Slashdot Mirror
Researchers Detect Android Apps That Connect to User Tracking and Ad Sites
An anonymous reader writes: A group of European researchers has developed software that tracks the URLs to which cellphone apps connect. After downloading 2,000+ free apps from Google Play, they indexed all the sites those apps connected to, and compared them to a list of known advertising and user tracking sites. "In total, the apps connect to a mind-boggling 250,000 different URLs across almost 2,000 top level domains. And while most attempt to connect to just a handful of ad and tracking sites, some are much more prolific. Vigneri and co give as an example "Music Volume Eq," an app designed to control volume, a task that does not require a connection to any external urls. And yet the app makes many connections. 'We find the app Music Volume EQ connects to almost 2,000 distinct URLs,' they say. [Another major offender] is an app called Eurosport Player which connects to 810 different user tracking sites." The researchers plan to publish their software for users to try out on Google Play soon.
We should know by now what are the costs of "free". That is why I use a hosts file for ad and tracking block.
I only wonder why they only tested android apps, and left out IOS apps. Without this comparison, the first paragraphs of the article, blaming the tracking and ads on the openness of Android, is little more than wistful thinking.
Dozens of external domains are not unusual anymore. Many web sites are unusable and unreadable without at least access to one CDN domain. Many also rely on script libraries on third party hosts. It's fucked up.
This would never happen if they choose the Microsoft industry standard Windows Store :)
This argument is very easy to understand, so it's a great starting point.
The first targets for a campaign for free software apps should be educational institutions and public services.
GNU.org has a good list of proprietary software packages with spyware:
https://www.gnu.org/philosophy...
Help build the anti-software-patent wiki
As Heinlein famously put it in his The Moon is a Harsh Mistress (and he was just echoing the sentiment), There Ain't No Such Thing As A Free Lunch -- or in this case, a free app.
If they're not charging you, then you (or your time, your attention, or your information) are the product they're charging somebody else for. Or as Heinlein would have put it, even at a charitable soup kitchen you're going to have to listen to a sermon.
What, you thought that every app asking for access to your contacts, wifi status and network access were doing it because it was helpful?
Doesn't Android allow the user to set permissions?
"If any question why we died, Tell them because our fathers lied."
Seems like those companies are making good use of you personal tracking devices!
It's dirty practices, but not entirely unexpected or new.
If you're getting Android apps from somewhere besides F-Droid but paying nothing, you're paying for them with ad impressions and/or personal info.
The user can see what permissions the app requires, and choose whether or not to install the app.
You need a special app with root permissions to set up your own blocks (which, of course, might break the app you are firewalling).
I agree it would have been really illuminating to do the same test for a large range of free iOS apps.
However I think that you wouldn't see the most egregious of tracking stuff going on in iOS, for two reasons:
1) iOS reviews would I think alarm on something connecting to 810 different tracking sites. Definitely f you were trying to do anything like that in the background.
2) There's simply not as much data to gather. Most Android apps ask for all possible permissions, because why not? You're probably not going to read it anyway. With the iOS permissions as they are the user is going to think "why is this app which has nothing to do with contacts, asking for contacts" (or location, or photo library, or health data, etc).
That said I'm sure many free apps on iOS are doing everything they can possibly get away with, and I would love to see quantified just what that is.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Jailbreak an iPhone, load and run Firewall IP. Download most apps from the App Store... and watch as the app connects to many, many sites before the app does a single thing.
The only difference in iOS is that there are no tools to catch a specific app in action.
I work with a guy who wrote gamespector, which was quite popular app until google kicked it our of the play store. The app can detect ads, tracking, GPS & microphone use, etc, and can remove ads from aps on rooted phones.
Are people still loading software from strangers onto devices with all their personal info? Welcome to the surveillance network.
I never really understand why folks are surprised by this kind of thing. There's nothing fundamentally different between a Windows box attached to the internet in the late 90s and a cell phone except that a heck of a lot more people have cell phones and they're easier to connect to a remote site. Both systems are perfectly happy to let you install random software you found god knows where that does god knows what. All that's really changed is the admission bar has lowered.
They should be ecstatic that all these apps do is send some tracking info to a few thousand sites.
Root phone, install hosts file, problem solved. Well, solved if you can root.
1)Not necessarily. Something as simple as not enabling that code for a month after release would get it by reviews. They aren't reviewing source code, they're reviewing behaviors. Just like you don't speed when there's a cop right behind you you wouldn't connect when you're being watched
2)They ask for a lot of permissions because the permissions aren't fine grained enough, and because polsih requires it. For example I had an app that did sound effects when you tapped a key. The OEM requested that we turn off sounds when the user is in a call so they wouldn't play on the other end. This reasonable request required a new permission (CALL_STATE IIRC), which actually gave us much more info than we wanted (we got to find out when calls started, ended, and the connection number which we didn't need). But if you just looked at our permissions your reaction would be "why do you need to know who I'm calling"? We didn't there was just no way to request less info, we didn't even look at the number.
