9 ms·

Hi HN, this is my efforts in reverse engineering a BLE car battery monitor where it's app has over 100,000 downloads on the Google Play store alone. It turns o

by haxrob 3y ago

Hi HN, this is my efforts in reverse engineering a BLE car battery monitor where it's app has over 100,000 downloads on the Google Play store alone. It turns out it's sending GPS, cell phone tower cell IDs and Wifi beacon data to servers in Hong Kong and mainland China on a continued basis. Google and Apple app store pages say no personal data is collected or sent to 3rd parties. Hopefully readers pick up a few tips on reversing apps for their connected devices.

qwertox 3y ago
Thank you for your effort. There also appears to be a BM6 variant which explicitly states that you get a personal account and will be able to track your car. https://www.amazon.de/dp/B0BLG9Z462 https://www.amazon.de/dp/B0BLG9Z462 You can click the images where the third one contains a comparison. Interesting that they pretend that BM6 has this as a special feature since it just is a feature of the app. The QR code [0] on the device points to this app: https://play.google.com/store/apps/details?id=com.dc.bm6 https://play.google.com/store/apps/details?id=com.dc.bm6 So I checked other URLs like https://link.quicklynks.com/bm3.html https://link.quicklynks.com/bm3.html and https://link.quicklynks.com/bm4.html https://link.quicklynks.com/bm4.html, and the latter redirects to https://www.leagend.com/ https://www.leagend.com/ which operates this YT channel https://www.youtube.com/channel/UCqkvyOFP5cXQ02f3h1Ns42Q https://www.youtube.com/channel/UCqkvyOFP5cXQ02f3h1Ns42Q [0] http://link.quicklynks.com/bm6.html http://link.quicklynks.com/bm6.html
- x1sec 3y ago
  Nice find. It appears the application is by the same developer [1]: The play store page for this app states: - No data shared with third parties - This app may collect these data types - Data isn’t encrypted - You can request that data be deleted I just checked the BM2 app (subject of the blog post series) and they have updated with the similar detail [2], updated on the 25th of June 2023, although they say the data is encrypted - will need to verify if this is the case with the latest release. It also still says data not sent to any third party. If they still use the Alibaba AMap SDK - then that's a third party. The Apple app store also now discloses location data is being sent [3] I'd like to think my research / blog posts put pressure on them to start being honest with their customers. This doesn't excuse them though. A battery monitor does not need to know your location. [1] https://play.google.com/store/apps/details?id=com.dc.bm6 https://play.google.com/store/apps/details?id=com.dc.bm6 [2] https://play.google.com/store/apps/details?id=com.dc.battery.monitor2 https://play.google.com/store/apps/details?id=com.dc.battery... [3] https://apps.apple.com/au/app/battery-monitor-bm2/id1115492033 https://apps.apple.com/au/app/battery-monitor-bm2/id11154920...
  - jacquesm 3y ago
    We'll probably never know but it would be very interesting to get an idea for their motivation to collect this data in the first place. It's a fine line between data collection for commercial reasons and spying. Of course the mis-representation is an issue all by itself and Apple/Google should kill this app for that reason alone if they are going to be consistent.
    - worik 3y ago
      > It's a fine line between data collection for commercial reasons and spying No there is not. Your permission is the line
      - jacquesm 3y ago
        I think you misunderstood my comment.
    - ddalex 3y ago
