search

Exodus-Privacy / exodus

Platform to audit trackers used by Android application
https://reports.exodus-privacy.eu.org/
GNU Affero General Public License v3.0
616 stars 62 forks source link

Identify new trackers #40

Closed U039b closed 5 years ago

U039b commented 6 years ago

In https://reports.exodus-privacy.eu.org/reports/37/:

U039b commented 6 years ago

To add a new tracker, follow this schema of description:

### Tracker name
* Website: xxxx
* Comment: xxxx
* Category: [Analytics, Advertising]
* Code signature: `xxx`
* Network signature: `xxx.com`
* Maven repository: `xxx.com`
* Artifact ID: `xxx`
* Group ID: `xxx` 
* Gradle: `xxx`
* Additional links: xxx xxx
* Notes: xxx
U039b commented 6 years ago

AppLovin

Avocarrot

NativeX

seandiggity commented 6 years ago

trying to untangle Baidu location tracking... the maps and location are so closely related in the code I've seen.

Baidu Maps

WeChat Location

seandiggity commented 6 years ago

A quick note - older versions of Tune tracker use the com.mobileapptracker name for the SDK.

Tune

seandiggity commented 6 years ago

Updates to SafeGraph. Much more detail at https://github.com/YalePrivacyLab/tracker-profiles/blob/master/trackers/SafeGraph.md

SafeGraph OpenLocate

seandiggity commented 6 years ago

HyperTrack

seandiggity commented 6 years ago

Uber Analytics

seandiggity commented 6 years ago

Lisnr

seandiggity commented 6 years ago

SilverPush

seandiggity commented 6 years ago

Shopkick

seandiggity commented 6 years ago

Alphonso

seandiggity commented 6 years ago

Smaato

seandiggity commented 6 years ago

Scandit

seandiggity commented 6 years ago

we need to decide how to handle / untangle Google Maps and Location services as well. At the least, the presence of the location services listener should be considered a tracker.

Google Maps

Google Location Service

U039b commented 6 years ago

Inrix

seandiggity commented 6 years ago

Signal360

kaputnikGo commented 6 years ago

Signal360 use the Manchester decoder for logic 1s and 0s. This is probably similar methodology for other audio beacon companies. http://ww1.microchip.com/downloads/en/AppNotes/01470A.pdf

seandiggity commented 6 years ago

thanks for the heads up, I'm sure you're right about this being the most common method. Some of these audio beacons use amplitude, but that's very limited (FidZup's method, if we trust the patent applications). Most seem to use frequency and what they call "frequency shift keying", which is slight changes in frequencies for 0s and 1s. Hypothetically, they could do much more frequency shifts within that 18kHz to 20kHz range (LISNR claims up to 22kHz but I don't know of devices that have that capability), and then they could do hex or the alphabet even.

What's unclear to me is how they have enough bandwidth to get complex data across the wire... the amount of time that someone is in proximity to a speaker with their microphone could be very limited.

kaputnikGo commented 6 years ago

one technique is this: pulses of 1ms, for 32 ms duration == 32 bits clock pulse (carrier-like) between logic 0 and logic 1 frequency serves as centre freq and start bit. audio as modulated 1s and modulated 0s 20550 to 21000 for logic 0 21000 to 22000 for logic 1

so if the sdk process hears the carrier frequency it can then start listening for the repeated modulated signals, create a historical cache of recorded signals and then process them for any candidates. If we assume the signal is unique to time and location then all the sdk needs to do is ping the server with a heard beacon message of a specific type.

seandiggity commented 6 years ago

we should talk off-thread, but that's potentially ~24KB per minute at most? something like that?

seandiggity commented 6 years ago

Byyd (Adfonic)

Mixpanel

Phunware

Gimbal

seandiggity commented 6 years ago

Google Usage Stats

kheops2713 commented 6 years ago

I just came across Segment (https://segment.com), a tracker that happens to be integrated into Mattermost, a self-hostable chat platform that is very popular now in the FLOSS community.

