Slashdot Mirror
Popular Weather App AccuWeather Caught Sending User Location Data, Even When Location Sharing is Off (zdnet.com)
Zack Whittaker, reporting for ZDNet: Popular weather app AccuWeather has been caught sending geolocation data to a third-party data monetization firm, even when the user has switched off location sharing. AccuWeather is one of the most popular weather apps in Apple's app store, with a near perfect four-star rating and millions of downloads to its name. But what the app doesn't say is that it sends sensitive data to a firm designed to monetize user locations without users' explicit permission. Security researcher Will Strafach intercepted the traffic from an iPhone running the latest version of AccuWeather and its servers and found that even when the app didn't have permission to access the device's precise location, the app would send the Wi-Fi router name and its unique MAC address to the servers of data monetization firm Reveal Mobile every few hours. That data can be correlated with public data to reveal an approximate location of a user's device. We independently verified the findings, and were able to geolocate an AccuWeather-running iPhone in our New York office within just a few meters, using nothing more than the Wi-Fi router's MAC address and public data.
Damnit! I really like the AccuWeather app.
Now it's uninstalled.
Is it really so hard to make money with an app that user data has to be stolen to make a profit?
In lawsuits, and deservedly so.
Display ads, don't steal user data.
#DeleteFacebook
So, went on an eclipse mini-vacation and I guess drove near the vicinity of a some trigger point. The caller was asking for another name, but still proceeded to sell me a pitch for a vacation spot I had "driven past." Now, was it my credit card company, the cell phone company, or the data-only account on my tablet who was responsible for leaking my location in real time to a vendor?
I swear to God...I swear to God! That is NOT how you treat your human!
After all accuweather had previously tried to convince Congress to gut the NWS so they could make money: http://www.politico.com/story/... So the idea that Accuweather would do something shady isn't without precedent.
"The bass, the rock, the mic, the treble. I like my coffee black, just like my metal" - Mindless Self Indulgence
DROP TABLE location;
we take privacy issues very seriously," the spokesperson said. "We work to have our [terms of service and agreements] as current as the law is evolving and often beyond that which may be legally required to protect the privacy of our users."
If you're only doing what's "legally required", then you aren't, in fact, taking privacy issues "very seriously".
Apps can access the router name and MAC to know when you connect to a device to do a first time setup. A lot of IOT (*insert IOT rants here*) setup a temp hotspot that you connect to then use the app to configure it. It then shuts down the ad-hoc and connects to your local WiFi that you configure.
This obviously needs to be locked behind a permission prompt like location is. *sigh* This is why we can't have nice things....
I browse on +1 so AC's need not respond, I won't see it.
Stallman was right after all.
Get the Android version and it does offer a paid for ad-free version - AccuWeather Platinum.
That is incorrect. Your MAC address is not contained in the IP Packet. MAC is a layer 2 addressing system while IP is layer 3. The only way for your MAC address to be shared via Layer 3 is if some application has accessed the OSI stack and pulled MAC information from that and then explicitly sent it to a server as part of a payload.
some karma... and kinda lukewarm about it.
I don't install apps when a web page is sufficient.
some karma... and kinda lukewarm about it.
Samsung phones come with a crippled version of AccuWeather installed by default. It's integrated into the firmware and difficult to remove. Does that version track you too?
One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
Just go to Weather Underground instead, you don't need an 'app'. Or if you think that's too commercial and you're going to get tracked, then just go to the National Weather Service. Seriously, you don't need an 'app' for everything.
Just to be a jerk I'll mention the IPv6 EUI-64 format address. That is layer 3, or as layer 3 as IP gets.
-- I have a private email server in my basement.