10 ms·

Discovering that a Bluetooth car battery monitor is siphoning location data

• firefoxd 3y ago
  There needs to be a feature on android to give fake gps data on a real device. This would be useful for any app that requires gps for no good reason. If your flashlight app needs gps to turn on, no problem. You are currently on mount Kilimanjaro.
  • x1sec 3y ago
    Android warns the user that location related permissions are required. The issue is, is that this is required for Bluetooth scanning and the app developer abuses this by collecting other 'location data'. The app developer even tries to explain to the user with a pop up saying (paraphrasing) "click accept, so bluetooth will work".
    • sleepybrett 3y ago
      Or they just lie to you 'we need your location data to do <sensible thing you want>' (like say localized weather or nearby starbucks or whatever) however they then turn around and basically track you constantly and sell your data to all comers.
      • x1sec 3y ago
        This is exactly what what they did here. That said, the attention of the blog post seems to have triggered them to disclose now on the Apple [1] and Google Play [2] store that they are indeed collecting your location data. They got away with lying for quite some time, over 100k downloads on Play store and 1.57k reviews. [1] https://apps.apple.com/au/app/battery-monitor-bm2/id1115492033 https://apps.apple.com/au/app/battery-monitor-bm2/id11154920... [2] https://play.google.com/store/apps/datasafety?id=com.dc.battery.monitor2 https://play.google.com/store/apps/datasafety?id=com.dc.batt...
    • crossroadsguy 3y ago
      This is horrendous. Android does it to make it clear, actually this is my best guess, that having access to WiFi and BT controls might leak location data based on, I assume again, where those BT and WiFi devices are located - ie by some kind of reverse search. And since that might leak why the hell not force user to grant the location permission anyway when they want BT/WiFi functionality. I mean this is just retarded design. Unless there’s a “technical need” to use GPS while dealing with BT or WiFi that I am not aware of that.
  • alias_neo 3y ago
    There is a "mock location" feature in developer settings. As I understand it, you download an app that provides "mock location data" and select it, then it will provide mock locations in whatever manner it was written to do.
• hnburnsy 3y ago
  I am so sick of this I have resorted to putting almost all my apps on an old iPad (iOS being the lesser of two evils) connected to its own isolated guest network. My Android phone only has apps needed for leaving the house.
• haxrob 3y ago
  Hi HN, this is my efforts in reverse engineering a BLE car battery monitor where it's app has over 100,000 downloads on the Google Play store alone. It turns out it's sending GPS, cell phone tower cell IDs and Wifi beacon data to servers in Hong Kong and mainland China on a continued basis. Google and Apple app store pages say no personal data is collected or sent to 3rd parties. Hopefully readers pick up a few tips on reversing apps for their connected devices.
  • qwertox 3y ago
    Thank you for your effort. There also appears to be a BM6 variant which explicitly states that you get a personal account and will be able to track your car. https://www.amazon.de/dp/B0BLG9Z462 https://www.amazon.de/dp/B0BLG9Z462 You can click the images where the third one contains a comparison. Interesting that they pretend that BM6 has this as a special feature since it just is a feature of the app. The QR code [0] on the device points to this app: https://play.google.com/store/apps/details?id=com.dc.bm6 https://play.google.com/store/apps/details?id=com.dc.bm6 So I checked other URLs like https://link.quicklynks.com/bm3.html https://link.quicklynks.com/bm3.html and https://link.quicklynks.com/bm4.html https://link.quicklynks.com/bm4.html, and the latter redirects to https://www.leagend.com/ https://www.leagend.com/ which operates this YT channel https://www.youtube.com/channel/UCqkvyOFP5cXQ02f3h1Ns42Q https://www.youtube.com/channel/UCqkvyOFP5cXQ02f3h1Ns42Q [0] http://link.quicklynks.com/bm6.html http://link.quicklynks.com/bm6.html
    • x1sec 3y ago
      Nice find. It appears the application is by the same developer [1]: The play store page for this app states: - No data shared with third parties - This app may collect these data types - Data isn’t encrypted - You can request that data be deleted I just checked the BM2 app (subject of the blog post series) and they have updated with the similar detail [2], updated on the 25th of June 2023, although they say the data is encrypted - will need to verify if this is the case with the latest release. It also still says data not sent to any third party. If they still use the Alibaba AMap SDK - then that's a third party. The Apple app store also now discloses location data is being sent [3] I'd like to think my research / blog posts put pressure on them to start being honest with their customers. This doesn't excuse them though. A battery monitor does not need to know your location. [1] https://play.google.com/store/apps/details?id=com.dc.bm6 https://play.google.com/store/apps/details?id=com.dc.bm6 [2] https://play.google.com/store/apps/details?id=com.dc.battery.monitor2 https://play.google.com/store/apps/details?id=com.dc.battery... [3] https://apps.apple.com/au/app/battery-monitor-bm2/id1115492033 https://apps.apple.com/au/app/battery-monitor-bm2/id11154920...
