Investigation Xoth: Smartphone location tracking | Hacker News Reader

Investigation Xoth: Smartphone location tracking

expressvpn.com

170 pointsgilad64 comments

The current link is to the press release for a paper. Link to the paper: https://www.expressvpn.com/digital-security-lab/investigatio...

E: The vice article [1] on this paper brings one aspect into focus:

    At least five more Muslim prayer or similar apps worked with data broker X-Mode, which has sold location data to military contractors and by extension U.S. military intelligence, according to multiple technical analyses.

1: https://www.vice.com/en/article/epdkze/muslim-apps-location-...

It's ridiculous we're trying to prevent three letter agencies to track us directly, but we then install all sorts of apps that could get the same information via apps from some 3rd party shell companies set up or funded by those agencies.

Perhaps it's not the tracking itself that we care about, but control over when it occurs and by whom.

Control over it?

Good luck figuring out which apps track you much less controlling when.

The trackers can change or be enabled programmatically and silently.

And VPN is getting more and more worthless. I have to turn it off for more and more apps to function at all.

I'd argue that it's the feeling of control that most people want, not necessarily the control itself. Perhaps a kind of "reactance".

We dilated on the x-mode piece of this if anyone feels like drilling down a step:

https://techcrunch.com/2021/01/28/x-mode-location-google-app...

OK, we've changed to that from https://www.expressvpn.com/blog/digital-security-lab-locatio.... Thanks!

As always, I would recommend to use an AOSP build without google service integration (like LineageOS builds).

I'd also recommend to use AppWarden [1] and the Exodus project [2] to verify for yourself what your Apps do behind the scenes.

Regarding an App masquerading as Telegram: Use the Telegram FOSS fork [3] which disables Firebase's trackers.

[1] https://gitlab.com/AuroraOSS/AppWarden

[2] https://exodus-privacy.eu.org/en/

[3] https://github.com/Telegram-FOSS-Team/Telegram-FOSS

That’s great advice. At the same time I wonder how many people can actually implement it? Maybe 0.2% of the population?

I think that's wildly optimistic; more like 0.00002%

That would still be around 140K people on a population of 7 Billion, which probably is still on the high side. If you do 1000X better, it's still close to meaningless. But if it makes you feel better, of course go for it.

The better advice is to just use your phone as a phone and not install any crap on it that you don't need. Use a PC with a reasonably uncompromised browser like Firefox or Chromium. Even with the default settings, that will keep you out of a heap of trouble and there probably are about 100M Firefox users or so (1.4% of the world population, not so bad).

7,000,000,000 * 0.00002% = 1400.

GrapheneOS also worth mentioning. https://twitter.com/jack/status/1355295732836626432

I don't know why your being downvoted, but GrapheneOS os worth some attention.

Likely because he links to Twitter.

https://grapheneos.org/

'NetGuard'[1] is also great tool to control/log network requests of apps, but uses VPN since it functions without root.

[1]https://github.com/M66B/NetGuard

I'd go even further and recommend GrapheneOS [0] on a Pixel.

It has some extra security improvements on top of AOSP and most importantly, the builds are signed and the device can be locked after you install the ROM.

[0]: https://grapheneos.org/

A good practice is to consult Exodus Privacy before installing your app. If the app is not already analysed, you can start an analysis via the UI.

https://exodus-privacy.eu.org/en/

While exodus is a good minimum bar, and I use it, its list of detected trackers is incomplete. I have reported two known trackers, but their signatures are not yet detected by exodus.

It is difficult to know these signatures because the good trackers share their SDK only under an NDA.

I would be interested to know how many of the 450 apps actually needed your location data to do their job. If the app is an exercise app with a map, its a feature that it knows where I am.

If it's a messenger app with a feature that can share your location, then its expected that it will have access to the API's.

https://github.com/expressvpn/xoth_location_tracker_investig...

At least one of the apps listed (Telegram) uses location when you choose to like sharing your location with people and I have never seen it request location otherwise. Puts the rest of the data in to question for me.

From TFA (emphasis mine)

> These include apps masquerading as popular services such as Telegram, Facebook Messenger, and WeChat.