      Just to map locations of cell towers is really nice as it can be used to augment positioning of other mobile devices
  - justinclift 3y ago
    > You can request that data be deleted Requesting is easy... but trusting the whole "Yeah, we definitely deleted that data you asked us about" is where things can be tricky. :/
russdill 3y ago
The worst part about this is last I checked, Android requires location permission to connect to a BLE device. Presumably because BLE scanning can determine location.
- x1sec 3y ago
  Google do offer Android app developers guidance in this regard: https://developer.android.com/guide/topics/connectivity/bluetooth/permissions https://developer.android.com/guide/topics/connectivity/blue...
- thombles 3y ago
  As described in sibling's link, they finally corrected this in Android 12 with fine-grained permissions including a flag for whether you are intending to use the BLE for location purposes or not. iOS is now somewhat behind in granularity.
  - Retric 3y ago
    “intending” seems like an unfortunate phrasing there. Is Android actually verifying this, or can this be used to misrepresent what’s going on?
    - thombles 3y ago
      The docs note that certain kinds of beacons (which presumably would only be useful for location-finding) will be filtered from results. Otherwise I suppose it's just a soft flag for Play Store review or similar. There's not much you can do - if a given app has access to BLE scan results, it's very difficult to prove that it's _not_ deriving location from that either locally or on a server. I'm satisfied that it's usually going to be difficult though, with the possible exception of say, a supermarket app who plants non-beacon-like devices in their stores. However a user would probably raise their eyebrows at a supermarket app that asks for access to Bluetooth.
      - russdill 3y ago
Aardwolf 3y ago
Why do 100k people need a car battery monitoring app? The dial is right on the dashboard of the car, what does this app possibly do?! And drain your phone battery continously as well, is that really worth the ability to see on your phone screen what your dashboard already tells? And if it's for a stationary battery, why not just analog volt meter dial? Sorry for complaining, but it's so hard to find standalone devices that don't require an app nowadays (simple example: try finding an LED lamp where you can choose the light color that allows doing it with a button on the lamp itself without app - I found one but it was non-trivial and it still doesn't allow color cycling without app). If people wouldn't prefer this BS, it would be easier to find sane electronics/electrics again.
- aembleton 3y ago
  Lots of cars don't have this dial - such as the Mk2 Prius. Mind you, I've never wanted this information either.
- flangola7 3y ago
  There's no battery information on my car dashboard.
  - Aardwolf 3y ago
    Not even a low battery warning icon when it's getting low?
    - skinner927 3y ago
      I’ve had more than one battery die with zero indication on the dash.
    - wlonkly 3y ago
      The indicator with a picture of a battery is really about your alternator.
- jjoonathan 3y ago
  The battery is there to start the (ICE) car. Its voltage under ~500 of amps of load is the relevant voltage. The voltage when the car is off is almost always irrelevant (it provides no guarantee about the ability to crank) and the voltage when the car is running is doubly irrelevant (alternator). What you want to do is watch and record the voltage dip while cranking, and this alone will give you a sense of your battery health.

