Security Researcher claims Uber’s app is literally Malware

The popular ride-sharing service Uber has been hit by various controversies lately, but now the things gone even worse for the company when a security researcher made a worrying discovery this week and claims, "Uber’s app is literally malware."

Researcher, who runs a cyber security firm in Arizona, just reverse-engineered the code of Uber’s Android application and come to the conclusion that it is a malware. He discovered that the app "calls home" and sends data back to the company.

The ride-hailing company is in disputes of handling privacy of its customers data. A Phoenix-based security researcher Joe Giron found that a surprising amount of users’ data is being collected by the company’s mobile application for Android.

The ride-driving company might have some legitimate reason to make use of most of this collected information in the app, perhaps for fraud detection or an intelligence-gathering tool. But, the problem is that the information is being sent and collected by Uber’s servers without any knowledge or permission of the app user. Neither the extent of the data the Uber app collects seems to go beyond the data set shown on its permissions screen.

Here we present you a long list of everything the Uber Android app can have about its users, revealed by a thread on Ycombinator:

• Accounts log (Email)
• App Activity (Name, PackageName, Process Number of activity, Processed id)
• App Data Usage (Cache size, code size, data size, name, package name)
• App Install (installed at, name, package name, unknown sources enabled, version code, version name)
• Battery (health, level, plugged, present, scale, status, technology, temperature, voltage)
• Device Info (board, brand, build version, cell number, device, device type, display, fingerprint, ip, mac address, manufacturer, model, os platform, product, sdk code, total disk space, unknown sources enabled)
• GPS (accuracy, altitude, latitude, longitude, provider, speed)
• MMS (from number, mms at, mmss type, service number, to number)
• NetData (bytes received, bytes sent, connection type, interface type)
• PhoneCall (call duration, called at, from number, phone call type, to number)
• SMS (from number, service number, sms at, sms type, to number)
• TelephonyInfo (cell tower id, cell tower latitude, cell tower longitude, imei, iso country code, local area code, meid, mobile country code, mobile network code, network name, network type, phone type, sim serial number, sim state, subscriber id)
• WifiConnection (bssid, ip, linkspeed, macaddr, networkid, rssi, ssid)
• WifiNeighbors (bssid, capabilities, frequency, level, ssid)
• Root Check (root staus code, root status reason code, root version, sig file version)
• Malware Info (algorithm confidence, app list, found malware, malware sdk version, package list, reason code, service list, sigfile version)

 Uber responded to the issue and said in a statement to Cult of Mac, "Access to permissions including Wifi networks and camera are included so that users can experience full functionality of the Uber app. This is not unique to Uber, and downloading the Uber app is of course optional."