Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect...
Transcript of Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect...
![Page 1: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/1.jpg)
Exodus Privacy
![Page 2: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/2.jpg)
Exodus Privacy at 42Who we are
• MeTaL_PoU
• pnu
What we will talk about
• The behavior of mobile applications and its consequences for our privacy
• What Exodus Privacy tries to do against that
2
![Page 3: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/3.jpg)
Who we are
3
![Page 4: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/4.jpg)
Exodus Privacy• Group of French hacktivists
• Non-profit organization founded in October 2017
• Undefined number of members
• Strict legal rules
• We do FLOSS
4
![Page 5: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/5.jpg)
Our goal
Make people aware of permanenttracking on smartphones“
5
![Page 6: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/6.jpg)
How do we do?• Develop the εxodus privacy auditing platform
• Identify trackers by code signatures
• Statically analyze APK files
We develop a transparency tool allowing people to know what is embedded in
Android applications.
6
![Page 7: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/7.jpg)
![Page 8: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/8.jpg)
What we call a tracker
A tracker is a piece of softwaremeant to collect data about youor your usages.“
Like Ogury, Google Analytics, Teemo, and many other.
8
![Page 9: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/9.jpg)
![Page 10: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/10.jpg)
How we detect themStatic analysis
• List Java classes embedded in the APK
• Find classes matching the tracker code signature
What we use:
• Gplaycli: download the APK and get application details from Google Play
• Androguard: get permissions, code version and certificates
• Dexdump: extract list of classes from APK file
10
![Page 11: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/11.jpg)
Static analysis11
![Page 12: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/12.jpg)
Static analysis12
![Page 13: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/13.jpg)
Our tools
13
![Page 14: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/14.jpg)
εxodus web platform• Look for an Android application report with its search engine
• Analyze an Android application by submitting its identifier
• Get tips on how to better manage your privacy
https://reports.exodus-privacy.eu.org/
14
![Page 15: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/15.jpg)
Exodus Privacy Android applicationShow the trackers and required permissions in the apps in your smartphone
Available on F-Droid and Google Play!
15
![Page 16: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/16.jpg)
Standalone local analysis toolexodus-standalone
• εxodus CLI client for local APK static analysis
• Can be used by developers to scan their own app before release
• Prints reports as simple text or JSON
• Available as a Docker image for easier usage
github.com/Exodus-Privacy/exodus-standalone
16
![Page 17: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/17.jpg)
Exodify: εxodus in your browser• Browser extension for Firefox and Chrome
• Displays the number of trackers of each application
• Quick link to submit the application for an analysis
17
![Page 18: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/18.jpg)
Exodify: εxodus in your browser18
![Page 19: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/19.jpg)
ETIPεxodus tracker investigation platform
• Tracker database for εxodus
• Open to everyone and filled by the community
• Main features:
• Track all modifications on trackers
• Detect rules collisions for signature
https://etip.exodus-privacy.eu.org/
19
![Page 20: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/20.jpg)
Our results
20
![Page 21: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/21.jpg)
What we did since our launch• We identified +250 trackers, analyzed +60000 apps and generated +100000 reports
• We provided advices/courses to developers who want to respect privacy
• We performed deep audits of several applications like Deliveroo Rider or Baby+
• We provided statistics and datasets to journalists and labs
• We opened a REST API
• We created video animations to explain trackers in applications
Everything is free and open 🎄
21
![Page 22: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/22.jpg)
22
![Page 23: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/23.jpg)
Most frequent trackers on +60k applications23
![Page 24: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/24.jpg)
We are in the press• 📰 Le Monde - Des mouchards cachés dans vos applications pour smartphones
• 📰 The Intercept - Staggering Variety of Clandestine Trackers Found in Popular […]
• 📰 Next Inpact - Rencontre avec Exodus Privacy, qui révèle les trackers […]
• 📰 BoingBoing - Researchers craft Android app that reveals to find horrific […]
• 📰 The Guardian - Three quarters of Android apps track users with third party tools
• 📰 RT - Smartphone apps track Android users with ‘clandestine surveillance software’
• 📺 France 2 - Ils promettent de vous faire gagner du temps
• 📰 Numerama - Lutter contre les mouchards des apps, une cause citoyenne : […]
• 📺 LeMédiaTV - Surveillés, exploités : dans l’enfer des livreurs à vélo
• 📰 Mediapart - Dans le ventilateur à données de l’appli Météo-France
+8000 articles in +20 languages during the first 6 months
24
![Page 25: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/25.jpg)
CommunicationWe use different ways to make us visible:
• Our blog - https://news.exodus-privacy.eu.org/
• PeerTube and YouTube channels
• Mastodon, Twitter and Facebook accounts
• Flyers & Stickers ☺
• Talks like the one of today
25
![Page 26: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/26.jpg)
Our future
26
![Page 27: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/27.jpg)
What's next• Keep maintaining and improving the εxodus platform and application
• Create more videos and podcasts to explain tracking on mobile
• Continue to animate our Facebook page, PeerTube and YouTube channels
• Translate our media and tools into new languages
• Gather more and more motivated people to increase our number of volunteers
• Your next idea?
27
![Page 28: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/28.jpg)
What we needWe are a non-profit organization animated by volunteers.
To stay alive, we need:
Contributions & Money
https://exodus-privacy.eu.org/en/page/contribute/
28
![Page 29: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/29.jpg)
ThanksWe want the thank all our donators and partners:
Code Lutin Codeurs en liberté
F-Droid Framasoft
Gandi La Quadrature du Net
serveurs et infogérance haute-fidélité
Octopuce Yale Privacy Lab
as well as the community and all the regular or one-shot donators
29
![Page 30: Exodus Privacy - 42l · What we call a tracker A tracker is a piece of sof tware meant to collect data about you “ or your usages. L ike O g u ry, G o og le Anal y t ic s , Teemo,](https://reader035.fdocuments.us/reader035/viewer/2022081402/60559bcb404a081bfa7bcc7f/html5/thumbnails/30.jpg)
Q/A
30