One of the big problems was that Google redesigned the play store to be less scary and show fewer permissions. One of those was that any app could request internet permission without it showing up. That was just wrong.
What we really need is the ability to turn on and off specific permissions by app. Perhaps with the ability to limit internet permission to certain IPs/URLs per app. That would solve most of the problem.
I still have more fans than freaks. WTF is wrong with you people?
yum install tcpdump
And hence the reason customers want OnePlusOne and Cyanogenmod, because it includes a privacy tool that lets you remove the permissions from apps like 'Music Volume EQ"
http://www.androidcentral.com/cyanogenmod-updating-privacy-guard-20-new-features-coming-cm102
A similar tool was pre-released by Google in v4.3, then removed claiming it broke applications. I suspect the reality was, that if you could remove privacy invading things from apps, then lawsuits would make it work also for Google Apps and that was against Google's business model.
https://www.eff.org/deeplinks/2013/12/google-removes-vital-privacy-features-android-shortly-after-adding-them
1) The app has to declare if it's going to be doing background processing, and you have to give a reason why they will accept. So not just any app can do that.
What we really need is the ability to turn on and off specific permissions by app. Perhaps with the ability to limit internet permission to certain IPs/URLs per app. That would solve most of the problem.
I thought Google added that ability in an early 4.0 or 5.0 version of Android, but then backed it out... Sadly I think because too many apps react badly when permissions are withdrawn it expects to run. The whole model creates a bad precedent I think where you assume you'll have all the app permissions you requested and so if any are withdrawn individually (which advanced users can do) the app is prone to break even though it could carry on just fine if it had been coded to detect that one permission was disabled. Google is going to have to bite that bullet at some point.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Like cookies, spyware needs love and load balancing..
For me is that no matter how well I take care of information if someone sticks it into their Android and runs one of these apps there goes that phone number.
In fact shortly after my buddy bought a Nexus 7 (he installs EVERYTHING on it...) I started getting txt offers from Chinese retailers and my number blew up with various other issues.
Nothing for years then this...
Now I can't prove it was his device and his bad habit of installing anything, but the timing works.
"If any question why we died, Tell them because our fathers lied."
I think internally they have such a tool and use it in testing all the time. I don't predict them exposing it any time soon. It was released by accident, but pulled very quickly. And their changes to permissions on the Play Store go the opposite way.
I still have more fans than freaks. WTF is wrong with you people?
Android Apps don't ask for permissions, they list demands. Once you've installed the App, you're just forced to just live with all their demands, uninstall, or root your phone. iPhones, on the other hand, allow you to grant and revoke permissions on the fly.
I realize that here on slashdot, rooting your phone may not seem like a big deal, but it's a pain and violates my agreement with my carrier--not something I'm willing to do.
My hosts file is only blocking ~40,000 crap sites. I'd like to bulk that up to 250,000.
So wheres the list?
Since installing AdAway on my Android devices it has eliminated most of the banner adverts in apps. I wonder how the researchers results would stack up after installing AdAway.
To do something right, you often have to roll up your sleeves and get busy.
So, how many connections will their new app do?
Can we use the app to monitor the same app?
I would rather see most apps just use intents:
http://developer.android.com/g...
Need an image because you are the QR-code app ? Ask the image 'app'. The user can pick to choose the camera app and make a picture if he/she wants or grab an image from the image gallery app.
Need a contact ? Ask the contact 'app'.
Now most apps don't need any permissions any more. And the user knows what data the app gets because the user chooses the data and the app the data came from.
New things are always on the horizon
I've been forced to start removing apps from my phone.
I have an older Android phone, and don't have (or want) a data plan.
A while ago, when I got voicemail and the the notification for it, I'd get a text message from my ISP saying that something on my phone was trying to connect to the internet.
Basically some app I had had decided that it needed to notify someone when I got a phone message, but it failed because I didn't have a data plan.
Then I started removing apps and testing, and eventually got it pared down enough that it didn't happen.
Basically most apps are written by greedy bastards who don't give a crap about your privacy and your security. And if Google won't give me fine grain control to say "I don't care if *you* want to connect to the internet" and disable it, then I'm simply not going to trust the apps.
It has gotten to the point where I have to assume most software is actually hostile to me. If ti can't pass the airplane mode test, it generally gets deleted.
I would definitely install this app, and use it to identify shady apps which need to be deleted.
Lost at C:>. Found at C.
What we really need is the ability to turn on and off specific permissions by app. Perhaps with the ability to limit internet permission to certain IPs/URLs per app. That would solve most of the problem.
This is the #1 reason why I install cyanogenmod on every phone I use. It lets you deny/approve individual permissions per app.
APK Hosts File Engine 9.0++ 32/64-Bit SR-2 http://start64.com/index.php?o...
* It populates hosts files with the MOST current data for threats (& other things like adbanner blocking, trackers, phish/spam, + other malicious threats out there too) from 10 reputable & reliable sources in the security community itself, which is rarely far behind when finding say, C&C servers for botnets etc. (malwares in general),
APK
P.S.=> MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it (near the top of that site) -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus http://www.av-test.org/en/news...
... apk