Note they are masquerading as the listed messengers, not the actual messengers themselves

If you got a JBL speaker, you cannot upgrade its firmware without the app. The app requires location access, otherwise it will not work at all. There is no reason for location access because even if you grant access, it doesn't feature anything like a map or compass. It solely uses the location for marketing.

Also, you cannot just search for a new firmware update and uninstall the app immediately afterwards. You have to wait a few days for it to notify you so they can track you for a longer period of time.

That's a violation of the Apple app store terms of service, but I have never yet successfully reported such a violation to Apple. Their tech support doesn't understand what to do with such reports and after many back-and-forth attempts I've just given up trying for now.

Apple employees, if you're reading this, it's an obvious violation of ASRG 5.1.1 (iv) Access and it's probably a violation of ASRG 3.1.4 Hardware Specific Content — but as a mere developer, there's nowhere for me to report that for internal investigation. Perhaps one of you can do better.

They have different rules for big companies and for small companies. All big companies are given a pass on shady stuff

Apple employees, if you're reading this, I would _LOVE_ a way to flag an app notification as spam. I use a few apps that I really need notifications on for (delivery apps, and the like) but that insist on spamming me. Pretty sure this is a ToS violation, but I'm entirely unsure how to do anything about this.

> That's a violation of the Apple app store terms of service

Like it is of hundreds of other high profile apps... other than facebook.

On iOS the "JBL Portable" app(a recent new name for their app JBL Connect) does not require any access to location.

Are you talking about the Android app?

bluetooth and location permissions are many times together, because if you can scan the device macs you are able to use it to locate the user ( with bluetooth beacons for example).

What is it in speaker firmware that needs upgrading anyway?

I never even connected my Nintendo Switch to the internet.

(It's pretty cool actually that when you buy a physical game, if they need an OS update it's shipped on the cartridge. )

My experience with Bluetooth connectivity is lots of things don’t work universally when shipped.

It very likely asks the location permission because it wants to scan Bluetooth devices. Scanning Bluetooth devices can be useful to detect the speaker, but it's also often used to track user locations especially indoor where the GPS doesn't work or is not precise enough.

You can place Bluetooth emitter beacons around an area and by scanning the Bluetooth devices on the smartphone and some triangulation, you know precisely where the smartphone is.

By the way even Apple, which is not that privacy friendly, sells such Bluetooth beacons to track peoples' location. https://en.m.wikipedia.org/wiki/IBeacon

This technology can have good use too, in retirement homes or hospitals for example. But it's mostly used to know where you are in a mall.

On android 9+, giving it the permission is not enough.

You must also enable the GPS and wait for it to lock your position :( :( :(

So yeah, it's a function designed to force you give away your location (masquerading as a privacy feature)

Which is the reason I prefer websites to apps. Ok, there are certain tasks that are not feasible without an app. Mostly though, what's done in the app could be done on a website. And the website is by far more accessible through a wide variety of devices with a range of operating systems.

Websites can track you as well and the UI’s are horrible for the most part. Of course, many apps are basically websites in an app browser. Sigh.

I use a Bose QC35 and its app too requires location enabled to be open.

Unfortunately, both Google and Apple decided to merge Bluetooth and Location permissions a while back, on the basis that bluetooth scans can be used to unmask your location (by fingerprinting known BLE beacons). This means that any app that needs to communicate over BLE is forced to request the location permission - even if they don't want to.

That's not to say anything about whether this app in particular is using location maliciously, of course. But all apps for BLE devices are in this boat :/

There should be finer grained location permissions like "this app requires access to your location when you're writing a message" (messenger). I think apps can currently check your location whenever they're open and potentially when they're not unless you restrict background processes.

Not sure how that could be implemented without creating a domain specific set of actions like defined Intents in android or Siri intents on iOS. In this case, apps would be required to use a messaging intent that provides location information once a message is initiated by a user. But how to be sure user initiated the message?

IMO: if you don't treat your phone like another PC and run postmarketOS (or similar) than you shouldn't use a "smartphone." Almost everything in the iOS and Android ecosystems is pathologically malicious.

So that means that 99% of the population should not use a smartphone. Compare the downsides of that with the intangible benefit of more privacy.

