4 ms·

AMap is the equivalent of Google Maps in China, so when Google started collecting wifi SSIDs and cell IDs on android and using them for faster-than-GPS or GPS-d

AMap is the equivalent of Google Maps in China, so when Google started collecting wifi SSIDs and cell IDs on android and using them for faster-than-GPS or GPS-denied location determination, it was only a matter of time until AMap added it. The article seems to be suggesting the device itself is gathering data and reporting back covertly ... but I believe it's just the AMap library included by the app developer doing its thing. In all likelihood, the data comes from phone sensors and is gathered by the app library, not from the device. And indeed, the Chinese language app logs on the Part 3 page only seem to refer to bluetooth and power related functions. This supports a hypothesis of the app and device developers not knowing this collection is going on - ie. standard-library-using-developer not international-covert-surveillance-product-conspiracy. I think that is far more likely.

x1sec 3y ago
> The article seems to be suggesting the device itself is gathering data and reporting back covertly ... but I believe it's just the AMap library included by the app developer doing its thing. If this is the take away, then I need to think about how I have phrased things. The GPS co-ordinates are sent two separate companies: 1) The Bluetooth device developer (bm2.quicklynks.com) 2) AMap (dualstack-cgicol.amap.com) Looking at the decomplication and HTTP REST messages, it is very clear the app developer is deliberately sending GPS to their servers. They send a JSON object with the battery voltages, bluetooth device address and lat/lng in the same request. The cell data, wifi beacon data - this is exclusively collected by AMap services and is not apparent without investing significant time reverse engineering their SDK.
- contingencies 3y ago
  Oh right, fair enough. So the actual breach of trust is the non-premium (non-tracking) app version sends GPS to the app developer, when they'd claimed otherwise and only the premium version is supposed to do so. This doesn't really justify delving in to device firmware, but more power to you.
  - x1sec 3y ago
    I'm confused by what you mean here, could you elaborate? For clarification - you purchase the hardware then you are required to download the phone application. You find this app by scanning the QR code printed on the physical device's box. This app is free. It does not link to a premium version.
    - contingencies 3y ago
      I thought I read something saying there was a position-reporting version you could pay for. If that's the case, and they share an app, this is not surprising. If not, no idea where that idea came from. Anyway, phones = no privacy, app installed and reporting online or otherwise. Too many tracking vulnerabilities... every wireless stack (wifi/BT/cellular), platform accounts (Google/Mac), mobile network operator, SIM provider, SS7, etc.

x1sec 3y ago

> The article seems to be suggesting the device itself is gathering data and reporting back covertly ... but I believe it's just the AMap library included by the app developer doing its thing. If this is the take away, then I need to think about how I have phrased things. The GPS co-ordinates are sent two separate companies: 1) The Bluetooth device developer (bm2.quicklynks.com) 2) AMap (dualstack-cgicol.amap.com) Looking at the decomplication and HTTP REST messages, it is very clear the app developer is deliberately sending GPS to their servers. They send a JSON object with the battery voltages, bluetooth device address and lat/lng in the same request. The cell data, wifi beacon data - this is exclusively collected by AMap services and is not apparent without investing significant time reverse engineering their SDK.

contingencies 3y ago
Oh right, fair enough. So the actual breach of trust is the non-premium (non-tracking) app version sends GPS to the app developer, when they'd claimed otherwise and only the premium version is supposed to do so. This doesn't really justify delving in to device firmware, but more power to you.
- x1sec 3y ago
  I'm confused by what you mean here, could you elaborate? For clarification - you purchase the hardware then you are required to download the phone application. You find this app by scanning the QR code printed on the physical device's box. This app is free. It does not link to a premium version.
  - contingencies 3y ago
    I thought I read something saying there was a position-reporting version you could pay for. If that's the case, and they share an app, this is not surprising. If not, no idea where that idea came from. Anyway, phones = no privacy, app installed and reporting online or otherwise. Too many tracking vulnerabilities... every wireless stack (wifi/BT/cellular), platform accounts (Google/Mac), mobile network operator, SIM provider, SS7, etc.