App Ops or App Oops!?

Was it a mistake to include it in the first place, or to remove it after it was "accidentally released"? In this article (http://www.theverge.com/2013/12/13/5207892/eff-criticizes-google-for-android-app-ops-removal) the Electronic Frontier Foundation (EFF) criticizes Google for the removal of a hidden permissions management tool from the latest builds of Android. App Ops was first introduced in the Android 4.3 releases and continued into the Android 4.4 release. But now in 4.4.2 App Ops has disappeared.

Wait, what is App Ops? You know when you are about to download an app from the Google Play store and you are prompted to accept a variety of permissions that the app is requesting like, access to your network, your contacts, your phone calls? App Ops is (was) a tool that let you review and change the app permissions after the app had been installed on your device.

The reality is that most apps do not need all the permissions they ask for.  This is the biggest Android security issue today and is exactly what the EFF says – apps that are in Google Play are compromising your personal data and your privacy. This may be counter to the scare tactics of the AV vendors, but viruses are not a big issue on Android for the typical user (e.g. those who do not side-load nefarious apps from dodgy websites).

There have been a number of attempts at restricting permissions, including extensions to SE Android promoted by the NSA. App Ops allows a device owner to rethink their decision to allow access and "un-approve" certain permissions without having to delete the entire app. But like earlier solutions, App Ops could break some apps by removing permissions that the app needed, or because the app did not gracefully handle the lack of permissions. And this is Google's argument for removing App Ops. (Similar to why SE Android is running mostly in permissive mode, but that is another topic.)

So, do you read the permissions, or do you simply say "ok" and start downloading your app? Unfortunately, most users click “ok”. And most do not even read what permissions are requested.  And most do not understand the potential implications of granting such permissions.

And this where we differ with the EFF. We do not need a solution for a small group of power users and privacy geeks (like us at Graphite Software). If most users ignore the permissions in the first place, then what makes you think they can/will navigate App Ops?

Our product, Secure Spaces, allows you to put apps into “Spaces” or different buckets, or different rooms – whatever physical analogy works best for you. Each Space is isolated from the other. The user can broadly control the permissions on the Space, rather than per app. If your contacts are not in the Space with Angry Birds, then the game can’t access your contacts. Simple. We need simple.

Restoring Trust in Your Technology

Monday brought quite the stir in the consumer technology space. Joining forces in an open letter to President Barack Obama, eight of the largest technology companies proposed principles for reforming government surveillance laws and practices, pointing to the summer revelations about data collection by the National Security Agency (NSA) to highlight the urgent need to reform government surveillance practices worldwide.

The letter concludes with eight strong voices for reform signed on with quotes of support behind these principles. One quote in particular caught my eye. Brad Smith, General Counsel and Executive Vice President, Legal and Corporate Affairs, Microsoft said, “People won’t use technology they don’t trust. Governments have put this trust at risk, and governments need to help restore it.”

In this simple statement, Mr. Smith has brought forth an important issue that goes beyond NSA surveillance, but includes any technology whether a server, software or device. This is very relevant to mobile devices, which are extremely personal. They are with us all the time and loaded with personal information and sensors measuring precisely what we are up to.

Just as the government has to collect personal data in exchange for security, we are often asked on personal devices to allow access to personal data in exchange for free apps or services. And just like the government, in many cases the apps go too far. Last week I read yet another story about a medical app that sends your personal information to three different ad networks, including “your phone number, your device's IMEI number, your exact geo-location, the Wi-Fi access points currently in use (and used in the past)” and more.

And BYOD is another example where consumers want one device to use for home and work, yet many do not trust their companies to respect the privacy of their personal data. What some employees have found are heavy and unwieldy MDM solutions imposed by the IT department that annoy the user and handicap productivity. Such enterprise centric solutions also beg the question to the user, who is looking at my data?

When we developed Secure Spaces, we wanted to give the consumer privacy options while also meeting corporate IT security. But we did it by making the IT department a guest on your device – not the other way around. Ensuring trust is the foundation of our product, because it opens up significant new use cases even beyond consumer privacy and BYOD. With simple, easy to create and “disposable” Secure Spaces, there is a whole new world of apps to download and safely segregate. App aggregation and services, guest mode, secure banking spaces, themed spaces and distributed mobile computing are all possible when there is trust in the underlying technology. We are re-thinking not only mobile security, but fundamentally how we use and interact with these amazing devices.

Brad Smith from Microsoft is right in saying “people won’t use technology they don’t trust,” but this doesn’t mean we have to settle for a lack of trust in our technology. Let’s give users control of their devices, control of their data and perhaps a better way to model their use of mobile devices around their real lives.

Alec Main, CEO of Graphite Software 

Mobile threats - hype vs. reality

A few weeks ago Graphite Software attended CounterMeasure2013 in Ottawa. The keynote by Charlie Miller, "Mobile Threats: Hype vs. Reality" - thus the title of this blog - was excellent. Not only does Charlie have the cred - he is a relaxed and entertaining speaker. Download his presentation here.

In the security field, we often get caught up reading our own press releases. Charlie is often creating such headlines, which is what made his "reality check" so refreshing. The best part for us personally at Graphite was that the presentation was a clear affirmation of what we are doing. Here is my summary as it pertains to mobile device and specifically Android security:

1. Android has the advantages of the PC - freedom to innovate, customize and large developer community - and has addressed many of the security issues of the PC - sandboxes, permissions and an app store. Android is not perfect from a security perspective, but in the end Android will win - which is why Android is our focus.

2. Mobile Device Challenge #1: Malware and viruses are not a huge issue, compared to basic issues particular to mobile devices - they are lost and stolen. This is exactly the threat model we address with our product - Secure Spaces. (While also isolating and limiting malware.)

3. Mobile Device Challenge #2: Users vs. BYOD. Users modify and root their devices. They can unintentionally, or intentionally, download code that can access personal and work data on the device. How do you secure both personal and work data on such devices, especially when most MDM software is trivial to break? Again this is where our engineers have developed a very elegant solution - Secure Spaces.

4. The Operating System is the only place for improvement. Application-level solutions can not make a difference. Server side scanning and controls have already been largely put in place. In order to address the mobile threats above, Graphite has developed some secure and fast extensions to Android, that leverage the existing code and security mechanisms, such as SE Android. This is where the next innovation will be.

See you at CounterMeasure 2014 (or before that at CES in January)!