{"id":974,"date":"2014-11-25T18:25:54","date_gmt":"2014-11-25T18:25:54","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=974"},"modified":"2014-11-27T04:35:50","modified_gmt":"2014-11-27T04:35:50","slug":"what-the-hell-uber-uncool-bro","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2014\/11\/what-the-hell-uber-uncool-bro\/","title":{"rendered":"What the hell Uber? Uncool bro."},"content":{"rendered":"

\"New-Logo-Vertical-Dark\"<\/a><\/p>\n

Howdy ho! <\/p>\n

This is one of those interim posts where I’m not posting something cool, but rather something that’s bothering me. You know, like a blog post?<\/p>\n

Anyways, I downloaded Uber the other day and its pretty cool and handy. The only qualm I had was with all the permissions it asked for. <\/p>\n

You can see the permissions the app wants to use by viewing the “AndroidManifest.xml” file inside the APK. just open the thing with 7zip and view it. Unfortunately doing this will yield garbage data. \"droid1\"<\/a><\/p>\n

The easiest way I’ve seen is to use a tool like xml-apk-parser<\/a>.
\n\"droid2\"<\/a><\/p>\n

Now we can get a clearer picture of what the heck it wants permission to use:
\n<\/p>\n

\n
<uses-permission<\/span> android:name=<\/span>"android.permission.ACCESS_COARSE_LOCATION"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.ACCESS_FINE_LOCATION"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.ACCESS_NETWORK_STATE"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.ACCESS_WIFI_STATE"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.CALL_PHONE"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.CAMERA"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.GET_ACCOUNTS"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.INTERNET"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.MANAGE_ACCOUNTS"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.READ_CONTACTS"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.READ_PHONE_STATE"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.USE_CREDENTIALS"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.VIBRATE"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.WRITE_SETTINGS"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.WRITE_EXTERNAL_STORAGE"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"com.google.android.providers.gsf.permission.READ_GSERVICES"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<permission<\/span> android:name=<\/span>"com.ubercab.permission.C2D_MESSAGE"<\/span> android:protectionLevel=<\/span>"0x00000002"<\/span>><\/span>\r\n<\/permission><\/span>\r\n<permission<\/span> android:name=<\/span>"com.ubercab.permission.NOTIFY_ACTION"<\/span> android:protectionLevel=<\/span>"0x00000002"<\/span>><\/span>\r\n<\/permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"com.ubercab.permission.C2D_MESSAGE"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"com.google.android.c2dm.permission.RECEIVE"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<uses-permission<\/span> android:name=<\/span>"android.permission.WAKE_LOCK"<\/span>><\/span>\r\n<\/uses-permission><\/span>\r\n<\/pre>\n<\/div>\n
Christ man! Why the hell would it want access to my camera, my phone calls, my wifi neighbors, my accounts, etc? We’ll see in just a second.<\/p>\n
<\/p>\n
\n
public<\/span> void<\/span> run()\r\n      {\r\n        Looper.prepare<\/span>();\r\n        InAuthManager.getInstance<\/span>().updateLogConfig<\/span>(this<\/span>.val<\/span>$URL, this<\/span>.val<\/span>$acctGUID);\r\n        InAuthManager.getInstance<\/span>().sendAccountsLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendAppActivityLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendAppDataUsageLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendAppInstallLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendBatteryLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendDeviceInfoLog<\/span>(this<\/span>.val<\/span>$transID, true<\/span>);\r\n        InAuthManager.getInstance<\/span>().sendGPSLog<\/span>(this<\/span>.val<\/span>$transID, true<\/span>);\r\n        InAuthManager.getInstance<\/span>().sendMMSLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendNetDataLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendPhoneCallLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendSMSLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendTelephonyInfoLog<\/span>(this<\/span>.val<\/span>$transID, true<\/span>);\r\n        InAuthManager.getInstance<\/span>().sendWifiConnectionLog<\/span>(this<\/span>.val<\/span>$transID);\r\n        InAuthManager.getInstance<\/span>().sendWifiNeighborsLog<\/span>(this<\/span>.val<\/span>$transID);\r\n      }\r\n    });\r\n<\/pre>\n<\/div>\n
Why the hell is this here? What’s it sending? Why? Where? I don’t remember agreeing to allow uber accedes to my phone calls and sms messages. Bad NSA-Uber. <\/p>\n
There’s a lot of code to go over. The thing is about 7.5 MB of classes. In fact, the code I snagged from above comes from about 1100 lines of code. See  for yourself<\/a>. I especially liked the ‘hasHeartbleedVulnerability()’ method. Why do they want to know that? Later exploitation?<\/p>\n
Going through the licenses.html file in the apk file, theres a software suite missing.
\n\"droid4\"<\/a>
\nSee it? Stericson.RootTools<\/p>\n
Google helps:
\n\"droid3\"<\/a><\/p>\n
Why the hell would they need this? I know I keep asking questions, but here’s some answers: Uber checks to see if your device is rooted. It doesn’t tell you of course, it just wants to know so it can phone home and tell them about it. I also saw checks for malware, application activity and a bunch of other stuff.<\/p>\n
[Correction] They use REST, not webdav. Thanks to everyone who pointed that out. Derp. <\/p>\n
Like I said before, there’s a lot of data here to go through. Maybe Uber evil. Maybe Uber isn’t sending a bunch of data off to their collection servers for harvesting. Maybe I’m just paranoid. <\/p>\n
Stay tuned for my next post, its gonna be good. I know I said that last time, but this is more of a blog post than an actual post. <\/p>\n
\"1405103297032\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Howdy ho! This is one of those interim posts where I’m not posting something cool, but rather something that’s bothering me. You know, like a blog post? Anyways, I downloaded Uber the other day and its pretty cool and handy. The only qualm I had was with all the permissions it asked for. You can […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,7],"tags":[96],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/974"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=974"}],"version-history":[{"count":7,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/974\/revisions"}],"predecessor-version":[{"id":988,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/974\/revisions\/988"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}