Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

github.com

Post reply on HN
Print view View original

281–290 of 363 posts

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#281

Post by Scaless »

collaborative wrote: post #259

Phone numbers are too public. The reason why they're used by messaging apps is that they are a goldmine to have. They actually make it harder to chat (ever tried using Whatsapp/Signal on a PC? Yes, you'll need to have it installed on your phone first (and have given over your contacts)) That's why I chose to set (masked) emails as the primary id on groupsapp.online and even these can't be seen publicly unless you sha…

At that point why even show the masked emails at all? All you're doing is leaking people who use their own custom domains (e.g. XXXX@myname.com), and XXXX@gmail.com isn't going to help me know who that person is either.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#283

Post by geoduck14 »

shervinafshar wrote: post #106
crazygringo wrote: post #90

I don't see what the point is. "Data poisoning" gives companies a bunch of fake contacts... on top of all your real ones? Who cares? So they send some e-mails to addresses that don't exist or something? So it takes up an extra 1% of disk space in their database? If you could share an empty address book then that would actually preserve the privacy of your contacts. But this doesn't do that. I don't get it.

Not an expert on guerilla cyber-warfare, but isn't it the whole point of this sort of poisoning? If enough people do this the cost of those bouncing emails would become prohibitive. That's my speculation. Would be great to know more from someone who knows the domain better.

Oh! I know! I work for a large company. At one point, we sent so much junk mail, we were the Post Office's #1 customer (in the US). We have started to send junk emails, too.

There is a Swedish company (non profit? Activist group? IDK) called SpamHause. They partner with ISPs to help block spam. Their process is something along the lines of:

1) Inject fake email addresses into lists of email addresses that are bought/sold WITHOUT user consent

2) Wait until someone UNAUTHORIZED emails them spam

3) Tell the ISPs (and anyone else who will listen) to STOP processing emails from the companies that sent them spam.

4) The ISPs block the companies because SpamHause is reputable and REALLY good at finding spam, also the ISPs save money by "not having to process the spam

We accidentally got a hold of a bad batch of email addresses several years ago and we spent MONTHS trying to fishout and overhaul our email authorization process. It cost us $10s of millions.

Also, WHY were we sending that spam?!?

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#284

Post by DanAtC »

djrogers wrote: post #66
rsync wrote: post #53

Earlier quoted context omitted.

"Recently Apple added a feature to iOS that allows you only to allow selected photos to be accessible by an app." What we really need to see from Apple is a permissions index in the app store that allows me to inspect, and consider, the permissions that an app will request before installing that app . I shouldn't have to install the app (or do laborious research online) to discover what permissions it will attempt to…

> and which of them are required to function. On the iOS App Store, none of the optional permissions can be required for an app to perform it's basic functions - that's a store policy, and it's generally well enforced. Obviously if your app's function is mapping, GPS can be required to use those features (but only at the user's discretion - ie while running or all the time, granular or coarse), but the app can't just…

Tell that to Citizen which refuses to operate without location enabled, and even worse, refuses to operate with coarse location. And being a free app there's no place on Apple's site to report this bad behavior.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#285

Post by xxyzz »

IG_Semmelweiss wrote: post #210
Haemm0r wrote: post #101

Earlier quoted context omitted.

For Android I can recommend "Shelter"[1] which lets you setup a work profile, so you dont have to share your contacts, files, etc.. Downside: If you have already a work profile, it does not work (Android allows only one work profile) [1] https://f-droid.org/en/packages/net.typeblog.shelter/

nice find. is there a list of known existing "big brother" apps ? or is it just as good to look at app permissions to figure this out ?

That means some Chinese apps: https://github.com/PeterCxy/Shelter#features--use-cases

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#286

Post by michaelcampbell »

remram wrote: post #142
shervinafshar wrote: post #106

Earlier quoted context omitted.

Not an expert on guerilla cyber-warfare, but isn't it the whole point of this sort of poisoning? If enough people do this the cost of those bouncing emails would become prohibitive. That's my speculation. Would be great to know more from someone who knows the domain better.

Even if you make your contact list 99% bounces and 1% real (and every user of the app does the same), I don't see how this becomes a problem for the app's operator. Remove a contact after 1-2 bounces and you're golden.

Who bounces any more?

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#287

Post by tyingq »

TedDoesntTalk wrote: post #146
jmatthews wrote: post #118

Earlier quoted context omitted.

You don't bounce emails you prebounce them and clean up your list. This is part of any sensible data engineers process.

what is prebounce?

Email them from a throwaway domain and ip, toss out hard bounces from the list, so you don't poison your SMTP reputation?

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#288

Post by bredren »

satya71 wrote: post #226
lupire wrote: post #209

Earlier quoted context omitted.

0. Don't use Clubhouse because it adds no value?

When you run a business, you have to go where the people are. If my customers are there, I have to be there.

This is the only reason I have to touch Facebook. It’s icky.

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#289

Post by 3825 »

DanAtC wrote: post #284
djrogers wrote: post #66

Earlier quoted context omitted.

> and which of them are required to function. On the iOS App Store, none of the optional permissions can be required for an app to perform it's basic functions - that's a store policy, and it's generally well enforced. Obviously if your app's function is mapping, GPS can be required to use those features (but only at the user's discretion - ie while running or all the time, granular or coarse), but the app can't just…

Tell that to Citizen which refuses to operate without location enabled, and even worse, refuses to operate with coarse location. And being a free app there's no place on Apple's site to report this bad behavior.

To those who like me are not in the know, I think the parent comment is about an app that used to be called vigilante

https://en.wikipedia.org/wiki/Citizen_(app)

> Citizen is a mobile app that sends users location-based safety alerts in real time.[1][2][3][4] It allows users to read updates about ongoing reports, broadcast live video, and leave comments.[1][2] The app uses radio antennas installed in major cities to monitor 911 communications,[5] with employees filtering the audio to generate alerts.[5] In March 2020, Citizen added the COVID-19 digital contact tracer SafePass. The app is currently available for iOS and Android devices[6] in 20 cities,[7] including New York City, the San Francisco Bay Area, Baltimore, Los Angeles,[8] Philadelphia.[9] Detroit,[10] Indianapolis,[11] Phoenix,[12][13] Cincinnati,[14] Chicago, Minneapolis, Saint Paul, and Cleveland.[15]

Re: Fake_contacts: Android app to create fake phone contacts, to do data-poisoning

#290

Post by _0ffh »

shervinafshar wrote: post #166
cyral wrote: post #160

Earlier quoted context omitted.

It will be interesting to see if these fake contacts show up in a leak somewhere someday. Almost like how people do myname+yourcompany@gmail.com, we could create similarly fake contacts to see who is selling or leaking data.

*@myname.name

Yeah I've been using yourcompany@mydomain.tld for ages to track who's sold or fumbled my data. Since haveibeenpwned I can even approximately separate the two groups. Surprisingly up to now nearly all incidents (that I know of) have been breaches. Not that it makes it any better.
Post reply on HN