Researchers Detect Android Apps That Connect to User Tracking and Ad Sites 74
An anonymous reader writes: A group of European researchers has developed software that tracks the URLs to which cellphone apps connect. After downloading 2,000+ free apps from Google Play, they indexed all the sites those apps connected to, and compared them to a list of known advertising and user tracking sites. "In total, the apps connect to a mind-boggling 250,000 different URLs across almost 2,000 top level domains. And while most attempt to connect to just a handful of ad and tracking sites, some are much more prolific. Vigneri and co give as an example "Music Volume Eq," an app designed to control volume, a task that does not require a connection to any external urls. And yet the app makes many connections. 'We find the app Music Volume EQ connects to almost 2,000 distinct URLs,' they say. [Another major offender] is an app called Eurosport Player which connects to 810 different user tracking sites." The researchers plan to publish their software for users to try out on Google Play soon.
Nothing new (Score:5, Insightful)
We should know by now what are the costs of "free". That is why I use a hosts file for ad and tracking block.
I only wonder why they only tested android apps, and left out IOS apps. Without this comparison, the first paragraphs of the article, blaming the tracking and ads on the openness of Android, is little more than wistful thinking.
Re: (Score:2)
Yes, there is such a thing as a free app. Hundreds actually. Before Apple ruined it for everybody by starting the app gold rush, the free software world was expanding. Now everybody is led into temptation to "monetize".
Excuse me: But just HOW did Apple "ruin it for everybody"?
The "App gold rush" was there because of the insane iPhone sales, and because of Apple's stupendous and unique (at the time) distribution model.
Re:TANSTAAFL (Score:5, Interesting)
As Heinlein famously put it in his The Moon is a Harsh Mistress (and he was just echoing the sentiment), There Ain't No Such Thing As A Free Lunch -- or in this case, a free app.
If they're not charging you, then you (or your time, your attention, or your information) are the product they're charging somebody else for. Or as Heinlein would have put it, even at a charitable soup kitchen you're going to have to listen to a sermon.
I don't think cost explains or excuses this phenomenon. There is always a motive for doing anything but traditionally much of it was side projects, hobbies, getting famous, filling resumes, PR and making money off pay version upgrades... the primary goal was never making money by fucking people over until the rise of the app store.
There must be countless hundreds of unique pieces of "free" software I use all the time on my desktop.. none of it is engaged in this bullshit.
The culprit in my view are perverted market pressures brought about by existence of app stores.
There is no useful quality filter.. You don't go to Walmart and walk out with a "free" or $3 PS4 title. When everything is free people who want to publish real software get fucked over by everyone expecting free or $1.50 while their product appears as just another piece of flotsam in a vast ocean of mostly useless crap.
Couple this with undeserved global exposure all apps automatically get regardless of whether they deserve it or not and feedback loops that make profiting from advertising and spying networks easy for app vendors and you get the current cesspool of mediocrity and hostility.
The review, it does something... as does sandbox (Score:2)
I agree it would have been really illuminating to do the same test for a large range of free iOS apps.
However I think that you wouldn't see the most egregious of tracking stuff going on in iOS, for two reasons:
1) iOS reviews would I think alarm on something connecting to 810 different tracking sites. Definitely f you were trying to do anything like that in the background.
2) There's simply not as much data to gather. Most Android apps ask for all possible permissions, because why not? You're probably not
Re:The review, it does something... as does sandbo (Score:5, Informative)
1)Not necessarily. Something as simple as not enabling that code for a month after release would get it by reviews. They aren't reviewing source code, they're reviewing behaviors. Just like you don't speed when there's a cop right behind you you wouldn't connect when you're being watched
2)They ask for a lot of permissions because the permissions aren't fine grained enough, and because polsih requires it. For example I had an app that did sound effects when you tapped a key. The OEM requested that we turn off sounds when the user is in a call so they wouldn't play on the other end. This reasonable request required a new permission (CALL_STATE IIRC), which actually gave us much more info than we wanted (we got to find out when calls started, ended, and the connection number which we didn't need). But if you just looked at our permissions your reaction would be "why do you need to know who I'm calling"? We didn't there was just no way to request less info, we didn't even look at the number.
One of the big problems was that Google redesigned the play store to be less scary and show fewer permissions. One of those was that any app could request internet permission without it showing up. That was just wrong.
What we really need is the ability to turn on and off specific permissions by app. Perhaps with the ability to limit internet permission to certain IPs/URLs per app. That would solve most of the problem.
Re: (Score:3)
1) The app has to declare if it's going to be doing background processing, and you have to give a reason why they will accept. So not just any app can do that.
What we really need is the ability to turn on and off specific permissions by app. Perhaps with the ability to limit internet permission to certain IPs/URLs per app. That would solve most of the problem.
I thought Google added that ability in an early 4.0 or 5.0 version of Android, but then backed it out... Sadly I think because too many apps react b
Re: (Score:2)
I think internally they have such a tool and use it in testing all the time. I don't predict them exposing it any time soon. It was released by accident, but pulled very quickly. And their changes to permissions on the Play Store go the opposite way.