• OldManRyan 3y ago
  Would love to learn more about this type of reverse engineering. Do you have any resources or tips on getting started?
  • x1sec 3y ago
    The best way is to just start practicing. I would say pick some simple apps on your (Android) phone and dig straight in. The great thing about Android applications is that often they generally decompile quite nice into human readable Java so the barrier of entry can be quite low to start reversing. Grab a copy of JADX[1] - it will decompress and decompile the APK files. If you don't have an Android handset, use an emulator and/or grab APKs from apkpure[2] Dynamic analysis is a bit more challenging. In my blog post I use Frida[3] extensively. If you get started on something and get stuck/looking for support, feel free to DM me on Twitter (handle in HN profile), more then happy to help. [1] https://github.com/skylot/jadx https://github.com/skylot/jadx [2] https://m.apkpure.com/ https://m.apkpure.com/ [3] https://frida.re/docs/android/ https://frida.re/docs/android/
    • OldManRyan 3y ago
      Thanks! I have an Android device so I'll start by looking at some apps I use daily.
      • x1sec 3y ago
        Great - good luck and most of all, have fun!
    • Daneel_ 3y ago
      "human readable Java" - that's a good one. I kid, I kid.. Somewhat.
      • dotancohen 3y ago
        Can't possibly be worse than reading someone else's perl.
• Syonyk 3y ago
  Of course it is. Because that's what "consumer tech" has turned into. An excuse to lie to end users as much as you can possibly get away with, to collect as much information from them as you possibly can, gatekept by companies who do not care in the slightest about any of those, unless it makes bad press for them, at which point they "promise to try harder to not get caught doing this in the future." And they don't even try to hide it. It's just that nobody looks. > Note: Since the BM2 does not use HTTPS, there is no need to even install a certificate. What this means is that anyone can independently identify that their latitude and longitude co-ordinates are being sent on either iOS or Android with no modifications to their phone. "Anyone can independently verify." And also, anyone on the network connection between you and the server can help themselves to this data.
  • jklinger410 3y ago
    Great observations. I hope everyone who shares these thoughts is voting for socialist candidates in their home countries. This is what unregulated capitalism looks like.
    • Zambyte 3y ago
      This is the result of "intellectual property" laws (which exist entirely outside of capitalism) being used by design. It's no surprise that when people have access to your computer and you are not legally allowed to know what they are doing with it, they abuse you.
    • lamontcg 3y ago
      I donated actual hard earned currency to my socialist candidate. Predictably futile, but I can state that none of this shit is my fault or what I wanted.
    • CyberDildonics 3y ago
      If unregulated capitalism is the problem, shouldn't people be voting for regulated capitalism?
      • 3y ago
• lyu07282 3y ago
  > "Since the Android app requires location permissions to use the hardware device" God because Blutooth LE devices need location permission on Android? How is that still a thing, I remember being outraged about that a decade ago or something.
  • varenc 3y ago
    Location permission is required because with Bluetooth access alone an app can essentially locate a device already by checking nearby device addresses against a database of known locations. Similar to how scanning WiFi BSSIDs can also determine location. It's a tricky problem. As a more technical user, I'd love it if they were separate permissions and the Bluetooth permission included an extra "your location can be determined from bluetooth alone" warning. But for the average user that's just going to confuse them.
