Throughout the ongoing process of decompiling and analyzing iOS applications, we publicly disclose particularly egregious behavior that is may be of public interest in hopes of enacting positive change.
How apps make money by selling your location history and daily whereabouts
Prior Research Efforts
We conducted an intensive review of code found within hundreds of thousands of apps (and the trackers embedded in them) in order to build the dataset which powers our firewall software.
Examples of public disclosures include the following:
- AccuWeather, a popular weather app for iOS, was sharing user location information with a third-party location tracking service even if users declined to grant the app Location Services access.
- An inadequate public response was issued, and the tracking code in question was quickly removed from AccuWeather’s iOS app.
- Uber was granted exclusive access to powerful capabilities in iOS which could allow it to access raw user screen data, allegedly in order to improve performance in their Apple Watch app. This capability was quickly removed after public disclosure.
- Onavo Protect, a Facebook-owned VPN app, abused the Packet Tunnel Provider functionality in iOS to continuously send analytics while running in the background. The app was removed from the App Store months later by Facebook at the request of Apple, due to Facebook’s inability to produce a variant of the app which was compliant with the App Store Guidelines. Onavo Protect was later available on iOS once again using a disguised “research” app targeted at teenagers, until disclosure of this fact, causing Apple to swiftly revoke Facebook’s code signing certificate. On May 6, 2019, Facebook shut down Onavo entirely.
- Many popular iOS applications such as GasBuddy, PayByPhone Parking, Perfect365, Tapatalk, Tunity, and YouMail were found to use code from various data monetization companies to track the daily whereabouts of users. Location Services permissions were granted to the apps by users under more a more innocuous premise, such as the ability to “provide local gas prices” or similar functions relevant to the host app.
Further public disclosures of this kind will be published here as they are discovered through our research.
More About App Data Sourcing
In order to effectively keep track of all known trackers being used on iOS, we periodically scan the App Store and use custom automated tooling to decompile, disassemble, and index the contents of iOS apps. Over the course of the last four years, we have developed this custom toolset which now gives us an unprecedented level of insight into network connections, security/privacy issues, and any other information we need from iOS apps.
This capability allows us to monitor changes in real time as trackers are added, updated, and removed from apps. We can easily find out what types of data are sent to external servers, and that is why each alert in the app is able to describe what we prevented from going out by blocking the connection.
Screening app traffic in a preliminary manner so that we know what it will look like adds an attractive privacy benefit: We can inform users with reasonably high confidence what types of data present in connections we blocked, without actually needing to analyze content from the network packets as they flow through the firewall. Remember: we consider users’ personal data to be a liability, not an asset.