Security-X

Forum Security-X => News => Discussion démarrée par: igor51 le février 10, 2018, 21:00:26

Titre: [FireEye]A Little Bird Told Me: Personal Information Sharing in Angry Birds and its Ad Libraries
Posté par: igor51 le février 10, 2018, 21:00:26
A Little Bird Told Me: Personal Information Sharing in Angry Birds and
its Ad Libraries

Many popular mobile apps, including Rovio’s ubiquitous Angry Birds,
  collect and share players’ personal information much more widely than
  most people realize.


 

Some news reports have begun to scratch the surface of the
  situation. The New York Times     href="http://www.nytimes.com/2012/10/29/technology/mobile-apps-have-a-ravenous-ability-to-collect-personal-data.html?_r=0">reported
    on Angry Birds and other data-hungry apps last October. And in
  January, the     href="http://www.nytimes.com/2014/01/28/world/spy-agencies-scour-phone-apps-for-personal-data.html">newspaper
    teamed up with public-interest news site   href="http://www.propublica.org/article/spy-agencies-probe-angry-birds-and-other-apps-for-personal-data">ProPublica
  and U.K. newspaper the   href="http://www.theguardian.com/world/2014/jan/27/nsa-gchq-smartphone-app-angry-birds-personal-data">Guardian
  for a series of stories detailing how government agencies use the game
  (and other mobile apps) to collect personal data. Even the
  long-running CBS show 60 Minutes reported earlier this month that     href="http://www.cbsnews.com/videos/the-data-brokers-the-heart-of-the-revolution-alma/">Rovio
    shares users’ locations.


 

The Android version of Angry Birds in the Google Play store, updated
  on March 4, continues to share personal information. In fact, more
  than a quarter billion users who create Rovio accounts to save their
  game progress across multiple devices might be unwittingly sharing all
  kinds of information—age, gender, and more — with multiple parties.
  And many more users who play the game without a Rovio account are
  sharing their device information without realizing it.


 

Once a Rovio account is created and personal information uploaded,
  the user can do little to stop this personal information sharing.
  Their data might be in multiple locations: Angry Birds Cloud, Burstly
  (ad mediation platform), and third-party ad networks such as Jumptap
  and Millennial Media. Users can avoid sharing personal data by playing
  Angry Birds without Rovio account, but that won’t stop the game from
  sharing device information.


 

In this blog post, we examine the personal information Angry Birds
  collects. We also demonstrate the relationships between the app, the
  ad mediation platform, and the ad clouds — showing how the information
  flows among the three. We also spell out the evidence, such as network
  packet capture (PCap) from FireEye Mobile Threat Prevention (MTP), to
  support our information flow chart. Finally, we reveal how the
  multi-stage information sharing works by tracking the code paths from
  the reverse-engineered source code.


 

To investigate the mechanism and contents of the information
  sharing, we researched different versions of Angry Birds. We found
  that multiple versions of the game can share personal information in
  clear text, including email, address, age, and gender.


 

Angry Birds’ data management service, “ad-x.co.uk,” shares
  information in the penultimate version of the game (V4.0.0), which was
  offered in the Google Play store through March 4.  And contrary to
  media reports that this data sharing occurred only on an older
  “special edition” of the game, we found that some  sharing occurs in
  multiple versions of Angry Birds — including the latest to the
  “classic” version, 4.1.0. (This update as added to Google Play on
  March 4.) With more than 2 billion downloads of Angry Birds so far,
  this sharing affects many, many devices.


 


  What information is shared?


 

Angry Birds encourages players to create Rovio accounts, touting the
  following benefits:


 
 

 


Source: A Little Bird Told Me: Personal Information Sharing in Angry Birds and
its Ad Libraries (http://)