Reply to post: Re: 'Let us know if the mint suggestion worked!'

'Facebook takes data from my phone – but I don't have an account!'

Jamie Jones Silver badge

Re: 'Let us know if the mint suggestion worked!'

Interesting idea, though location data can be transfered in 4 bytes.. It would be pretty easy to hide that somewhere, without uploading an image... Uploading an image would set my alarm bells off immediately! Have they got control of my camera?!

Ok, I found this. I wrote a script that deletes all the spying data files, but this is obviously one I missed:

44 -rw-rw---- 1 u0_a194 u0_a194 43043 Aug 27 2016 /data/data/air.SpaceZombies2/shared_prefs/Appodeal.xml

Look for "Appodeal.xml" in the shared_prefs folder of any app (you'll need to be root though)

This is a 43K file, starting off like:

<?xml version='1.0' encoding='utf-8' standalone='yes' ?>

<map>

ap>

<string name="banner">{&quot;status&quot;:&quot;ok&quot;,&quot;ads&quot;:[{&quot;status&quot;:&quot;mopub&quot;,&quot;id&quot;:&quot;YktV,,, etc.

decoding it gives a json file, uploading variables such as:

gender:

alcohol:

smoking: (how the f??? does it know that?)

Interestingly, it's also hacked other apps and uploaded their unique ids that were given to me, including: "admob, applovin, chartboost, inmobi, mopub, smaato"

The worst is this URL listed:

"url":"http://soma.smaato.net/oapi/reqAd.jsp?adspace=130015622

\u0026apiver=415

\u0026bundle=air.SpaceZombies2

\u0026device=Dalvik%2F2.1.0+%28Linux%3B+U%3B+Android+5.1.1%3B+R68G+Build%2FLMY48G%29

\u0026devicemodel=rockchip+R68G

\u0026devip=88.109.36.106

\u0026dimension=full_320x480

\u0026dimensionstrict=true

\u0026format=all

\u0026formatstrict=true

\u0026gender=m

\u0026googleadid=6d7d7151-9edf-4085-aa19-67726fd7dd1c

\u0026googlednt=false

\u0026gps=51.65765765765766%2C-4.0371868876609485

\u0026iabcategory=IAB95

\u0026kws=puzzle%2Ctools%2Cadventure

\u0026mraidver=2

\u0026pub=1001000335

\u0026response=html"

All those details were accurate at the time - as I said, I don;t even have gps on here, but if you look at the "gps" field, if you threw a hand-grnade at those coordinates, you'd blow up my sofa! (OK, slight exageration, but it's the coordinates of the playing field opposite!)

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019