x1sec

Nice find. It appears the application is by the same developer [1]:

The play store page for this app states:

- No data shared with third parties

- This app may collect these data types

- Data isn’t encrypted

- You can request that data be deleted

I just checked the BM2 app (subject of the blog post series) and they have updated with the similar detail [2], updated on the 25th of June 2023, although they say the data is encrypted - will need to verify if this is the case with the latest release. It also still says data not sent to any third party. If they still use the Alibaba AMap SDK - then that's a third party.

The Apple app store also now discloses location data is being sent [3]

I'd like to think my research / blog posts put pressure on them to start being honest with their customers.

This doesn't excuse them though. A battery monitor does not need to know your location.

[1] https://play.google.com/store/apps/details?id=com.dc.bm6

[2] https://play.google.com/store/apps/details?id=com.dc.battery...

[3] https://apps.apple.com/au/app/battery-monitor-bm2/id11154920...

The manifest has ACCESS_FINE_LOCATION. When you run the application, the developer actually displays a popup saying to grant the permission so it can do BLE scanning to connect to the hardware device.

Of course they neglect to say they will also use the permission to collect your GPS co-ordinates.

Then the AMap location services SDK goes further collects MNC, MCC, LAC and CELL IDs (CGI) and Wifi SSIDs. Here I think the battery app developer does not even know this is happening, they use AMap SDK to obtain the GPS data only. It took me quite some time to figure this out (documented in part 2[1]).

Will also note the manifest has CAMERA, IMAGE_CAPTURE, ACTION_VIDEO_CAPTURE, RECORD_AUDIO and MODIFY_AUDIO_SETTINGS. I have not seen where/how they are used (yet). The code that included strings requesting various permissions (In the AMap SDK code) uses string obfuscation to conceal what it is doing. Likely to trick automated static code analysis tooling.

Note:

> Alibaba state “in 2018, Amap became the first Chinese maps service to navigate a path to 100 million daily users”. [2]

How are Google allowing this SDK to be used in developer's applications?

[1] https://doubleagent.net/2023/05/22/a-car-battery-monitor-tra...

[2] https://www.alibabacloud.com/customers/autonavi

Great - good luck and most of all, have fun!

Good point, and I assume this is why Google has taken this approach. That said, the more location data points you have, the more accurate the location (larger sample size, time proximity data - GPS is accurate always, SSID/BSSIDs can be out of date.

Can you link me to the app store for this? Happy to take a look.

I agree and Apple's approach does this. You can deny the location permissions and still use the Bluetooth services. This is not the case with Android.

The OIAC (Privacy regulator in Australia) notes [1]:

> If you’re concerned your personal information has been mishandled, you first need to complain to the organisation or agency you think has mishandled it. If they don’t respond to your complaint within 30 days or you’re not happy with their response, you can lodge a complaint with us.

I have complained to the retail store that I purchased it from. It's been over 30 days, next is the OIAC. The device is rebranded and sold under many different names (globally) so the real impactful course of action is to have Google and Apple take the applications off the app store.

[1] https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-p...

In the second part of the blog post series, I show that they AMap SDK they use encrypts data data first using AES and then further encrypting the AES key(s) with a public RSA key embedded in the application. Not trivial.

If certificate pinning was used, it can be bypassed by modifying the APK or dynamically hooking into the running application using Frida. Often you have to try a few things before getting it working, often starting with a universal TLS bypass Frida script [1][2]

[1] https://codeshare.frida.re/@pcipolloni/universal-android-ssl...

[2] https://codeshare.frida.re/@akabe1/frida-multiple-unpinning/

Android warns the user that location related permissions are required. The issue is, is that this is required for Bluetooth scanning and the app developer abuses this by collecting other 'location data'. The app developer even tries to explain to the user with a pop up saying (paraphrasing) "click accept, so bluetooth will work".

> don't install apps unless absolutely necessary

Very sound advice. What if you have purchased some Bluetooth enabled device that requires an app? Don't purchase Bluetooth/connected hardware? Perhaps!

