable/disable notify for application request.

    -----

    there are all ready applications that fake your simcard PLMN mobile network codes without the need of kernel rights, but you need to enable disable the flight mode to restore the default code.
    ===========
    good luck to spoofidroid or similar applications. :D
    1
    I'm the project lead of the TaintDroid system. We are currently working on a few extensions of TaintDroid but unfortunately are short on engineering resources to port TaintDroid onto other systems than Nexus One that we originally developed. We'd greatly appreciate it if XDA developers would take on this effort! Many ongoing projects would hugely benefit from having easy-to-run TaintDroid ROM available for many different devices and upcoming Android systems let alone user benifit.

    Thanks,

    Jaeyeon
    Research Scientist @ Intel Labs Seattle