search

Exodus-Privacy / exodus

Platform to audit trackers used by Android application
https://reports.exodus-privacy.eu.org/
GNU Affero General Public License v3.0
619 stars 62 forks source link

Identify new trackers #40

Closed U039b closed 5 years ago

U039b commented 6 years ago

In https://reports.exodus-privacy.eu.org/reports/37/:

kaputnikGo commented 6 years ago

Intrasonics

jawz101 commented 6 years ago

Foresee

I don't know if I'm doing this right but here's one

jawz101 commented 6 years ago

Adflake

jawz101 commented 6 years ago

Adform

jawz101 commented 6 years ago

Adfurikun

jawz101 commented 6 years ago

Smart Ad Server

jawz101 commented 6 years ago

Swrve

Iron Source

Startapp

jawz101 commented 6 years ago

Sense360

jawz101 commented 6 years ago

Rubicon Project

jawz101 commented 6 years ago

Appboy (bought by Braze)

jawz101 commented 6 years ago

Fiksu

jawz101 commented 6 years ago

Apteligent by VMWare (formerly crittercism)

jawz101 commented 6 years ago

Sensoro

jawz101 commented 6 years ago

Ensighten

jawz101 commented 6 years ago

Dynamic Yield

jawz101 commented 6 years ago

Exelate (A Nielsen Company)

jawz101 commented 6 years ago

AdFit (Daum)

jawz101 commented 6 years ago

Gigya

jawz101 commented 6 years ago

Heyzap (bought by Fyber)

SponsorPay (bought by Fyber)

jawz101 commented 6 years ago

Vungle

jawz101 commented 6 years ago

BlueKai (acquired by Oracle)

jawz101 commented 6 years ago

Apsalar

BillCarsonFr commented 6 years ago

AppNext

android.gms.permission.ACTIVITY_RECOGNITION android.permission.ACCESS_WIFI_STATE android.permission.READ_PHONE_STATE android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_COARSE_LOCATION android.permission.GET_TASKS android.permission.REAL_GET_TASKS android.permission.PACKAGE_USAGE_STATS android.permission.WRITE_EXTERNAL_STORAGE android.permission.CAMERA android.permission.BLUETOOTH_ADMIN

We recommend that your privacy policy contain language materially similar to the following:

"We allow third-party companies to serve ads and collect certain anonymous information when you visit our app. These companies may use anonymous information such as your Google Advertising ID, your device type and version, browsing activity, location and other technical data relating to your device, in order to provide advertisements".

kaputnikGo commented 6 years ago

OtherLevels

jawz101 commented 6 years ago

I wish we had this thread in a different format so we could fill in the blanks on one anothers' posts. Like the wiki tab or something.

Has anyone been able to dig into that Moat company? I can't find any information on their integration instructions out there https://moat.com. The most I have is some DNS traffic from my mobile.

apx.moatads.com
js.moatads.com
pixel.moatads.com
z.moatads.com

github searches yield imports of com.moat.analytics.mobile.* into some people's apps.

kaputnikGo commented 6 years ago

Moat

kaputnikGo commented 6 years ago

OpenX

kaputnikGo commented 6 years ago

if there are additions or blanks in the comments made then maybe list them in a new comment and we can go over our own and edit them accordingly?

jawz101 commented 6 years ago

I dunno. The wiki on here seems easier so we're not waiting on each other. And someone can easily fix even the fixes.

jawz101 commented 6 years ago

Placer

service com.placer.client.PlacerScheduler

receiver com.placer.client.PlacerReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.USER_PRESENT com.placer.action.ENABLE_PLACER com.placer.action.DISABLE_PLACER provider com.placer.library.tray.provider.TrayContentProvider
kaputnikGo commented 6 years ago

