It is not rare for a user to be requested permissions while using an application. However, many users are still in the dark as to understanding what happens when they accept the permissions the application requests. In this paper, we will be highlighting Android vulnerabilities used to abuse permission assignment for continuous sensors involved with location based services (LBSs) and GPS location data. Such vulnerabilities include user privacy awareness, ride-hailing services (RHS), side-channel attacks, and white-box and black-box attacks. We will then evaluate these vulnerabilities on the application AbuserGPS, then review and propose different defense strategies to combat these vulnerabilities within the operating system such as the Location-Privacy Preserving Mechanisms (LPPMs), the ASM framework, and MATRIX.
