Android, iOS beam telemetry to Google, Apple even when you tell them not to – study
- Reference: 1617261005
- News link: https://www.theregister.co.uk/2021/04/01/android_ios_location/
- Source link:
In a recent released research paper, titled "Mobile Handset Privacy: Measuring The Data iOS and Android Send to Apple And Google"
[1]PDF
, Douglas Leith, chairman of computer systems in the school of computer science and statistics at Trinity College Dublin, Ireland, documents how iPhones and Android devices phone home regardless of the wishes of their owners.[2]
According to Leith, Android and iOS handsets share data about their salient characteristics with their makers every 4.5 minutes on average.
"The phone IMEI, hardware serial number, SIM serial number and IMSI, handset phone number etc are shared with Apple and Google," the paper says. "Both iOS and Google Android transmit telemetry, despite the user explicitly opting out of this."
[3]
Both iOS and Google Android transmit telemetry, despite the user explicitly opting out of this
These transmissions occur even when the iOS Analytics & Improvements option is turned off and the Android Usage & Diagnostics option is turned off.
Such data [4]may be considered personal information under privacy rules, depending upon the applicable laws and whether they can be associated with an individual. It can also have legitimate uses.
Of the two mobile operating systems, Android is claimed to be the more chatty: According to Leith, "Google collects a notably larger volume of handset data than Apple."
Within 10 minutes of starting up, a Google Pixel handset sent about 1MB of data to Google, compared to 42KB of data sent to Apple in a similar startup scenario. And when the handsets sit idle, the Pixel will send about 1MB every 12 hours, about 20x more than the 52KB sent over the same period by an idle iPhone.
Extrapolated across the estimated US customer base of 129m Android users and 113m iPhone users, that works out to Apple collecting 5.8GB of data every 12 hours and Google collecting 1.3TB in America alone, the team estimates.
Google however contends Leith's figures are off by an order of magnitude.
Secret spy
Leith's tests excluded data related to services selected by device users, like those related to search, cloud storage, maps, and the like. Instead, they focused on the transmission of data shared when there's no logged in user, including IMEI number, hardware serial number, SIM serial number, phone number, device ids (UDID, Ad ID, RDID, etc), location, telemetry, cookies, local IP address, device Wi-Fi MAC address, and nearby Wi-Fi MAC addresses.
This last category is noteworthy because it has privacy implications for other people on the same network. As the paper explains, iOS shares additional data: the handset Bluetooth UniqueChipID, the Secure Element ID (used for Apple Pay), and the Wi-Fi MAC addresses of nearby devices, specifically other devices using the same network gateway.
New lawsuit: Why do Android phones mysteriously exchange 260MB a month with Google via cellular data when they're not even in use? [5]READ MORE
"When the handset location setting is enabled, these MAC addresses are also tagged with the GPS location," the paper says. "Note that it takes only one device to tag the home gateway MAC address with its GPS location and thereafter the location of all other devices reporting that MAC address to Apple is revealed."
Collecting such data, Leith observes, doesn't necessarily constitute a privacy violation, but may when linked to a specific individual.
Linkage of this sort occurs when a user logs in to use Google Play or the iOS App Store and associates the device data with personal details used for authentication and payment, the paper says. It also occurs whenever a handset connects with a backend server and reveals its IP address, which can be used by geoIP services to infer user location.
"Many studies have shown that location data linked over time can be used to de-anonymize," Leith observes in his paper.
Google, however, disputes the methodology Leith employed to make his measurements.
"We identified flaws in the researcher's methodology for measuring data volume and disagree with the paper’s claims that an Android device shares 20 times more data than an iPhone," a company spokesperson said in an email to The Register on Wednesday. "According to our research, these findings are off by an order of magnitude, and we shared our methodology concerns with the researcher before publication."
These findings are off by an order of magnitude, and we shared our methodology concerns with the researcher before publication
Google points out that Android supports many more handset models than iOS, making data about devices more salient from a network and operations perspective. Collecting data on CPU loads and apps that remain active on screen, for example, makes it possible to optimize power consumption.
Google's position is that Leith's research basically just outlines how smartphones work.
"Modern cars regularly send basic data about vehicle components, their safety status and service schedules to car manufacturers, and mobile phones work in very similar ways," the company's spokesperson said. "This report details those communications, which help ensure that iOS or Android software is up to date, services are working as intended, and that the phone is secure and running efficiently."
Google also has a plausible fine-print justification: Leith notes that Google's analytics options menu includes the text, "Turning off this feature doesn’t affect your device’s ability to send the information needed for essential services such as system updates and security." However, Leith argues that this "essential" data is extensive and beyond reasonable user expectations.
[6]
As for Apple, you might think a company that proclaims "What happens on your iPhone stays on your iPhone" on billboards, and "Your data. Your choice," on its website would want to explain its permission-defying telemetry. Yet the iPhone maker did not respond to a request for comment. ®
Get our [7]Tech Resources
[1] https://www.scss.tcd.ie/doug.leith/apple_google.pdf
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YGWZu0t1dxOQaTgJj1PHOAAAAIg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YGWZu0t1dxOQaTgJj1PHOAAAAIg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://blog.zimperium.com/may-25-2018-big-day-gdpr-just-another-one-mobile-security-privacy-leader/
[5] https://www.theregister.com/2020/11/14/google_android_data_allowance/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YGWZu0t1dxOQaTgJj1PHOAAAAIg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://whitepapers.theregister.com/
What a revelation?
Yeah, nothing tcpdump and wireshark haven't told me in ages. There should be serious punishment meted out for such flagrant violations of privacy and trust.
