Google Play Store 'flaw' puts users'
details on display
by: By Claire Porter,
technology editor
From: news.com.au
February 15, 2013 5:15AM
Millions of Google
customers have had their personal details exposed after massive security hole
was discovered in the Google Play store
EVERY time you purchase an
app on Google Play, your name, address and email is passed on to the developer,
it has been revealed.
The "flaw" -
which appears to be by design - was discovered by Sydney app developer, Dan
Nolan who told news.com.au that he was uncomfortable being the custodian of
this information and that there was no reason for any developer to have this information
at their finger tips.
You may remember Mr Nolan
as the creator of the Paul Keating insult generator all that hit number one in
the Aussie App Store last month."
"Let me make this
crystal clear, every App purchase you make on Google Play gives the developer
your name, suburb and email address with no indication that this information is
actually being transferred," Nolan wrote on his blog.
"With the information
I have available to me through the checkout portal I could track down and
harass users who left negative reviews or refunded the app purchase."
Harrassment aside, the
problems posed by malware - "virus" programs that infect your phone,
or computer and steal your personal details - are far more serious.
With Google customers'
details just sitting in developers accounts, all it would take is a half decent
piece of malware software for that information to be accessed. These personal
details could then be used to access the users' bank details. That's also more
than enough information to be able to access your other devices which could
also be mined for more data - insurance information, other credit cards - which could then be used to access your
banking credentials.
Mr Nolan told News.com.au
that tens of millions of Google customers could be affected.
"As far as I can tell
this impacts every person who purchased an App on the Play Store," he
said.
"I can't see any way
to opt out of providing that information and it seems to be a feature of the
Google checkout process. I don't know whether it applies to free apps, but
there are hundreds of thousands of apps that are available for pay on the play
store and there are millions of people who buy Android apps out there, I'd say
easily millions or tens of millions of people.
"It's active in every
market that Google accepts payment for apps. That's a lot of people having
their personal information handed over without them knowing."
Mr Nolan told News.com.au
that user information has always been provided to developers, "as far as
he could tell and that the reason it hadn't been discovered until now was
because the people who would have paid attention to it were likely exploiting
it and selling users' personal information, it using it as an extra source of
revenue on top of what they were making off their Google Play / Android app.
"In comparison to the
information you get from Apple which is just a quantity of sales in a Country
and then a cheque three months later, this is absolutely absurd," he said.
"I doubt anyone
expects to have their contact information, name and suburb sent to a developer
purely because they decide to buy an app off the Play Store. "
Google's terms of service
state that it may store your personal information including your name, address
and billing details, but nowhere in its privacy statement does the company
explicitly state that it passes on your personal information to developers,
every time you purchase their app.
The terms of service state
that Google will share your address and personal information if you purchase a
magazine subscription through Google Play, but it makes no mention of other
apps.
"This is a massive
oversight by Google," Nolan wrote on his blog.
"Under no
circumstances should I be able to get the information of the people who are
buying my apps unless they opt into it and it’s made crystal clear to them that
I’m getting this information. This is a massive, massive privacy issue Google.
Fix it. Immediately."
Google has not responded
to news.com.au's request for comment.
Comments
Post a Comment