    • jbaber 3y ago
      Isn't it a good thing that it informs the average user that the app can know your location?
      • varenc 3y ago
        edit: changed my original reply after I read the docs: https://developer.android.com/guide/topics/connectivity/bluetooth/permissions https://developer.android.com/guide/topics/connectivity/blue... On Android apps that don't use Bluetooth to derive location, and assert that they don't, will not prompt the user for a location permission. But this app is requesting `ACCESS_FINE_LOCATION` in its manifest. It could be doing that because they're acknowledging they are using Bluetooth to derive location, but I don't think they are. I suspect what's actually going on is that they're requesting that permission just so they can show your location inside an embedded map view. In which case the permission is not related to its Bluetooth usage.
        • x1sec 3y ago
          I do note that BLUETOOTH_SCAN could be used for versions 12+. The link you provided is good, I'll also reference that as it also has details on strong assertion (android:usesPermissionFlags - neverForLocation). > I suspect what's actually going on is that they're requesting that permission just so they can show your location inside an embedded map view. Does the embedded map do some processing in the cloud first? Because the lat/lng is sent over the same API request that includes the battery voltages as well as the BLE address of your handset. I really think none of this is essential to a simple app that reads a battery voltage on your screen.
• fswd 3y ago
  Victron's android mobile app for battery management does this as well. Luckily I spoof my GPS, according to them I'm in the middle of the pacific.
  • patja 3y ago
    Which Victron app? My install of Victron Connect doesn't seem to do this.
    • x1sec 3y ago
      Can you link me to the app store for this? Happy to take a look.
      • sodality2 3y ago
        Looks like this: https://play.google.com/store/apps/details?id=com.victronenergy.victronconnect https://play.google.com/store/apps/details?id=com.victronene...
        • patja 3y ago
          Yes that's it
          • x1sec 3y ago
            Great, will take a look and will post on Twitter if there is anything notable found. Twitter handle in my HN profile.
            • Daneel_ 3y ago
              Looking forward to that one! Followed you on all your channels. Thanks for the detailed write-up on the battery monitor - very interesting read!
              • 3y ago
• Waterluvian 3y ago
  Could someone fill me in: why do people want to monitor their 12V battery? Is it just a proxy for “you seem to have left your light on”? It honestly feels like a way to spy on family/company vehicles. Powered by the battery… knowing its voltage just being a side effect. But I guess that’s only if the app also tells you these data.
  • hsbauauvhabzb 3y ago
    Even if it is, the attitude of ‘don’t install this app as it might track you’ is not a viable solution for it that classes of app. Reducing risk is one thing, but until regulation occurs there’s nothing to stop every app you use doing the same thing.
  • Arrath 3y ago
    Less often used equipment/vehicles (say, boats or weekend motorcycles) are often put on battery tenders when not in use, to keep the battery fresh for when you do want to use it. Just yesterday my FIL was relating how he put his motorcycle on a tender because it had some parasitic drain that would flatten the battery in 3 days of sitting, for example. This product seems to be a bit of an in-between, not having the ability to trickle charge the battery, but you can keep any eye on it and charge or jump it as needed.
    • Syonyk 3y ago
      Yeah, I got tired of replacing batteries and now keep just about everything infrequently used on a battery tender. Lead acid as used in cars doesn't like being deeply discharged, so a couple good deep charges will trash them. A battery tender and extension cord is an awful lot cheaper than batteries, and a $30 unit will save you a lot more in battery replacement for infrequently used vehicles. Also, they make the tractor a lot happier to start in the winter. :)
    • SV_BubbleTime 3y ago
      I was in a warehouse of supercars recently. Stuff you had no idea existed. 10 offs, things like that. Every vehicle was on a trickle charger, for a few reasons. But one reason I especially liked… The La Ferrari CAN NOT run the batteries dead. If it does, and it’s locked, you are in trouble. Like call a Ferrari rep to come fly out and partially take it apart to get it charged and running again trouble. Same with some Bugati I had never heard of. Everything down to McCarens and lower. These aren’t vehicles that will run after sitting for a month let alone a few. Some might top at a week.
