What can Google actually do on my phone using Google Play Services?

Question

When it comes to Android security and hardening, sources like the TOR project recommend to avoid the installation of Google Play Services (I'll call them only "the services" here). I'm aware that the following things could happen when the services are running:

• Google could add any malicious code at any time when I have internet access.

• Google could be forced to do so or somebody could exploit their infrastructure.

• The services could already contain malicious code by someone for some reason.

• There are vulnerabilities which could allow elevation of privileges and such.

But there are some problems with all these possibilities:

• There's no proof that something like this ever happened before (except the vulnerabilities. nobody could seriously deny that such a large codebase has vulnerabilities).

• They would require a targeted attack.

• It all (still) sounds like conspiracy theory for many (even technical) people.

So my question is: What can Google actually do on my phone which will breach my privacy using the services without any patching and exploits? Can they access private app data? Record keystrokes? See network communication? Manipulate what I see?

Answer 1

But there are some problems with all these possibilities:

• There's no proof that something like this ever happened before (except the vulnerabilities. nobody could seriously deny that such a large codebase has vulnerabilities).

You're in the wrong forum if you think that "it's obviously easily possible, but has not been subject to large attention" is in any way a limit to the damage that can be done.

In fact, app updates as automatically done by the Play Services have been used extensively before to remove software and intellectual property from devices, add more intrusive ads in later versions, remove functionality, add spying… pretty much the definition of "malicious", if you ask me.

• They would require a targeted attack.

No. I don't see how that is true. If google wants, it can update the home screen of millions of users at once and then later pick out the data they're interested in.

• It all (still) sounds like conspiracy theory for many (even technical) people.

Nope. It seems you're young: Back in my day (and I'm not that old), there was consensus among people that updaters are questionable, at best, and only with the advent of ever more malware, the desire to have automatic security updates outweighed the concern about unsupervised updating.

In other words: it only sounds like a conspiracy theory if you're absolutely used to running such software. If you explain to someone from the 90s or 2000s that billions of devices will update central parts of their internet-connected firmware on a single whim of a single supplier, they'd probably be a little alarmed.

So my question is: What can Google actually do on my phone which will breach my privacy using the services without any patching and exploits?

Anything. The same services, as far as I know, is used to provide system updates. These, by definition, have the highest degree of privilege on your system.

Can they access private app data? Record keystrokes? See network communication? Manipulate what I see?

Yes. Imagine someone replacing the software that interacts with you, your display and netork. That is exactly the job of a system component update.

Answer 2

It all comes down to home much you trust Google. Play Services is a self updating service that runs with elevated privileges on your phone. It doesn't follow the normal Android update process and request permission before installing a new version that has elevated permissions. I don't doubt that Google could literally do anything they wanted with the service and get any information on your phone that they wanted with it.

It does have some good security aspects as things that used to be built into the OS are now part of Play services or apps in the store that can be updated independently of the OS to fix security issues or add features but that does require placing a lot of trust in Google.

I think a more relevant consideration might be how internet connected they are and how much information the services might leak without Google having to do anything malicious. Given how things like browser fingerprinting can already help to identify someone using TOR I'd expect Play Services to easily and uniquely identify someone.

Answer 3

I did notice that Google Play Services has full control of Bluetooth, so turning off bluetooth in the settings is a waste of time. I found that even with Bluetooth off, Google play Services is constantly polling for external bluetooth devices and choosing to connect to them. The only way I found to stop some of this behaviour is remove Google play access to device settings.

Clearly this is a privacy breach and a potential vulnerability.

Answer 4

Well, the Tor project information is quite wrong, let me explain.

Tor is designed for freedom, so that anyone on the globe can browse internet anonymously. It also helps with bypassing some of the firewalls.

Since the most advanced part of the world do respect freedom of individuals and do not have anything against right to communicate with the rest of the world, there's no need for any Tor user to fear Google.

Google operates in the Free World and there's no way any that foreign government who does not respect basic freedoms would be able to force them to do anything. Especially doing any nasty stuff like hacking.

However, Tor is used by criminals however it's not the majority of users. In case you are breaking the law, you can expect Google to cooperate. It's not about breaking any particular law in particular country, it is about breaking common sense law.

So now if your freedoms are not respected and you are using Tor, you should make sure that you have all updates from Google. And Google is good and tries to make sure you do really have them all no installed automatically. In 2000s there was era of Windows XP which on the beginning had no firewall at all and automatic updates were considered "evil". This has been revised and today automatic updates are considered a requirement for any widely used software. Every major software today has automated updates (with few exceptions like Android kernels).

So the answer is: if you use Tor as it is supposed to be used, you should have Google Play installed and performing automated updates.

So the device with automated updates is really stronger than without. Tor advice is misleading and inconsistent with their mission statement.