by haxrob 3y ago

qwertox 3y ago

Thank you for your effort. There also appears to be a BM6 variant which explicitly states that you get a personal account and will be able to track your car. https://www.amazon.de/dp/B0BLG9Z462 https://www.amazon.de/dp/B0BLG9Z462 You can click the images where the third one contains a comparison. Interesting that they pretend that BM6 has this as a special feature since it just is a feature of the app. The QR code [0] on the device points to this app: https://play.google.com/store/apps/details?id=com.dc.bm6 https://play.google.com/store/apps/details?id=com.dc.bm6 So I checked other URLs like https://link.quicklynks.com/bm3.html https://link.quicklynks.com/bm3.html and https://link.quicklynks.com/bm4.html https://link.quicklynks.com/bm4.html, and the latter redirects to https://www.leagend.com/ https://www.leagend.com/ which operates this YT channel https://www.youtube.com/channel/UCqkvyOFP5cXQ02f3h1Ns42Q https://www.youtube.com/channel/UCqkvyOFP5cXQ02f3h1Ns42Q [0] http://link.quicklynks.com/bm6.html http://link.quicklynks.com/bm6.html

x1sec 3y ago
Nice find. It appears the application is by the same developer [1]: The play store page for this app states: - No data shared with third parties - This app may collect these data types - Data isn’t encrypted - You can request that data be deleted I just checked the BM2 app (subject of the blog post series) and they have updated with the similar detail [2], updated on the 25th of June 2023, although they say the data is encrypted - will need to verify if this is the case with the latest release. It also still says data not sent to any third party. If they still use the Alibaba AMap SDK - then that's a third party. The Apple app store also now discloses location data is being sent [3] I'd like to think my research / blog posts put pressure on them to start being honest with their customers. This doesn't excuse them though. A battery monitor does not need to know your location. [1] https://play.google.com/store/apps/details?id=com.dc.bm6 https://play.google.com/store/apps/details?id=com.dc.bm6 [2] https://play.google.com/store/apps/details?id=com.dc.battery.monitor2 https://play.google.com/store/apps/details?id=com.dc.battery... [3] https://apps.apple.com/au/app/battery-monitor-bm2/id1115492033 https://apps.apple.com/au/app/battery-monitor-bm2/id11154920...
- jacquesm 3y ago
  We'll probably never know but it would be very interesting to get an idea for their motivation to collect this data in the first place. It's a fine line between data collection for commercial reasons and spying. Of course the mis-representation is an issue all by itself and Apple/Google should kill this app for that reason alone if they are going to be consistent.
  - worik 3y ago
    > It's a fine line between data collection for commercial reasons and spying No there is not. Your permission is the line
    - jacquesm 3y ago
      I think you misunderstood my comment.
  - ddalex 3y ago
    Just to map locations of cell towers is really nice as it can be used to augment positioning of other mobile devices
- justinclift 3y ago
  > You can request that data be deleted Requesting is easy... but trusting the whole "Yeah, we definitely deleted that data you asked us about" is where things can be tricky. :/

russdill 3y ago

The worst part about this is last I checked, Android requires location permission to connect to a BLE device. Presumably because BLE scanning can determine location.

x1sec 3y ago
Google do offer Android app developers guidance in this regard: https://developer.android.com/guide/topics/connectivity/bluetooth/permissions https://developer.android.com/guide/topics/connectivity/blue...
thombles 3y ago
As described in sibling's link, they finally corrected this in Android 12 with fine-grained permissions including a flag for whether you are intending to use the BLE for location purposes or not. iOS is now somewhat behind in granularity.
- Retric 3y ago
  “intending” seems like an unfortunate phrasing there. Is Android actually verifying this, or can this be used to misrepresent what’s going on?
  - thombles 3y ago
    The docs note that certain kinds of beacons (which presumably would only be useful for location-finding) will be filtered from results. Otherwise I suppose it's just a soft flag for Play Store review or similar. There's not much you can do - if a given app has access to BLE scan results, it's very difficult to prove that it's _not_ deriving location from that either locally or on a server. I'm satisfied that it's usually going to be difficult though, with the possible exception of say, a supermarket app who plants non-beacon-like devices in their stores. However a user would probably raise their eyebrows at a supermarket app that asks for access to Bluetooth.
    - russdill 3y ago

Aardwolf 3y ago

Why do 100k people need a car battery monitoring app? The dial is right on the dashboard of the car, what does this app possibly do?! And drain your phone battery continously as well, is that really worth the ability to see on your phone screen what your dashboard already tells? And if it's for a stationary battery, why not just analog volt meter dial? Sorry for complaining, but it's so hard to find standalone devices that don't require an app nowadays (simple example: try finding an LED lamp where you can choose the light color that allows doing it with a button on the lamp itself without app - I found one but it was non-trivial and it still doesn't allow color cycling without app). If people wouldn't prefer this BS, it would be easier to find sane electronics/electrics again.

aembleton 3y ago
Lots of cars don't have this dial - such as the Mk2 Prius. Mind you, I've never wanted this information either.
flangola7 3y ago
There's no battery information on my car dashboard.
- Aardwolf 3y ago
  Not even a low battery warning icon when it's getting low?
  - skinner927 3y ago
    I’ve had more than one battery die with zero indication on the dash.
  - wlonkly 3y ago
    The indicator with a picture of a battery is really about your alternator.
jjoonathan 3y ago
The battery is there to start the (ICE) car. Its voltage under ~500 of amps of load is the relevant voltage. The voltage when the car is off is almost always irrelevant (it provides no guarantee about the ability to crank) and the voltage when the car is running is doubly irrelevant (alternator). What you want to do is watch and record the voltage dip while cranking, and this alone will give you a sense of your battery health.