• tacker2000 3y ago
  At this point its fair to assume that all these devices are collecting large amounts of data and phoning home. I wouldnt be surprised if TP Link routers also send everything back to China. But this is not limited to China anyway, the iPhone im using here is probably sending every keystroke and location data back to the US.
  • r3trohack3r 3y ago
    > it’s fair to assume I’m not sure I like this pattern of thinking. For example, a TP Link router would send data back using packets over the public internet (unless there is some true spy craft at work). That’s verifiable. If you suspect your TP Link router is sending everything to some remote server… monitor the traffic?
    • allarm 3y ago
      > monitor the traffic? Like, how exactly? With a separate firewall between WAN and the TP Link? It makes little sense because TP Link makes cheap home routers and adding a firewall to the design would make the whole setup expensive.
      • r3trohack3r 3y ago
        Using a lab setup, not all the time. If you’re worried about these things you can reuse your lab setup to test multiple devices for “phoning home” packets. Setup a lab using an old PC with two Ethernet cards, a WiFi card, etc. and observe the traffic flowing through it from the device you connect. If it’s phoning home you’ll see those messages. If you think it’s event based, or targeted surveillance, you’ll need to get more creative. But in OPs post it sounded closer to “logging everything and sending it all back” - if you’re already technically inclined that’s detectable with less effort than a lifetime of worrying about such things.
• kccqzy 3y ago
  Operating systems need to make Internet access a permission that users can grant or revoke. (Pretty sure that used to be a thing in Android, but never in iOS except mobile data.) If I get a device that claims to use Bluetooth, I would return it if it actually needs access to the internet.
  • notjulianjaynes 3y ago
    I have used NetGuard on Android to block internet access to certain apps. https://netguard.me/ https://netguard.me/
    • VcZar 3y ago
      Thanks for this. How do I trust their VPN is not just harvesting my data?
      • notjulianjaynes 3y ago
        It's not a VPN service like the type you'd use for privacy. The VPN part all happens on your device so there's no data being sent to a third party for them to harvest to begin with. Not sure if that is what you meant. If your concern is more generally about the app being malicious, I suppose you could audit the source code. But this is not something I have done or even am qualified to do, so I don't know.
        • VcZar 3y ago
          Thanks.
    • autoexec 3y ago
      Does it stop data from leaving your device or just collect it all as a proxy and refuse to forward some of it. I'd much prefer to not have to hand all my traffic over to anyone offering a free app and just trust them not to use/abuse it.
      • 3y ago
• 1970-01-01 3y ago
  Realize the thing that watches the thing is also slowly consuming it, to the point of it being necessary to actively monitor the monitor. (The BLE gizmo will slowly but surely drain your car battery. You must take action to recharge the battery when it eventually sends you an alert, because it will soon stop sending them to you.) It also siphons data on your phone and sends it to China. Oh, and I bet that drains your phone battery. I can't think of a better anti-gift for the holidays. This gizmo is a rare triple consumer threat.
  • morcheeba 3y ago
    For a typical 70AHr car battery, the 1 mA from this monitor will take 8 years to drain the battery. When you get a "25% remaining" alert, you only have 2 years to recharge it! No, seriously, the self-discharge is about an order of magnitude greater than this monitor.
    • dotancohen 3y ago
      That might have been true decades ago, but modern ICE car batteries are designed for providing high cranking amps, not longevity under constant trickle. And even occasionally getting under 12 volts (12.6 is full) will damage them. That is the trade off of making the battery lighter and smaller. You'll notice that alternators and vehicle electrical systems have changed, too. This is a big problem with aftermarket dashcams that continue to monitor the surroundings when the vehicle is parked.
      • vardump 3y ago
        Are you talking about the new Li-ion ICE car batteries or older lead-acid ones?
        • aembleton 3y ago
          I think he's talking about the AGM lead acid ones.