Re: (Score:2)
I would rather see most apps just use intents:
http://developer.android.com/g... [android.com]
Need an image because you are the QR-code app ? Ask the image 'app'. The user can pick to choose the camera app and make a picture if he/she wants or grab an image from the image gallery app.
Need a contact ? Ask the contact 'app'.
Now most apps don't need any permissions any more. And the user knows what data the app gets because the user chooses the data and the app the data came from.
Re: (Score:2)
What we really need is the ability to turn on and off specific permissions by app. Perhaps with the ability to limit internet permission to certain IPs/URLs per app. That would solve most of the problem.
This is the #1 reason why I install cyanogenmod on every phone I use. It lets you deny/approve individual permissions per app.
Re: (Score:2)
Android Apps don't ask for permissions, they list demands. Once you've installed the App, you're just forced to just live with all their demands, uninstall, or root your phone. iPhones, on the other hand, allow you to grant and revoke permissions on the fly.
I realize that here on slashdot, rooting your phone may not seem like a big deal, but it's a pain and violates my agreement with my carrier--not something I'm willing to do.
Same stuff on iOS... (Score:1)
Jailbreak an iPhone, load and run Firewall IP. Download most apps from the App Store... and watch as the app connects to many, many sites before the app does a single thing.
The only difference in iOS is that there are no tools to catch a specific app in action.
Re: (Score:2)
Actually, Apple does try to catch those apps that sign out. In the process, they will miss the more cunning ones. And they make false positives.
One of my free iOS Apps, a RPN stack-based scripting language, came with some sample scripts you could in-click install (aka, move from App bundle into the sandboxed Documents). The App also had a button linking directly to a Wiki explaining the language and had copies of the scripts.
Somehow Apple evaluated that my App downloaded the sample scripts from my wiki down
Re: (Score:2)
How do you add a hosts into non-jail broken iOS? I still haven't found a good free non-proxy web browser ad blocker. I found one, but it was a trial.
Re: (Score:2)
Well, if the apps are just ports of each other, then it's exactly the same.
However, if you want to make money, the business models on iOS and Android differ. On iOS, selling a paid app is a really good way to make money - iOS users will pay for apps.
But on Android, paid apps are put
Re: (Score:2)
There are many, many wonderful desktop applications for all operating systems that are free (as in beer) and don't track the user or display advertisements. So it's not immediately obvious that "free" programs come with strings attached. I wonder why it's so different on mobile platforms; is it just easier to do tracking and ads there?
Re: (Score:2)
We should know by now what are the costs of "free". That is why I use a hosts file for ad and tracking block.
I only wonder why they only tested android apps, and left out IOS apps. Without this comparison, the first paragraphs of the article, blaming the tracking and ads on the openness of Android, is little more than wistful thinking.
I am as big an Apple enthusiast (not fanboi) as they come; but I was wondering the same thing; if, for nothing else, bragging rights for iOS.
But seriously, though, the study is rather useless without comparative data.
Have you looked at website internals lately? (Score:5, Insightful)
Dozens of external domains are not unusual anymore. Many web sites are unusable and unreadable without at least access to one CDN domain. Many also rely on script libraries on third party hosts. It's fucked up.
Re:Have you looked at website internals lately? (Score:5, Insightful)
If you're running a business using a site, or are using forums or other interactive, feedback-driven system, trusting your libraries and passing data to third parties seems like a terrible idea. Bad enough for your own server to be penetrated and your libraries or scripts messed with, but much worse now that those with malicious intent have one-stop shopping to screw over loads of users and sites.
Re: (Score:2)
Worse - if you're using Adobe SiteCatalyst analytics (and probably others), you need* to create a domain below yours for the tracking to go to (basically, create a CNAME to their server somewhere in your domain). That means Adobe get to see all the cookies you set in the root of your domain (and I'll bet you don't set all your cookies to just your website or webapp). If you're not very careful, that's just about everything you know about your visitors also going to Adobe.
Ghostery/Adblock or similar are the
Stop being evil Google! (Score:5, Funny)
This is why we need free-as-in-freedom apps (Score:4, Interesting)
This argument is very easy to understand, so it's a great starting point.
The first targets for a campaign for free software apps should be educational institutions and public services.
GNU.org has a good list of proprietary software packages with spyware:
https://www.gnu.org/philosophy... [gnu.org]
Re: (Score:2)
Why doesn't GNU Hurd run on my phone?
'cause it doesn't run on any real hardware?
Re: (Score:2)
Why doesn't GNU Hurd run on my phone?
Because you didn't finish installing it.
Re:Free as in ads for beer (Score:4, Informative)
And often even on F-Droid.
A lot of F-Droid apps ask for extra permissions. Instead of just trusting them, I download the source, reduce the permissions, and then run the app. If it is trying to use those extras permissions I took out, then it will crash when it tries. Almost all the apps (on f-droid) that claim not to actually use those permissions unless some feature is turned on will actually crash without them. Then I go in and comment out the sections of code that cause the app to crash. That way I don't need to audit their source, just debug the crashes.