Foresee

additional SDK urls for events, surveys, whitelist:

analytics.foresee.com , i.4see.mobi , rec.replay.answerscloud.com , foreseeresults.com , foresee.com

l1git commented 6 years ago

from https://twitter.com/fs0c131y/status/977267255309463554

Website: https://clevertap.com/ Comment: "#CleverTap is the next generation app engagement platform. It enables marketers to identify, engage and retain users and provides developers" Category: Tracking Code signature: com.clevertap.android.sdk Network signature: wzrkt.com Maven repository: xxx.com Artifact ID: xxx Group ID: xxx Gradle: `` Additional links: https://github.com/CleverTap

kaputnikGo commented 6 years ago

adding to already existing listing:

InMobi

kaputnikGo commented 6 years ago

Brightcove

kaputnikGo commented 6 years ago

Integral Ad Science

kaputnikGo commented 6 years ago

PubMatic

kaputnikGo commented 6 years ago

adding to already existing listing:

Kochava

kaputnikGo commented 6 years ago

Freckle IoT

jawz101 commented 6 years ago

Big source of companies https://www.programmableweb.com/category/mobile/sdks

kaputnikGo commented 6 years ago

great find, it will take a while to go through this resource. Btw, maybe now is a good time to figure out a more efficient way of doing this, such as your suggestion for the wiki? Also a published list of categories that we should be using, cos i been adding a few such as "identity" where the SDK is gathering and sending high level PIIs.

seandiggity commented 6 years ago

A feature request might be a submission form, with two options:

Lots to work on, of course, and I won't be getting to it anytime soon but it could be added to the Exodus Web UI or even just the main exodus-privacy.org website.

kaputnikGo commented 6 years ago

Because of the way i work (static analysis, apktool etc), the main problem Im finding is that i cant get the info necessary for the LibScout requirements mentioned in Issue #38 . I worry that this is causing more work down the track, so hopefully there is a quicker more efficient way that those contributing to this issue page could get good useful tracker details ready for inclusion in Exodus. We could create a page on the wiki with Basic and Advanced sections?

seandiggity commented 6 years ago

you can sometimes find that info for #38 with dexdump, dedexer, dex2jar, etc. but not always. At least in my experience.

It's going to vary from tracker to tracker depending on the development workflow of the tracking company, the age of the SDK, whether some source is available, and so on.

Personally, I'm all ears to whatever the main contributors to this issue think makes sense. Wherever the info is submitted, it will need cleanup and checking.

@U039b care to weigh in on this?

kaputnikGo commented 6 years ago

Moca

kaputnikGo commented 6 years ago

I can usually only find maven stuff on the dev docs webpages (see above for Moca - ha, found it) , and a lot of them maintain their own repos so i can't get access unless i join up as a dev. mainly at the moment im concerned about making too much unnecessary work for @U039b and you at integrating the posts to this issue into the exodus tracker list.

kaputnikGo commented 6 years ago

Proximi

kaputnikGo commented 6 years ago

IndoorAtlas

jawz101 commented 6 years ago

Personally, I've not touched apktool nor any other inspection tools. I've just been going with domains I know about and Google for their company, "(company name) Android sdk", searching GitHub for strings like "import com.(Company name)" to find if anyone has pulled a tracker into their own programs... junk like that.

Usually only takes a few minutes of time to get some basic info. Sometimes I do score a Maven repository url but it's hit and miss. GitHub itself has been the best source lol.

U039b commented 6 years ago

Hi all!!! Thank you so much for your great job here! In order to test code signatures, I have extracted 4 234 171 unique Java class names from the 5000+ applications analyzed by εxodus. You can download the 24MB TGZ file, untar it and play like this:

grep -E "com.safegraph.|com.openlocate" uniq_list

where com.safegraph.|com.openlocate is the code signature you want to test.

I am working on the development of a collaborative platform meant to ease tracker investigation. This platform will also track all changes made on each object.

screenshot from 2018-04-01 18-25-03 screenshot-2018-4-1 change tracker django site admin

kaputnikGo commented 6 years ago

Lenddo