3 ms·

Watch out, Here Maps has the Facebook SDK malware embedded in it that will call home to Zuck on every app launch (at least) and send a device fingerprint and pe

Watch out, Here Maps has the Facebook SDK malware embedded in it that will call home to Zuck on every app launch (at least) and send a device fingerprint and persistent identifier.

rkhleung 5y ago
Reference?
- Nextgrid 5y ago
  My own testing on iOS by monitoring the network traffic - I don't see why Android would be any different. Edit: Exodus Privacy also confirms that Facebook malware is indeed present: https://reports.exodus-privacy.eu.org/en/reports/com.here.app.maps/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.here.ap...
walterbell 5y ago
Very unfortunate, since HERE maps allows offline maps. We need a public registry of apps that embed tracking SDKs. And iOS needs an outbound firewall, now that it is shipping an App Privacy Report.
- vinay427 5y ago
  > And iOS needs an outbound firewall This can already easily be added through third-party apps. Would a system-wide firewall be a worthwhile improvement? I suppose it would help to have it enabled by default for users who wouldn’t install a tracker firewall app afterwards.
  - walterbell 5y ago
    Is there an iOS 3rd-party app which can provide on-device outbound firewalling across all apps?
    - vinay427 5y ago
      Yes, AdGuard seems to do so and IIRC also has customizable block lists. The default includes Safari-only blocking but it is able to add a device-wide filter using Apple's API for VPNs. It seems to identify the various trackers used by the social media apps on my device, for instance. App store link: https://apps.apple.com/app/apple-store/id1047223162 https://apps.apple.com/app/apple-store/id1047223162 GitHub link: https://github.com/AdguardTeam/AdguardForiOS https://github.com/AdguardTeam/AdguardForiOS System-wide blocking: https://adguard.com/en/blog/how-to-configure-system-wide-blocking.html https://adguard.com/en/blog/how-to-configure-system-wide-blo...
      - walterbell 5y ago
        Thank you!
      - walterbell 5y ago
        Looks like system-wide blocking is via DNS, which would leak DNS requests to AdGuard's DNS server? The same could be accomplished with a local PiHole device.
jlg23 5y ago
Thanks for the pointer! Unfortunately FB is free on the major mobile operators and thus basically mandatory for communication, so my phone calls "home to Zuck" regularly anyways :/

Watch out, Here Maps has the Facebook SDK malware embedded in it that will call home to Zuck on every app launch (at least) and send a device fingerprint and persistent identifier.

rkhleung 5y ago

Reference?

Nextgrid 5y ago
My own testing on iOS by monitoring the network traffic - I don't see why Android would be any different. Edit: Exodus Privacy also confirms that Facebook malware is indeed present: https://reports.exodus-privacy.eu.org/en/reports/com.here.app.maps/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.here.ap...

walterbell 5y ago

Very unfortunate, since HERE maps allows offline maps. We need a public registry of apps that embed tracking SDKs. And iOS needs an outbound firewall, now that it is shipping an App Privacy Report.

vinay427 5y ago
> And iOS needs an outbound firewall This can already easily be added through third-party apps. Would a system-wide firewall be a worthwhile improvement? I suppose it would help to have it enabled by default for users who wouldn’t install a tracker firewall app afterwards.
- walterbell 5y ago
  Is there an iOS 3rd-party app which can provide on-device outbound firewalling across all apps?
  - vinay427 5y ago
    Yes, AdGuard seems to do so and IIRC also has customizable block lists. The default includes Safari-only blocking but it is able to add a device-wide filter using Apple's API for VPNs. It seems to identify the various trackers used by the social media apps on my device, for instance. App store link: https://apps.apple.com/app/apple-store/id1047223162 https://apps.apple.com/app/apple-store/id1047223162 GitHub link: https://github.com/AdguardTeam/AdguardForiOS https://github.com/AdguardTeam/AdguardForiOS System-wide blocking: https://adguard.com/en/blog/how-to-configure-system-wide-blocking.html https://adguard.com/en/blog/how-to-configure-system-wide-blo...
    - walterbell 5y ago
      Thank you!
    - walterbell 5y ago
      Looks like system-wide blocking is via DNS, which would leak DNS requests to AdGuard's DNS server? The same could be accomplished with a local PiHole device.

jlg23 5y ago

Thanks for the pointer! Unfortunately FB is free on the major mobile operators and thus basically mandatory for communication, so my phone calls "home to Zuck" regularly anyways :/