TLDR: Uber's Android app is literally malware
Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your:
- SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested]
- call history
- wifi connections
- GPS location
- every type of device fingerprint possible (device IDs)
It also checks if you're phone is rooted/jailbroken and if it's vulnerable to Heartbleed... which it also calls home.
From my understanding, which the author somehow missed, is that it is using http://www.inauth.com SDK which provides 'malware detection'. This SDK is popular in the 'mobile finance industry' and the banking sector. Also notably one of the founders is former DHS/FBI.
Two possible theories: it is being used for fraud detection and/or an intelligence gathering tool.
Edit: here is a copy of the decompiled source code http://www.gironsec.com/blog/wp-content/uploads/2014/11/InAu... note the name "package com.inauth.mme"
Edit #2: here is a screenshot of Uber's permission request https://i.imgur.com/4MmYrJH.png no SMS on the list
Since the website is currently down, this person reverse-engineered Uber's Android app and discovered it has code that will "call home" aka send data back to Uber with your:
- SMS list [edit: see other comments re SMSLog, SMS permission is not currently requested] - call history - wifi connections - GPS location - every type of device fingerprint possible (device IDs)
It also checks if you're phone is rooted/jailbroken and if it's vulnerable to Heartbleed... which it also calls home.
From my understanding, which the author somehow missed, is that it is using http://www.inauth.com SDK which provides 'malware detection'. This SDK is popular in the 'mobile finance industry' and the banking sector. Also notably one of the founders is former DHS/FBI.
Two possible theories: it is being used for fraud detection and/or an intelligence gathering tool.
Edit: here is a copy of the decompiled source code http://www.gironsec.com/blog/wp-content/uploads/2014/11/InAu... note the name "package com.inauth.mme"
Edit #2: here is a screenshot of Uber's permission request https://i.imgur.com/4MmYrJH.png no SMS on the list