Slashdot Mirror

← Back to Stories (view on slashdot.org)

Popular Weather App AccuWeather Caught Sending User Location Data, Even When Location Sharing is Off (zdnet.com)

Posted by msmash on from the beware dept.

Zack Whittaker, reporting for ZDNet: Popular weather app AccuWeather has been caught sending geolocation data to a third-party data monetization firm, even when the user has switched off location sharing. AccuWeather is one of the most popular weather apps in Apple's app store, with a near perfect four-star rating and millions of downloads to its name. But what the app doesn't say is that it sends sensitive data to a firm designed to monetize user locations without users' explicit permission. Security researcher Will Strafach intercepted the traffic from an iPhone running the latest version of AccuWeather and its servers and found that even when the app didn't have permission to access the device's precise location, the app would send the Wi-Fi router name and its unique MAC address to the servers of data monetization firm Reveal Mobile every few hours. That data can be correlated with public data to reveal an approximate location of a user's device. We independently verified the findings, and were able to geolocate an AccuWeather-running iPhone in our New York office within just a few meters, using nothing more than the Wi-Fi router's MAC address and public data.

9 of 124 comments (clear)

  1. That free app going to cost AccWeather a fortune by JoeyRox · · Score: 4, Funny

    In lawsuits, and deservedly so.

  2. No shock by bloodstar · · Score: 4, Interesting

    After all accuweather had previously tried to convince Congress to gut the NWS so they could make money: http://www.politico.com/story/... So the idea that Accuweather would do something shady isn't without precedent.

    --
    "The bass, the rock, the mic, the treble. I like my coffee black, just like my metal" - Mindless Self Indulgence
  3. Change your router name to by bobstreo · · Score: 4, Funny

    DROP TABLE location;

  4. They can't even see their own lie by JohnFen · · Score: 3, Insightful

    we take privacy issues very seriously," the spokesperson said. "We work to have our [terms of service and agreements] as current as the law is evolving and often beyond that which may be legally required to protect the privacy of our users."

    If you're only doing what's "legally required", then you aren't, in fact, taking privacy issues "very seriously".

  5. Just sayin' by jabberw0k · · Score: 3, Insightful

    Stallman was right after all.

  6. Re:WiFi Router Name? by c-A-d · · Score: 4, Informative

    That is incorrect. Your MAC address is not contained in the IP Packet. MAC is a layer 2 addressing system while IP is layer 3. The only way for your MAC address to be shared via Layer 3 is if some application has accessed the OSI stack and pulled MAC information from that and then explicitly sent it to a server as part of a payload.

    --
    some karma... and kinda lukewarm about it.
  7. Samsung is Worse by Thelasko · · Score: 3, Interesting

    Samsung phones come with a crippled version of AccuWeather installed by default. It's integrated into the firmware and difficult to remove. Does that version track you too?

    --
    One of our competitors trademarked the term "hypothesis". From now on, we will call them "boneheaded ideas".
    1. Re:Samsung is Worse by JohnFen · · Score: 3, Interesting

      If you're using Ice Cream Sandwich or later then you can disable any app, even the ones that carriers make uninstallable. You can also root the thing and physically delete the app from storage.

  8. Skip weather 'apps', just go to Wundergound by Rick+Schumann · · Score: 3, Interesting

    Just go to Weather Underground instead, you don't need an 'app'. Or if you think that's too commercial and you're going to get tracked, then just go to the National Weather Service. Seriously, you don't need an 'app' for everything.