Security and Outsourcing


Really wonder how outsourcing has become a point of technical discussions :-)

Comments

Post a Comment

Popular posts from this blog

Android Shared User ID and android:process

      Android's shared user id (android:sharedUserId) is a way for different applications to share the same user id for permissions, which lets them access their data and host their components in other process space. By declaring a new sharedUserId in the manifest, a new user id is creating during installation and is ready to be used by other applications provided they are signed with the same certificate and one such use is to update android:process of an application component to host it in other process space.    However, if the applications don't share a user id and aren't signed with the same certificate, a new process is launched with the same name as in android:process and this new process automatically shares userId with the requested application.    If the applications share user id and and aren't signed by the same certificate, the installation of the apk would fail.     If the applications share user id and are signed by the ...
Read more

Android - Marshmallow WifiInfo's getMacAddress()

Image
     Android Marshmallow changed the behavior for WifiInfo's getMacAddress() due to privacy concerns. The API wasn't removed or deprecated instead was just updated to return a default address 02:00:00:00:00:00. The intention is to block access to device's hardware identifier using WiFi and Bluetooth APIs. In addition, any background wifi or bluetooth scan is shown as being generated by random mac address starting from Android 6.0. This doesn't let tracking softwares like the ones used in coffee shops, malls do what they used to do, study customer behavior without their knowledge, just because they had their wifi or bluetooth turned on by default. This is similar to what Apple did to iOS8. In Android 6.0, there are still few apps like Settings which continue to have access to the mac address. This is accessed via Settings > About Phone > Status or via Settings > WiFi > Advanced.      Is there any other hidden API that might return the...
Read more

Disappearing facebook chat heads

Image
      I was curious about the implementation of Facebook's chat heads launched few weeks back as a part of Facebook Home. Wondered if chat head was an overlay or being written directly to the surface but it didn't make sense for the framework to grant such control to an app and Facebook's home and chat head was being distributed as just yet another app from App store. So how does it work. Turns out that Chat head uses a public API, SYSTEM_ALERT_WINDOW  and App store lets users know about this permission and that the app might display content on top of other applications.     In android UI, all controls need a context to be created and Chat Head is no exception and is created by Facebook messenger application (com.facebook.orca). Killing Facebook messenger application clears active Chat Heads as the context isn't valid anymore. Based on the ownership of chat heads, it is indeed vulnerable to low memory killer, even t...
Read more