        • dotancohen 3y ago
• TheBozzCL 3y ago
  Awesome write-up! When my friends laugh at my obsession over privacy and data collection, this is the kind of thing I point at. There's no reason to believe they're doing this for malicious reasons, but we really have no way to know. It's probably just ignorance/incompetence.
  • x1sec 3y ago
    Thanks! Part of my motivation to documenting this is to raise awareness and also provide encouragement for others to start looking at what their devices/apps in their home are doing. The amount of location data the device maker is collecting is significant - perhaps they are monetizing it? If so, would you consider this malicious (if not disclosed to the end user this was happening)? The AMap SDK the app uses collects much more location data - here I feel they are likely using it to improve the accuracy of their location service/mapping software. I don't consider this malicious, unless this behavior is not disclosed to users and developers. Their site is in Chinese [1], would anyone read through their fine print to verify? [1] https://lbs.amap.com/api/lightweight-android-sdk/download https://lbs.amap.com/api/lightweight-android-sdk/download
    • TheBozzCL 3y ago
      That's my thought exactly: there's no logical reason for this to need to send your location, so it's probably monetized by AMap to improve location accuracy. The fact that it's not disclosed is worrisome but sounds more like incompetence or ignorance to me. I haven't taken the time to fully dig into your posts, did you notice if they're generating a user ID? For me, that would be the difference between using it for location accuracy or tracking user locations. That being said, the data they already have is probably more than enough to track individuals. Reminds me of this one post that I just can't find anymore: a (danish? finnish?) journal bought a pack of "anonymized" location data and chose one individual. They were able to track where they lived and worked, and where they went for vacation. They even went to their place and talked to them, and they had no idea this was happening whatsoever. I really wish I could remember where I read it.
      • 3y ago
• disposition2 3y ago
  Really appreciate the write up. Just wanted to share, while unimportant…I still thought I would share, some grammatical errors near the top of the page > reveals that that the Apple iPhone version is also location data to remote servers. I’m guessing there should only be 1 “that” and there’s a missing “sending” between “also” and “location data”
  • x1sec 3y ago
    Thank you for the keen eye, fixed.
• api 3y ago
  If it’s connected assume it is spying on you as much as it possibly can.
• neilv 3y ago
  > acquired from a popular electronics retailer in Australia. Use the courts and public sentiment.
  • x1sec 3y ago
    The OIAC (Privacy regulator in Australia) notes [1]: > If you’re concerned your personal information has been mishandled, you first need to complain to the organisation or agency you think has mishandled it. If they don’t respond to your complaint within 30 days or you’re not happy with their response, you can lodge a complaint with us. I have complained to the retail store that I purchased it from. It's been over 30 days, next is the OIAC. The device is rebranded and sold under many different names (globally) so the real impactful course of action is to have Google and Apple take the applications off the app store. [1] https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-p...
    • x1sec 3y ago
      Update here is that the developers of this app have now updated the Apple and Google store pages disclosing that they do collect location data. So now it's up to the retailers/resellers to comply with local privacy laws and regulations.
• cryptoegorophy 3y ago
  I know it has been talked about this many times, but any tips for readers on how to safe guard from such issues? What comes to mind: - don't install apps unless absolutely necessary. - don't let apps have extra permissions when possible. - if app is free - most likely you paid for it somehow (your data) Anything else? I also use 1blocker on iOS to block trackers etc, although, I am not sure if 1Blocker is not spying on my browsing.
  • x1sec 3y ago
    > don't install apps unless absolutely necessary Very sound advice. What if you have purchased some Bluetooth enabled device that requires an app? Don't purchase Bluetooth/connected hardware? Perhaps! My next blog post will be on a bike Speedometer that uses GPS to calculate the bike speed. It has an Android app, and yes it sends your data to remote servers hosted within Hong Kong.
• yazzku 3y ago
  Noob question, but was the application streaming over plain http, or did you do something to decrypt https traffic? How would you do the latter? Edit: with mitmproxy and installing a cert in the phone's store, as explained in the latter half of the write-up. I guess that wouldn't work if the application pinned the server certs, but I guess this "commercial malware" is not that sophisticated.
