Live data from Hacker News

Some Android apps are using ultrasonic beacons to track users

bleepingcomputer.com

61–70 of 93 posts

Re: Some Android apps are using ultrasonic beacons to track users

#61
post #31

Earlier quoted context omitted.

cough youtube cough

Youtube has a video recording function, that doesn't work so well without the camera and mic

Clearly, that is better as a seperate app. 99.99% of viewers will never upload, much less use that feature.

Re: Some Android apps are using ultrasonic beacons to track users

#62

> The only good news found in this research was that after searching TV streams from seven different countries, researchers failed to discover any ultrasonic beacons Would that even work? I'm pretty sure modern digital TV audio compression totally removes sound that is vaguely close to 'ultrasound'. I guess maybe smart TV apps could add the signal though, but why would they when they already know what you are watchin…

Its most likely not ultrasound, but just on the high end of what's supported by these codecs. mp3 and other codecs are biased towards human hearing ranges but support up to 30000hz I believe. Most people can't hear above 15000hz. Load up any 'dog whistle' app if you want to see this in action.

I imagine these apps use somewhere about 15k where some of us can hear it but really won't notice it too much during the 'empty' spaces between music, commercials, etc.

The middle aged and over execs and managers who approve of these schemes certainly can't hear it.

Re: Some Android apps are using ultrasonic beacons to track users

#63

Does anyone have the link to the actual list? Neither the article nor the original paper seem to list the tracking apps, they just mention McDonald’s and Krispy Kreme.

Here's the top apps using silverpush: http://mixrank.com/playstore/namespaces/com.silverpush.sdk.a...

Lisnr: http://mixrank.com/playstore/namespaces/com.lisnr.sdk/instal...

And shopkick doesn't appear to be for Android. If someone has a link to the docs I can double check.

Re: Some Android apps are using ultrasonic beacons to track users

#64
post #48

Earlier quoted context omitted.

Only on apps that target Android 6 however. They couldn't retroactively apply it. Just build your app targeting Lollipop and you get all the permissions you want. Plus their app store isn't as strongly vetted, so apps can refuse to work if you don't grant a bullshit tracking permission.

This I never understood. Couldn't they just supply the app with empty lists and black pixels for restricted APIs until the user approved the permission? iOS managed to do this retroactively just fine.

I don't think iOS did it retroactively. It's just that, since so many more people actually update (because they're not at the mercy of their carrier), devs update their apps more often.

Re: Some Android apps are using ultrasonic beacons to track users

#65

Earlier quoted context omitted.

Youtube has a video recording function, that doesn't work so well without the camera and mic

Clearly, that is better as a seperate app. 99.99% of viewers will never upload, much less use that feature.

It's still part of YouTube. And if Google is following their own guidelines for it, they won't ask for those permissions until you try to do something that needs it. Seeing as how I've been using YouTube for a while and have not been asked for those permissions, it seems to be working fine.

Re: Some Android apps are using ultrasonic beacons to track users

#66

062115 - How to Manage Android App Permissions to Protect Your Privacy http://thehackernews.com/2015/06/android-permission-manager.... beacon-blocking Chrome extension and sample Android (research prototype) patch: http://ubeacsec.org/#Downloads Silverdog Chrome Extension http://www.thewindowsclub.com/silverdog-chrome-extension-mit... Disable Beacon monitoring on a condition in Application http://stackoverflow.com/qu…

Don't think permissions don't really protect you from this.

AFAIK you don't need permission to _play_ sounds at least for foreground apps. So that means in a public space, it doesn't matter if your mic is disabled - if anyone _else_ gave permission for an app to use the mic, their phone hear your phone transmitting ultrasound, allowing you to be tracked.

Re: Some Android apps are using ultrasonic beacons to track users

#67
post #5

This is why apps that shouldn't need the mic or speaker but still require it should not be installed. Permissions on an app should be checked carefully by a user, and users should be educated in this!

Or, of course, users could avoid installing apps altogether. Which, apparently, is the approach that many people take:

https://www.recode.net/2016/9/16/12933780/average-app-downlo...

It seems likely that lots of folks already realize 'experiencing the joy of the Krispy Kreme app" will not improve their life in any way, shape, or form.

Re: Some Android apps are using ultrasonic beacons to track users

#68
post #64
post #48

Earlier quoted context omitted.

This I never understood. Couldn't they just supply the app with empty lists and black pixels for restricted APIs until the user approved the permission? iOS managed to do this retroactively just fine.

I don't think iOS did it retroactively. It's just that, since so many more people actually update (because they're not at the mercy of their carrier), devs update their apps more often.

I believe you are incorrect. iOS have introduced more and more permissions (most recently, for iOS10 a permission prompt appears for apps trying to access the built-in media library, whereas this was a silent free-for-all in earlier versions), and existing apps are not grandfathered in. According to at least https://www.macrumors.com/2012/06/14/apple-requires-user-per... apps will just receive empty/dummy data until the permission is granted. From my personal experience, camera APIs return black pixels until the permission has been granted, even for apps that were released when iOS 5.0.0 was the latest version and never updated since.

Re: Some Android apps are using ultrasonic beacons to track users

#69

> The only good news found in this research was that after searching TV streams from seven different countries, researchers failed to discover any ultrasonic beacons Would that even work? I'm pretty sure modern digital TV audio compression totally removes sound that is vaguely close to 'ultrasound'. I guess maybe smart TV apps could add the signal though, but why would they when they already know what you are watchin…

They'd do it to connect profiles between the TV (which knows what you're watching) and any mobile devices within ultrasound reach (i.e. line of sight) of the TV. Do this a few times and it quickly becomes clear which phone is usually within range of the TV, and with that the profiles can be merged, giving a broader view of the user behind these devices. The solution is simple: don't get a 'smart' television. Better s…

I'm with you on not getting a 'smart' TV, but this comment reeks of elitism: "Better still is to forego on television altogether but if you insist on having canned 'entertainment' (panem et circensis) beamed into your domicile"

What if I want to play games, watch movies, or just sit down and otherwise enjoy myself? Is everything that comes on a screen an unnecessary diversion or is it just a screen of a certain size?

Re: Some Android apps are using ultrasonic beacons to track users

#70

Earlier quoted context omitted.

The smart televisions are far more likely to have code (or be updated with code) that can be used to emit unique tracking signals of some sort.

Sorry if I'm missing something, but television programming usually doesn't require code in the TV in order to emit audio. Is audio in ultrasonic frequencies a special case?

The risk with smart TVs is (as an example) CBS approaches Samsung and asks them to push code that makes the TV do a particular hard-to-notice sound when it detects the logo of a specific show being sent to the screen.
Post reply on HN