These things don't just invade your privacy though. Entier UIs are built around making you behave in ways the vendor wants or looking at ads (and absolutely nothing else) where the vendor rents the ability to manipulate their users behavior en mass.

If it were just privacy you would have a point but it was never about privacy, that's just much easier to measure and talk about because it's something most people have been talking about since the 80s/90s when strong cryptography became available to the average computer user.

I only buy LineageOS compatible phones. Its Privacy Guard feature allows fine control over permissions.

Unfortunately Privacy Guard is no longer a thing with LOS17 :(

Ah. News to me. My device is still on LOS15. I also use https://github.com/OxfordHCC/tracker-control-android to monitor apps.

Do you know the reason behind it? Was it replaced by something else?

XprivacyLua works fine as a replacement but it requires Xposed Framework.

But hasn't this gotten very similar to the upstream AOSP 10 app settings? I know they are somewhat hidden, but you can change a lot about an App's behaviour and even fake location data for a specific App.

I didn't use Lineage with Privacy Guard (too old or too new devices)... so what's the TLDR on the featureset that's missing?

Might be worth creating an alternative for 10+ if there isn't any.

How does it otherwise compare to Android or iPhone?

LineageOS is Android. The usual Google Play store is available on it (after installation of gapps). Apparently Privacy Guard is gone in the latest LineageOS. If you're on Android, give this a try: https://github.com/OxfordHCC/tracker-control-android

My 5yr old phone is apparently compatible but I found lineage essentially didn't work with it. Had to revert to vendor Android. I will try again when I get a new phone though.

If there is a market demand for functionality without spyware, why is not there some company capitalizing on that demand?

Because the market demand is small and the profit margins narrow or nonexistent.

I mean a lot / most open source software has always been free and resistant of spyware, but has e.g. desktop linux ever taken off outside of a relatively small community?

There ARE companies capitalizing on the demand; they're frequently mentioned on HN, companies like Proton/Fastmail, chat apps like Signal, Matrix, etc. All of cryptocurrency, a software and financial product that was / is intended as a privacy tool (like cash money), is a global $1 trillion market (according to https://coinmarketcap.com/), with most clients and protocols being open source. (maybe I'm reaching here)

I realize the FSF itself, being a foundation, isn't the correct answer (been a member for years) but a related for-"profit" outfit, run ethically, seems only a modicum of management talent out of reach.

My point is that the vaccum here is astounding.

The main issue is that privacy and tracking are a death-by-a-thousand-cuts type of problem. Whatsapp may be tracking me, so I'll switch to Signal. But then I have to worry about Twitter and switch to Mastodon. Then I have to worry about a long tail of apps (notetakers, camera apps, flashlights, etc.) and find/build replacements for each of those. And even after I am done with the app-level tracking (if ever done), I still need to worry about OS-level tracking (at least in Android/Google Play Services/...).

Those thousand cuts drain into a data lake. There, even reasonably sane security policies on discrete sites can be substantially mooted by combining a bunch of data from disparate sources.

What to do? Join an Amish community?

There isn't a demand because the average user doesn't know. Of course they would mostly pick the app without spyware if the were asked, but they are not.

This is a ridiculous problem. Stop installing smart phone apps. Even better, get rid of your smartphone.

Are these apps granted location permissions by the user? Are they listed as having location access in Settings?

The article seems somewhat absent of information, They list telegram as one of these location tracker apps. I use telegram and it has some features like sending your location to a friend but I'm not aware of it ever just grabbing your location without requesting it. I'm also not sure that ios allows grabbing the location without the app being in use either.

It doesn't say Telegram tracks your location, it says apps masquerading as Telegram track your location.

Actually, Telegram is an open standard which allows you or me to make a compatible app. Now, I am not sure if they are talking of such a client or an app that imitates to be one of these.

The article says it quite clear:

>"Predicio is present in twelve messenger apps, including apps masquerading as Telegram and WeChat. X-Mode is present in apps such as Messenger Go and Messenger Pro that mimic the branding of Facebook Messenger, with at least 60 million downloads."

Reply on news.ycombinator.com