One of their client, whose use of the data looks the most cynical to me: https://segment.com/customers/xo-group

They do seem to be collecting data from Android as well: https://segment.com/docs/sources/mobile/android/. Interestingly enough, their Android client/library (I am not sure what I am talking about) seems to be open source.

seandiggity commented 6 years ago

Thanks. We do have Segment listed as a tracker in Exodus, but it would be great if you could provide more detail in this thread so that we can fill out the tracker profile more completely. Try to take a look at some of the more detailed profiles above, or the ones we did at https://github.com/YalePrivacyLab/tracker-profiles

https://reports.exodus-privacy.eu.org/trackers/62/

mildis commented 6 years ago

NewRelic

seandiggity commented 6 years ago

Changes to Signal 360:

Signal360

seandiggity commented 6 years ago

Matomo (Piwik)

kaputnikGo commented 6 years ago

Lisnr

add new code signature due to new sdk lib, 6.1.0.0:

seandiggity commented 6 years ago

We've got LISNR here: https://reports.exodus-privacy.eu.org/trackers/79/

And the related Signal360: https://reports.exodus-privacy.eu.org/trackers/86/

LISNR and Signal360 have some kind of business relationship, and it shows in apps by developer YinzCam like this one: https://reports.exodus-privacy.eu.org/reports/1351/

The other big LISNR developer is Aloompa. Please e-mail me with any of their apps we might have missed from the Exodus list above and we'll scan them.

BillCarsonFr commented 6 years ago

AppBrain

BillCarsonFr commented 6 years ago

AppAnalytics

BillCarsonFr commented 6 years ago

AppSee

BillCarsonFr commented 6 years ago

Countly

BillCarsonFr commented 6 years ago

MixPannel

Required Permissions INTERNET/ACCESS_NETWORK_STATE/BLUETOOTH

BillCarsonFr commented 6 years ago

Apptentive

sanpii commented 6 years ago

Neerby

kaputnikGo commented 6 years ago

Carnival

kaputnikGo commented 6 years ago

Taplytics

kaputnikGo commented 6 years ago

Snowplow

kaputnikGo commented 6 years ago

Estimote

kaputnikGo commented 6 years ago

Adobe

kaputnikGo commented 6 years ago

Radius Networks

BillCarsonFr commented 6 years ago

AccountKit

jawz101 commented 6 years ago

since @Atavic referenced this from my host file repo, I don't know if the network signature are what DNS record strings are contained within an app or if its based on what domains are seen in a live test of an app. If it's based on live traffic, the host file on the repo he referenced has a bunch of additional subdomains for some of these companies that might help with detections. I'd been gathering them on my phone via Adaway and NetGuard logs for a few years.

also, the domain for FB's accountkit is graph.accountkit.com I just turned on logging in NetGuard and ran a few apps I know have the library and that's the domain it connects to.

Adobe Mobile Marketing 's domain traffic goes to 2o7.net Gimbal connects to analytics-server.gimbal.com, api.gimbal.com Tapylitics: api.taplytics.com, ping.taplytics.com Mixpanel has a few at mixpanel.com as well as cdn.mxpnl.com ... and so on.

I've wanted to reach out to VirusTotal to see if they could pull together some sort of collection of url's the've seen in apk files to see if I could find all of the analytic companies but I doubt they'd do that :/

U039b commented 6 years ago

MAdvertise

U039b commented 6 years ago

Retency

U039b commented 6 years ago

@jawz101 network signature is a regex matching domains where collected data is sent to.

U039b commented 6 years ago

TeleQuid

U039b commented 6 years ago

Smart Where

seandiggity commented 6 years ago

@jawz101 Not a bad idea, but not possible all the time. Sometimes we're working backwards from the SDK information we find online (from vendor/tracking company documentation or available source code).

SafeGraph/OpenLocate is a good example, where we have yet to find the SDK in apps but we know a lot about it through news stories and published source. In a case like that, we want Exodus to have the signature and be prepared to find it in submitted apps.