How Angry is That Bird?

10230457_sThe news regarding the NSA and its British counterpart discussed how the Angry Birds app was targeted as a means to collect personal information about app users. Presumably the agencies were collecting data that the app was already accessing as part of its normal operations. What data is being accessed and should it concern us?

We performed a behavioral analysis on Angry Birds for Android with our mobile application reputation service. Here’s what we found.

Our first analysis was to determine whether Angry Birds contained known malicious code, or malicious behaviors. Fortunately, it’s clean in both cases.

Next we analyzed Angry Birds’ behavioral characteristics against several pre-built application security policies. Policies can be created to look for specific code capabilities, Android permissions, location tracking, etc. Based on the items mentioned in the news stories, we focused on the personal information privacy policy (which btw is also a good idea for healthcare companies – see Caitlin’s post Food for Thought: Mobile Application Security & HIPAA).

Angry Birds received seven violations in the code capabilities section of the privacy policy.

Category Code Item
Sensitive Information Access Unique Device Identification Information
Information like phone number, IMEI, etc.
Sensitive Information Retrieve SIM Card Information
Contains code that may reveal the serial number of your SIM card as well as information about the provider network with which it is attached.
Sensitive Information Retrieve Information About Device Type
Contains code capable of finding the device brand, model and/or version of the operating system.
Sensitive Information Monitor Device Location
Code is present that may track the location of the device based on cellular network and or/gps. This is also aware of when the location changes.
Sensitive Information Retrieve Carrier Information
Contains code that may identify and retrieve information about your mobile service provider.
System Access Monitor Device Statistics
Code is present that allows for the tracking of device information such as battery status, signal strengths, network traffic and cpu performance.
System Access Listen for Key Presses
Contains code to listen for key and touch events and take action via callbacks. While this is a normal API enabled ability it may be combined with other nefarious methods.

In regards to geo-location, Angry Birds received one code capability violation and one permission violation.

Category Code Item
Sensitive Information Monitor Device Location
Code is present that may track the location of the device based on cellular network and or/gps. This is also aware of when the location changes.
Permission android.permission.ACCESS_COARSE_LOCATION

Angry Birds is currently the 18th most popular game for Android in the Google Play Store. All 100 top free games in the Google Play Store have code capabilities violations for privacy/personal information policy, many with a similar granularity of violations. Compared to other top 100 free games, Angry Birds is categorized as one of the least risky for malware and privacy.

The larger problem ties back to comments made by Chris Eng, Vice President of Veracode Research. Chris said that it’s more complicated than complaining to an app developer to stop requesting certain pieces of information from its users’ smartphones. “If I don’t want an app to know my location, the developer could say, ‘I’m planning these new features that rely on location information,‘” he told ABC News. “That’s where you run into these sorts of issues with apps that leak these sorts of info.” Many apps “are communicating to servers without any encryption,” said Eng. “Apps that don’t encrypt everything in transit are open to eavesdropping.

Source of quote: http://abcnews.go.com/


Want to learn more about building secure mobile apps, check out:

Developer’s Guide to Building Secure Mobile Applications Infographic

Webinar: What Are Employees’ Mobile Apps Doing Behind Your Back?

NelC | January 30, 2014 9:19 am

You’d think that encrypted transmissions would be mandated by the OS.

Please Post Your Comments & Reviews

Your email address will not be published. Required fields are marked *

RSS feed for comments on this post