Google 'flaw' puts users' details on display

[Erica Absetz <eabsetz () opensecurityfoundation org>]

http://www.news.com.au/technology/massive-google-security-flaw-puts-users-details-on-display-for-all-to-find/story-e6frfro0-1226577210852

EVERY time you purchase an app on Google Play, your name, address and
email is passed on to the developer, it has been revealed.

The "flaw" - which appears to be by design - was discovered by Sydney
app developer, Dan Nolan who told news.com.au that he was
uncomfortable being the custodian of this information and that there
was no reason for any developer to have this information at their
finger tips.

You may remember Mr Nolan as the creator of the Paul Keating insult
generator all that hit number one in the Aussie App Store last month."

"Let me make this crystal clear, every App purchase you make on Google
Play gives the developer your name, suburb and email address with no
indication that this information is actually being transferred," Nolan
wrote on his blog.

"With the information I have available to me through the checkout
portal I could track down and harass users who left negative reviews
or refunded the app purchase."

Harrassment aside, the problems posed by malware - "virus" programs
that infect your phone, or computer and steal your personal details -
are far more serious.

With Google customers' details just sitting in developers accounts,
all it would take is a half decent piece of malware software for that
information to be accessed. These personal details could then be used
to access the users' bank details. That's also more than enough
information to be able to access your other devices which could also
be mined for more data - insurance information, other credit cards -
which could then be used to access your banking credentials.

Mr Nolan told News.com.au that tens of millions of Google customers
could be affected.

"As far as I can tell this impacts every person who purchased an App
on the Play Store," he said.

"I can't see any way to opt out of providing that information and it
seems to be a feature of the Google checkout process. I don't know
whether it applies to free apps, but there are hundreds of thousands
of apps that are available for pay on the play store and there are
millions of people who buy Android apps out there, I'd say easily
millions or tens of millions of people.

"It's active in every market that Google accepts payment for apps.
That's a lot of people having their personal information handed over
without them knowing."

Mr Nolan told News.com.au that user information has always been
provided to developers, "as far as he could tell and that the reason
it hadn't been discovered until now was because the people who would
have paid attention to it were likely exploiting it and selling users'
personal information, it using it as an extra source of revenue on top
of what they were making off their Google Play / Android app.

"In comparison to the information you get from Apple which is just a
quantity of sales in a Country and then a cheque three months later,
this is absolutely absurd," he said.

"I doubt anyone expects to have their contact information, name and
suburb sent to a developer purely because they decide to buy an app
off the Play Store. "

Google's terms of service state that it may store your personal
information including your name, address and billing details, but
nowhere in its privacy statement does the company explicitly state
that it passes on your personal information to developers, every time
you purchase their app.

The terms of service state that Google will share your address and
personal information if you purchase a magazine subscription through
Google Play, but it makes no mention of other apps.

"This is a massive oversight by Google," Nolan wrote on his blog.

"Under no circumstances should I be able to get the information of the
people who are buying my apps unless they opt into it and it’s made
crystal clear to them that I’m getting this information. This is a
massive, massive privacy issue Google. Fix it. Immediately."

Google has not responded to news.com.au's request for comment.

UPDATE: This story has been amended at the request of Google.
_______________________________________________
Dataloss-discuss Mailing List (dataloss-discuss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://datalossdb.org/mailing_list

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security equips organizations with security intelligence, risk
management services and on-demand security solutions to establish
customized risk-based programs to address information security and
compliance challenges. 

Tenable Network Security (http://www.tenable.com/)
Tenable Network Security provides a suite of solutions which unify real-time
vulnerability, event and compliance monitoring into a single, role-based, interface
for administrators, auditors and risk managers to evaluate, communicate and
report needed information for effective decision making and systems management.