search

kercre123 / wire-prod-pod

49 stars 9 forks source link

Question regarding ads queries #18

Closed raymck closed 1 year ago

raymck commented 1 year ago

My wire-prod-pod VM is making a lot of DNS queries to mobile app tracking sites, advertising sites, googlevideo.com, youtube, tiktok ads, etc, etc. All of these aren't getting past my DNS hole, but I'm curious what is doing it and wanted to raise awareness.

Is this one of the binary blobs doing this? I'm not great at grep, but I've not found anything else that would be causing this. I'm running only wire-prod-pod in a bare-bones debian VM.

raymck commented 1 year ago

I see now the update with the SDK app. I'm pseudo-randomly guessing that the original app was lifted mostly whole, along with all the cruft.

kercre123 commented 1 year ago

I have not seen wire-prod-pod make any requests to any URLs other than the ones for the weather API and Houndify. Are you absolutely sure it is coming from wire-prod-pod? The only proprietary blobs involved with wire-prod-pod are the Picovoice libraries, and even then I have looked through the blob and couldn't find any of the URLs mentioned.

raymck commented 1 year ago

After further investigation, this turned out to be an error in Pi-hole. A junk android tablet for facebook and games had MAC Randomization turned on and that confused Pi-hole. It was showing the tablet with escapepod as the hostname, as well as wire-pod. The entries in the log were identical until examining all devices. I apologize for the noise!