6 ms·

Very interesting. How did you measure this? On-device or on the wire or with MITM?

schleck8 4y ago
Pretty simple with DNS logging. I installed the APK (it's not georestricted, you can just install it on Android). I set up a permanent VPN killswitch while testing, set up NextDNS as private DNS provider in the system settings and changed the NextDNS settings to log all contacted domains. You can then view the DNS requests in real time As for the clipboard, newer Android versions give you a toast when something uses the clipboard API to fetch its content
- uniqueuid 4y ago
  I think there's an evident need for someone to do a deep analysis of this app's behavior. Both with interception/MITM and possibly disassembly if that's even possible ATM. I remember trying to disassemble a facebook APK years ago and that was way too involved even then (because of countermeasures). Perhaps using frida on android is a saner approach these days.
  - schleck8 4y ago
    The same people who analyzed Pegasus did that, but Douyin obfuscates its code so a lot of activity is inconclusive https://citizenlab.ca/2021/03/tiktok-vs-douyin-security-privacy-analysis/ https://citizenlab.ca/2021/03/tiktok-vs-douyin-security-priv...
    - uniqueuid 4y ago
      Many thanks, the citizen lab does awesome work. Great to see this. [edit]: Awesome to see that they publish their reports on github and even include frida components https://github.com/citizenlab/tiktok-report-data https://github.com/citizenlab/tiktok-report-data
- throwaway4good 4y ago
  Why do you interpretate a DNS request as a "privacy invasion"? To me many DNS request sounds like a broken / poorly designed app. Do you block the requests - is that reason for the large number?
  - schleck8 4y ago
    Because some of the domains mixed into the bunch, which were contacted independently from the CDN at times, are known tracking domains. Even disregarding this fact, Douyin has 700 million annual users and this issue does not exist with Tiktok which uses the same codebase. You are telling me this is not intentional but an accident? With a company as large and skilled as Bytedance?
    - throwaway4good 4y ago
      It is an app not constrained by browser same origin rules. It could just do one request sending the tracking information and the receiver could pass that on as needed. I don't think you can deduce what you deduce from the number of DNS requests it does.
      - schleck8 4y ago
        It's rather about the fact that this is happening minutes after closing the app than the number, I do agree with you on the latter
  - sam0x17 4y ago
    The domains in question are very clearly analytics collectors disguised as cdns
dyingkneepad 4y ago
You can use Tracker Control: https://f-droid.org/en/packages/net.kollnig.missioncontrol.fdroid/ https://f-droid.org/en/packages/net.kollnig.missioncontrol.f...

Pretty simple with DNS logging. I installed the APK (it's not georestricted, you can just install it on Android). I set up a permanent VPN killswitch while testing, set up NextDNS as private DNS provider in the system settings and changed the NextDNS settings to log all contacted domains. You can then view the DNS requests in real time As for the clipboard, newer Android versions give you a toast when something uses the clipboard API to fetch its content

uniqueuid 4y ago
I think there's an evident need for someone to do a deep analysis of this app's behavior. Both with interception/MITM and possibly disassembly if that's even possible ATM. I remember trying to disassemble a facebook APK years ago and that was way too involved even then (because of countermeasures). Perhaps using frida on android is a saner approach these days.
- schleck8 4y ago
  The same people who analyzed Pegasus did that, but Douyin obfuscates its code so a lot of activity is inconclusive https://citizenlab.ca/2021/03/tiktok-vs-douyin-security-privacy-analysis/ https://citizenlab.ca/2021/03/tiktok-vs-douyin-security-priv...
  - uniqueuid 4y ago
    Many thanks, the citizen lab does awesome work. Great to see this. [edit]: Awesome to see that they publish their reports on github and even include frida components https://github.com/citizenlab/tiktok-report-data https://github.com/citizenlab/tiktok-report-data
throwaway4good 4y ago
Why do you interpretate a DNS request as a "privacy invasion"? To me many DNS request sounds like a broken / poorly designed app. Do you block the requests - is that reason for the large number?
- schleck8 4y ago
  Because some of the domains mixed into the bunch, which were contacted independently from the CDN at times, are known tracking domains. Even disregarding this fact, Douyin has 700 million annual users and this issue does not exist with Tiktok which uses the same codebase. You are telling me this is not intentional but an accident? With a company as large and skilled as Bytedance?
  - throwaway4good 4y ago
    It is an app not constrained by browser same origin rules. It could just do one request sending the tracking information and the receiver could pass that on as needed. I don't think you can deduce what you deduce from the number of DNS requests it does.
    - schleck8 4y ago
      It's rather about the fact that this is happening minutes after closing the app than the number, I do agree with you on the latter
- sam0x17 4y ago
  The domains in question are very clearly analytics collectors disguised as cdns

dyingkneepad 4y ago

You can use Tracker Control: https://f-droid.org/en/packages/net.kollnig.missioncontrol.fdroid/ https://f-droid.org/en/packages/net.kollnig.missioncontrol.f...