4 ms·

> The article seems to be suggesting the device itself is gathering data and reporting back covertly ... but I believe it's just the AMap library included by th

by x1sec 3y ago

> The article seems to be suggesting the device itself is gathering data and reporting back covertly ... but I believe it's just the AMap library included by the app developer doing its thing. If this is the take away, then I need to think about how I have phrased things. The GPS co-ordinates are sent two separate companies: 1) The Bluetooth device developer (bm2.quicklynks.com) 2) AMap (dualstack-cgicol.amap.com) Looking at the decomplication and HTTP REST messages, it is very clear the app developer is deliberately sending GPS to their servers. They send a JSON object with the battery voltages, bluetooth device address and lat/lng in the same request. The cell data, wifi beacon data - this is exclusively collected by AMap services and is not apparent without investing significant time reverse engineering their SDK.

contingencies 3y ago
Oh right, fair enough. So the actual breach of trust is the non-premium (non-tracking) app version sends GPS to the app developer, when they'd claimed otherwise and only the premium version is supposed to do so. This doesn't really justify delving in to device firmware, but more power to you.
- x1sec 3y ago
  I'm confused by what you mean here, could you elaborate? For clarification - you purchase the hardware then you are required to download the phone application. You find this app by scanning the QR code printed on the physical device's box. This app is free. It does not link to a premium version.
  - contingencies 3y ago
    I thought I read something saying there was a position-reporting version you could pay for. If that's the case, and they share an app, this is not surprising. If not, no idea where that idea came from. Anyway, phones = no privacy, app installed and reporting online or otherwise. Too many tracking vulnerabilities... every wireless stack (wifi/BT/cellular), platform accounts (Google/Mac), mobile network operator, SIM provider, SS7, etc.

by x1sec 3y ago

contingencies 3y ago

Oh right, fair enough. So the actual breach of trust is the non-premium (non-tracking) app version sends GPS to the app developer, when they'd claimed otherwise and only the premium version is supposed to do so. This doesn't really justify delving in to device firmware, but more power to you.

x1sec 3y ago
I'm confused by what you mean here, could you elaborate? For clarification - you purchase the hardware then you are required to download the phone application. You find this app by scanning the QR code printed on the physical device's box. This app is free. It does not link to a premium version.
- contingencies 3y ago
  I thought I read something saying there was a position-reporting version you could pay for. If that's the case, and they share an app, this is not surprising. If not, no idea where that idea came from. Anyway, phones = no privacy, app installed and reporting online or otherwise. Too many tracking vulnerabilities... every wireless stack (wifi/BT/cellular), platform accounts (Google/Mac), mobile network operator, SIM provider, SS7, etc.