Why don't all browsers, desktop and mobile, just block all cross-origin access to localhost?
Covert web-to-app tracking via localhost on Android
171–180 of 356 posts
Re: Covert web-to-app tracking via localhost on Android
#172Another similar tracking vector that lets any app detect all installed apps by using android.intent.action.MAIN Query: https://support.google.com/googleplay/android-developer/thre... without the QUERY_ALL_PACKAGES permission. No response from Google. Being used by dozens of apps in the wild. Edit: Original Research link: https://peabee.substack.com/p/everyone-knows-what-apps-you-u... (HN: https://news.ycombinator.com…
[deleted]
Re: Covert web-to-app tracking via localhost on Android
#173Why don't all browsers, desktop and mobile, just block all cross-origin access to localhost?
For one I think it would break all those "update your BIOS via your motherboard website" apps that probably shouldn't exist anyways.
There probably are some legitimate uses, but I'm straining to come up with them.
Re: Covert web-to-app tracking via localhost on Android
#174Earlier quoted context omitted.
Which, per the OP, the site would be doing by merely including the Meta pixel, which practically every e-commerce and news site does to track its campaigns and organic traffic. The takeaway is that for all intents and purposes, anything you did in a private session or secondary profile on an Android device with any Meta app installed, was fully connected to your identity in that app for an unknown amount of time. And…
Yes, but if the concern is not mixing business and personal compartment of the phone, business sites would hopefully not embed a Meta tracking pixel. > The takeaway is that for all intents and purposes, anything you did in a private session or secondary profile on an Android device with any Meta app installed, was fully connected to your identity Definitely, and that's a huge problem. I just don't think Android busin…
While I agree with your reasoning, in my experience any statement where I prepend "hopefully" usually ends up being the worst possible interpretation in practice.
Re: Covert web-to-app tracking via localhost on Android
#175Earlier quoted context omitted.
Yes, but if the concern is not mixing business and personal compartment of the phone, business sites would hopefully not embed a Meta tracking pixel. > The takeaway is that for all intents and purposes, anything you did in a private session or secondary profile on an Android device with any Meta app installed, was fully connected to your identity Definitely, and that's a huge problem. I just don't think Android busin…
While I agree with your reasoning, in my experience any statement where I prepend "hopefully" usually ends up being the worst possible interpretation in practice.
What I mean is: If a corporate internal website regularly connects to unauthenticated local ports and leaks sensitive data out, that's fully on them.
If they are trying to fingerprint the "private compartment" of a BYOB device, that seems roughly as bad as a non-corporate side doing the same.
Re: Covert web-to-app tracking via localhost on Android
#176Earlier quoted context omitted.
While I agree with your reasoning, in my experience any statement where I prepend "hopefully" usually ends up being the worst possible interpretation in practice.
What I mean is: If a corporate internal website regularly connects to unauthenticated local ports and leaks sensitive data out , that's fully on them. If they are trying to fingerprint the "private compartment" of a BYOB device, that seems roughly as bad as a non-corporate side doing the same.
100% agree, and fingerprinting BYOB devices would be problematic in a lot of ways.
I'm generally against BYOD programs. They're convenient but usually come from a place of allowing employees access to things without the willingness to take on the cost (both in corp devices and inconvenience of a second phone/tablet/whatever) to run them with a high level of assurance.
Much better in my opinion to use something like PagerDuty or text/push notifications to prompt folks to check a corp device if they have alerts/new emails/whatever.
Re: Covert web-to-app tracking via localhost on Android
#177Earlier quoted context omitted.
Which, per the OP, the site would be doing by merely including the Meta pixel, which practically every e-commerce and news site does to track its campaigns and organic traffic. The takeaway is that for all intents and purposes, anything you did in a private session or secondary profile on an Android device with any Meta app installed, was fully connected to your identity in that app for an unknown amount of time. And…
Yes, but if the concern is not mixing business and personal compartment of the phone, business sites would hopefully not embed a Meta tracking pixel. > The takeaway is that for all intents and purposes, anything you did in a private session or secondary profile on an Android device with any Meta app installed, was fully connected to your identity Definitely, and that's a huge problem. I just don't think Android busin…
> do Android "business profiles" also include browser sessions
I believe that is typical.
My business profile has it's own instance of Chrome. Mostly used for internal and external sites that require corporate SSO or client certificates. Of course it could be used to browse anything.
Re: Covert web-to-app tracking via localhost on Android
#178A comment I wrote in another HN thread [0] covering this issue: Web apps talking to LAN resources is an attack vector which is surprisingly still left wide open by browsers these days. uBlock Origin has a filter list that prevents this called "Block Outsider Intrusion into LAN" under the "Privacy" filters [1], but it isn't enabled on a fresh install, it has to be opted into explicitly. It also has some built-in exemp…
There is a specification for blocking this: https://wicg.github.io/private-network-access/ It gained support from WebKit: https://github.com/WebKit/standards-positions/issues/163 …and Mozilla: https://github.com/mozilla/standards-positions/issues/143 …and it was trialled in Blink: https://developer.chrome.com/blog/private-network-access-upd... Unfortunately, it’s now on hold due to compatibility problems: https://dev…
Both Firefox [0] and Chrome [1] are working on successors which rely on permissions prompts instead of preflight requests.
[0] https://groups.google.com/a/mozilla.org/g/dev-platform/c/B8o...
[1] https://groups.google.com/a/chromium.org/g/blink-dev/c/CDy8L...
Re: Covert web-to-app tracking via localhost on Android
#179A quite obvious attack mechanism, I'm surprised browsers permitted this in the first place. I can't think of a reason to STUN/TURN to localhost. Aside from localhost, trackers can also use all other IP addresses available to the browser to bind their apps/send traffic to. Now that the mechanism is known (and widely implemented), one could write an app to notify users about attempted tracking. All you need to do is to…
> hand out a different, temporary IPv6 address to every app and segment off any other interface that might be expose Yes, but (AFAIK) not out of the box (unless one of the security focused ROMs already supports this). The kernel supports network namespaces and there's plenty of documentation available explaining how to make use of those. However I don't know if typical android ROMs ship with the necessary tooling. Ap…
I've looked into network namespaces a bit but from what I can tell you need to do a lot of manual routing and other weird stuff to actually make IPv6 addresses reachable through them.
In theory all you need to do is have zygote constrain the app further with a network namespaces, and run a CLAT daemon for legacy networks, but in practice I'm not sure if that approach works well with 200 apps that each need their IPs rotated regularly.
Plus, you'd need to reconfigure the sandbox when switching between WiFi/5G/ethernet. Not impossible to overcome, but not the weekend project I'd hoped it would be.
Re: Covert web-to-app tracking via localhost on Android
#180Earlier quoted context omitted.
What's the crime?
Unauthorized access to a computer system. I'm sure if I connected to some port on a computer belonging to Meta without them wanting it, that would be the crime I would be charged with. But somehow if Meta connects to a port on my phone without me agreeing to it, it's not a crime?
Yes.. and that listening service is their software that you installed on your device... So caveat emptor.