I would even go along the lines of the French tax model where they pay for the judiciary to appoint offices to supervise their operations and ensure that they comply with the relevant laws. This bullshit it was a rogue developer or some misunderstanding or we were just "testing" is complete and utter bullshit. I am sick and tired of meaningless fines and/or orders for mandatory training. Change the law to allow the supervision from withing and you will see compliance immediately.
Surprised?
I am not. This is one of the reasons I have a basic phone.
Re: Surprised?
And you think your 'basic phone' doesn't share information like IMEI, SIM data and UUID?
If you have a phone that uses the GSM protocol, it shares this data. It's literally how the network works.
Re: Surprised?
I don't believe that the GSM protocol requires that any data be sent to to the original device manufacturers, only the networks.
That said, many people might have more trust in Apple's business model (seeking to retain lucrative customers for decades by selling them hardware) than they do the confusopoly of the network operators.
Also, a lot of people are glad of the Find My iPhone service that wouldn't work if a bag-snatcher could easily disable telemetry.
Never mind the width feel the quality
I note that Google does not deny the slurpage, only the alleged quantity; which still works out to double that of the fruity lot.
Re: Never mind the width feel the quality
Just about to say the same thing.
Re: Never mind the width feel the quality
They said the estimate was "off by an order of magnitude" - but they didn't say in which direction.
What I want to know is whether all this slurpage still takes place if mobile data is switched off.
What really irks me is that mobile data is expensive - all this slurpage is being done without my consent and on my dime.
It's this sense of entitlement that get's me
Google said....
"Modern cars regularly send basic data about vehicle components, their safety status and service schedules to car manufacturers, and mobile phones work in very similar ways," the company's spokesperson said. "This report details those communications, which help ensure that iOS or Android software is up to date, services are working as intended, and that the phone is secure and running efficiently."
A classic piece of whataboutery and entitlement. One we're speaking about phones not cars Google. And as far as I am concerned what car manufacturers do is not acceptable either! Car manufacturers take a damn sight more than that and in my view nothing should be sent back from my car full stop. The same as in a perfect world nothing would be sent back from my phone, computer, television, HiFi amp, Blu-Ray player etc.
It does need knocked on the head, unfortunately too many members of the public give it "nothing to fear, nothing to hide" and cannot see what the fuss is about.
As far as I am concerned once you have bought a product, the manufacturer loses all tie and rights to that product. My device, my data etc it is not there for a manufacturer (or OS creator) to use as a money making excercise, a way to avoid paying for test environments, or indeed global domination. Unfortunately its so ingrained in people now, they see it as normal, something that 15-20 years ago would have required covert surveillance, rifling through your possessions in secret, and any other activities that would have had a regular person convicted under current stalking laws, or at very least placing someone under fear or alarm. Its gone too far, can it ever be turned around now?
Re: It's this sense of entitlement that get's me
I was talking to a coworker of my wife last week about this and he was totally oblivious of these issues, his attitude was “whatever.,, I don’t care, it’s nothing”. And that is exactly the attitude of the general public. They simply don’t give a sh$&. There is no hope of this changing while the general population really don’t give a fuck. It will take a massive data breach, globally, where there are severe financial consequences for the public before this becomes an “issue”, and even then, the guilty will just roll out the boilerplate bullshit of “we value your privacy...blah blah blah”. The only solution is regulation but that’s not going to happen any time soon unfortunately.
Re: It's this sense of entitlement that get's me
>> “we value your privacy..."
Yup. It's very valuable to us.
GDPR ...
Is this not the sort of thing that the GDPR was supposed to stop.
Why are Google, Apple, Facebook, ... just allowed to break privcay laws ? I suppose for much the same reason that they get away with not paying taxes!
When my S8 started showing its age, jumped to iP12, one small reason, Apple slurps less private info, Google is just too nosey and sems to be unaccountable.
Oh, so slurping less is acceptable to you ? You accept nosey, but too nosey is too far ?
I'm sorry, for me just plain nosey is already too far.
Linux phone... here I come...
See title.
Re: Linux phone... here I come...
Good luck getting a phone that doesn't share any data. Hint: they all do, that's how the GSM protocol works.
Sharing data so that the phone company can connect your call is more than okay, it's required. None of that data needs to get to the phone maker.
This
Just confirms that having a phone and carrying around with you, pin points to anyone who's interested (pick your TLA or Corporation of concern) your exact location and that they can track your every move (and of those around you), even if you think your opting out. Nothing new in that revelation. The details mentioned in the article however did peak my interest.
It mentioned that compete MAC and IP addresses (along with other such identifying data) where being returned. It goes on to say that the companies responded that they need this information to in general to monitor the performance (in a wide sense) of their product. It would seem to me that they could collect incomplete data for such items, such as a MAC address of 00-26-DD-XX-XX-XX, and it would fulfill that brief. It would confirm that the phone is connected (or any other monitored function) and that it is working nominally without sending to the mother ship any personally identifying data. Should we suggest this :) Pipe dream I know...
I truly believe Apple are doing the right thing by its customers and Google is just evil.
Or is it the other way around? Or are both utter shits?
The form of your post implies a symetry between the type and quantity of data collected by Apple and Google respectively, a symetry that might not be there in reality.
Yawn!
The mobile telcos collect all the basic shit anyway, so they can track your phone activity as part of the billing process. If the phonemakers of this world were banned from collecting it, they'd just do deals with the telcos along the lines of "spill us the shit or our next OS release will crash on your networks, here's some $$$ (a tenth of what we currently spend on spyware/exploitation dev) to help focus your minds. Oh, and you license us to sell it on, got that?"...
... OMG, they already have?
Re: Yawn!
In the USA, some telcos were recently found to have been selling location data about their paying customers to other companies.
That Pesky Rogue Developer
certainly gets around