It is a total PITA but it is the only way to get the tracking code out; even on "free" software.
Re: (Score:3)
Do you report the results to F-Droid, and/or upload your "clean" version of the program? It'd be nice if you did, and I get the impression that the F-Droid repository maintainers care about stuff like that (so they'd welcome your contribution).
Re: (Score:2)
They're the same people making the false claims about what the apps do or don't do, so why would I run to them as a trusted party?
If they were actively addressing this and warning users and removing apps based on this, then there would be something for me to contribute to.
As it is now, telling them would be like a feature request; talking about something they don't care about, and trying to persuade them.
They flag git apps for having github integration with giant "promotes non-free services" ads, even if th
Re: (Score:2)
Re: (Score:2)
You're asserting that an unnecessary permission merits a red warning, and if that was true everything else you say would have meaning.
But since that isn't actually what f-droid is doing, since that is not the policy, none of the other stuff follows.
And no, I'm not "upset" and being so would indeed be unjustified; they have no expectation to value my privacy, or to share my values. They simply don't share the values of privacy that many people casually assume they do, and I try to raise awareness of that. If
Re: (Score:2)
That's not true. They do care about privacy, which is why they have that tracking antifeature that I mentioned before. You can't discount that! The only difference between what they're doing and what you apparently want them to be doing is that they don't assume that just because something is using an unnecessary permission it means it's violating the user's privacy. You can argue that maybe they're wrong for failing to assume that, but you have to acknowledge tha
Re: (Score:2)
The most expensive part of the computer now is the idiot at the keyboard.
If you can make a person more productive, say 1 hour a week, thats over 150 hours over 3 years they spend doing more work instead of browsing slashdot.org and facebook.com
FTFY.
The time saved/money saved equation is not simple or universal.
If you save someone 5 minutes a day at their job, they'll probably just spend 5 more minutes fucking around.
There are some exceptions, like high volume call centres where staff are basically robots. But more other jobs are not time managed down to the second.
Re: (Score:2)
Still no granular app permissions in Play Store (Score:4, Informative)
What, you thought that every app asking for access to your contacts, wifi status and network access were doing it because it was helpful?
Re: (Score:3)
Re: (Score:3)
There's an app for that?
I use the built in functionality of Android. It's right there in the Lollipop notification thing.
Re: (Score:2)
Why? (Score:1, Interesting)
Doesn't Android allow the user to set permissions?
No. (Score:4, Informative)
The user can see what permissions the app requires, and choose whether or not to install the app.
You need a special app with root permissions to set up your own blocks (which, of course, might break the app you are firewalling).
Re: (Score:3)
The people who devote their time and skills, free of charge, to port CyanogenMod to specific hardware.
Re: (Score:2)
Re: (Score:2)
There is App Ops, built into the OS in a hidden menu, but that has one of the worst user interfaces I've ever seen. It's pretty much unusable.
Re: (Score:2)
Not really surprising (Score:2)
I never really understand why folks are surprised by this kind of thing. There's nothing fundamentally different between a Windows box attached to the internet in the late 90s and a cell phone except that a heck of a lot more people have cell phones and they're easier to connect to a remote site. Both systems are perfectly happy to let you install random software you found god knows where that does god knows what. All that's really changed is the admission bar has lowered.
They should be ecstatic that al
Hosts file (Score:2)
Root phone, install hosts file, problem solved. Well, solved if you can root.
Re: (Score:3)
New app to watch apps ... (Score:2)
Cyanogen mod Privacy Guard (Score:1)
And hence the reason customers want OnePlusOne and Cyanogenmod, because it includes a privacy tool that lets you remove the permissions from apps like 'Music Volume EQ"
http://www.androidcentral.com/cyanogenmod-updating-privacy-guard-20-new-features-coming-cm102
A similar tool was pre-released by Google in v4.3, then removed claiming it broke applications. I suspect the reality was, that if you could remove privacy invading things from apps, then lawsuits would make it work also for Google Apps and that was a
The problem (Score:1)
For me is that no matter how well I take care of information if someone sticks it into their Android and runs one of these apps there goes that phone number.
In fact shortly after my buddy bought a Nexus 7 (he installs EVERYTHING on it...) I started getting txt offers from Chinese retailers and my number blew up with various other issues.
Nothing for years then this...
Now I can't prove it was his device and his bad habit of installing anything, but the timing works.
AdAway (Score:3)
How many connections... (Score:2)
Can we use the app to monitor the same app?
Started to remove apps ... (Score:2)
I've been forced to start removing apps from my phone.
I have an older Android phone, and don't have (or want) a data plan.
A while ago, when I got voicemail and the the notification for it, I'd get a text message from my ISP saying that something on my phone was trying to connect to the internet.
Basically some app I had had decided that it needed to notify someone when I got a phone message, but it failed because I didn't have a data plan.
Then I started removing apps and testing, and eventually got it pared