My next blog post will be on a bike Speedometer that uses GPS to calculate the bike speed. It has an Android app, and yes it sends your data to remote servers hosted within Hong Kong.

Most defiantly. iOS is a different kettle of fish.

Same challenges are present with performing forensics on an iPhone! The top commercial forensic toolkits will try to jailbreak the handset if possible to pull off artifacts. Good luck on newer hardware with the latest iOS versions. [1]

On the topic of iOS forensics, you can still get quite many useful artifacts from iOS backups with Mobile Verification Toolkit [2] being quite exceptional. I have had less success with iOS backups and the popular iLEAPP forensics software [3].

[1] https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-...

[2] https://docs.mvt.re/en/latest/

[3] https://github.com/abrignoni/iLEAPP

Thanks! Part of my motivation to documenting this is to raise awareness and also provide encouragement for others to start looking at what their devices/apps in their home are doing.

The amount of location data the device maker is collecting is significant - perhaps they are monetizing it? If so, would you consider this malicious (if not disclosed to the end user this was happening)?

The AMap SDK the app uses collects much more location data - here I feel they are likely using it to improve the accuracy of their location service/mapping software. I don't consider this malicious, unless this behavior is not disclosed to users and developers. Their site is in Chinese [1], would anyone read through their fine print to verify?

[1] https://lbs.amap.com/api/lightweight-android-sdk/download

I know someone who actually has a few of these devices - they are big into their FWD'ing - they have solar panels on their roof and spend days 'off the grid'.

Another (more common) use case is people that take their caravan out on the road. Many have a plug into the car that keeps the caravan fridge powered on when driving.

For me, I wanted to keep track of the voltage of the battery in a caravan when not connected to mains power.

This is very true. I make an effort to point out that MITM proxy now supports Wireguard [1] to tunnel traffic out from the handset. It literally should take no more then 5 minutes from download to packet inspection. Of course if TLS is used by the mobile app then on iOS it's a few more minutes of setup time. Unfortunately with Android, installing your own certificate in the trust store is no longer trivial.

As you point out though, the application doesn't even use TLS for sending the GPS data.

In part two [2] of the blog post series, the Alibaba's AMap SDK uses both TLS and custom encryption and this took me quite a few days to figure out the Wifi and cell data collection - so it's not always so trivial. Either way, I recommend to everyone to at least do a basic 'desk check' on the apps they install. You never know what you will find.

[1] https://mitmproxy.org/posts/wireguard-mode/

[2] https://doubleagent.net/2023/05/22/a-car-battery-monitor-tra...

The best way is to just start practicing. I would say pick some simple apps on your (Android) phone and dig straight in.

The great thing about Android applications is that often they generally decompile quite nice into human readable Java so the barrier of entry can be quite low to start reversing.

Grab a copy of JADX[1] - it will decompress and decompile the APK files. If you don't have an Android handset, use an emulator and/or grab APKs from apkpure[2]

Dynamic analysis is a bit more challenging. In my blog post I use Frida[3] extensively.

If you get started on something and get stuck/looking for support, feel free to DM me on Twitter (handle in HN profile), more then happy to help.

[1] https://github.com/skylot/jadx

[2] https://m.apkpure.com/

[3] https://frida.re/docs/android/

Had a similar experience, so I decided today to write a Github action[1] that automatically takes the contents of an Obsidian[2] vault, generates static content with Hugo and publishes it on Github pages. Hopefully I have documented the steps clearly [3].

After initial setup, the idea is you can edit a blog on any machine (not requiring Hugo locally). Just check out a repository, make changes and do a `git push`. All the hard work is done in a Github runner.

I wanted a simple way to be able to cut and paste screenshots into Markdown and generate a static site. Obsidian is both an excellent note taking tool and editor, so it seemed appropriate. Of course the markdown files can be edited with any editor.

[1] https://github.com/marketplace/actions/obsidian-to-hugo-page...

[2] https://obsidian.md/

[3] https://blog.x1sec.com/posts/obsidian-to-hugo-github-pages-a...