Slashdot Mirror
Over 200 Android Apps Are Currently Using Ultrasonic Beacons To Track Users (bleepingcomputer.com)
Catalin Cimpanu, writing for BleepingComputer: A team of researchers from the Brunswick Technical University in Germany has discovered an alarming number of Android apps (234, to be exact) that employ ultrasonic tracking beacons to track users and their nearby environment. Their research paper focused on the technology of ultrasound cross-device tracking (uXDT) that became very popular in the last three years. uXDT is the practice of advertisers hiding ultrasounds in their ads. When the ad plays on a TV or radio, or some ad code runs on a mobile or computer, it emits ultrasounds that are picked up by the microphone of nearby laptops, desktops, tablets or smartphones. SDKs embedded in apps installed on those devices relay the beacon back to the online advertiser, who then knows that the user of TV "x" is also the owner of smartphone "Y" and links their two previous advertising profiles together, creating a broader picture of the user's interests, device portfolio, home, and even family members.
Cited research paper:
http://christian.wressnegger.i...
Found via the reddit thread on the same topic, It names a few of the apps, primarily using the SilverPush library.
Why aren't you encrypting your e-mail?
According to the article, offending apps seem to be mostly from India and the Philippines. They list 5 "representative apps" with developers:
Application Name Developer Version Downloads
100000+ SMS Messages Moziberg 2.4 1,000,000 – 5,000,000
McDo Philippines Golden Arches Dev. Corp. 1.4.27 100,000 – 500,000
Krispy Kreme Philippines Mobext 1.9 100,000 – 500,000
Pinoy Henyo Jayson Tamayo 4.0 1,000,000 – 5,000,000
Civil Service Reviewer Free Jayson Tamayo 1.1 50,000 – 100,000
TABLE 2: Third-party applications with SilverPush functionality
XPrivacy used to do exactly this on Android. An app wanting a GPS location? Here is one. Contact info? Here is a randomly generated list. Ad IDS? Pick a 128 bit number.