  • x1sec 3y ago
    In the second part of the blog post series, I show that they AMap SDK they use encrypts data data first using AES and then further encrypting the AES key(s) with a public RSA key embedded in the application. Not trivial. If certificate pinning was used, it can be bypassed by modifying the APK or dynamically hooking into the running application using Frida. Often you have to try a few things before getting it working, often starting with a universal TLS bypass Frida script [1][2] [1] https://codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass-with-frida/ https://codeshare.frida.re/@pcipolloni/universal-android-ssl... [2] https://codeshare.frida.re/@akabe1/frida-multiple-unpinning/ https://codeshare.frida.re/@akabe1/frida-multiple-unpinning/
• segmondy 3y ago
  For once, I really hope the US govt would do something about these sort of devices. I bought a digital picture frame from amazon. It's listed as having an SD card. When I tried to set it up. It wanted me to install an android app, and that was the only way to save pictures to the SD card. To connect the device to Wifi, then use my phone to send picture to the device. So nothing only would I have an unknown device in my network, collecting and reporting who knows what, it would be on my cell phone as well. I returned it. Imagine if there was 100k or 500k of these trojan horse devices in the US. It's truly scary what it means for US's national security.
  • chaostheory 3y ago
    > It's truly scary what it means for US's national security. “national security” is the magic phrase to get the US government to do anything
  • Libcat99 3y ago
    Nothing to imagine, I am certain that there are 100s of thousands of such devices, and even if their design intent is not malicious they are typically security nightmares.
    • worthless-trash 3y ago
      Its very odd you are being downvoted. You're not incorrect.
    • TheKarateKid 3y ago
      It doesn't matter if the intent doesn't seem malicious. And if they had nothing to hide, why weren't they upfront about the data collection? Remember when we thought having all those Facebook "Like" buttons on every website was harmless until we learned the level of which everybody was being tracked without consent? This is China's typical playbook. Purposely collect data in seemingly harmless ways, or intentionally leave wide open security flaws that they can exploit in the future. And when they get caught it's an "oops sorry, we'll fix it right away". The worst part is that there is no consequence for this behavior. Google, the EU, and/or FTC should be lodging fines.
• gxs 3y ago
  How is it that giving an app the ability to scan for nearby wifi networks is not a permission in and of itself? The very first time it happened to me, it was confusing - hm, why does this random app, having nothing to do with connectivity, require bluetooth access? Permissions should be more granular - and more importantly, Apple should make it so not giving an application a non-essential permissions is not grounds for not letting the user use the app. That was a mouthful, hope it made sense.
  • x1sec 3y ago
    I agree and Apple's approach does this. You can deny the location permissions and still use the Bluetooth services. This is not the case with Android.
    • x1sec 3y ago
      Here I am specifically referring to the behavior of the app in question. As pointed out elsewhere, Android 12+ offers flexibility here. That said, it could be argued that there is too much trust for developers doing the right thing when Bluetooth and other location permissions can be mixed under ACCESS_FINE_LOCATION as we witness here. https://developer.android.com/guide/topics/connectivity/bluetooth/permissions#assert-never-for-location https://developer.android.com/guide/topics/connectivity/blue...
• throitallaway 3y ago
  It's annoying that this has become the norm with basically zero consequences for bad actors. Seeing this article made me thankful for GrapheneOS. I've been dailying it for a few months now. Every single app is explicitly granted network permission (or not) upon installation. Local apps like this definitely don't get network perms, and neither does my keyboard app (that always creeped me out.)
  • hirundo 3y ago
    I'm considering switching to GrapheneOS but the fact that it only runs on Google phones makes me hesitant. Yet the other Android replacements look a lot less compatible. Am I being paranoid?
    • nuker 3y ago
      Why not Apple?
      • CaptainNegative 3y ago
        Not the person you replied to, but from a privacy perspective Apple won't allow Westerners to disable all network access per-app. Something that's been around in Chinese iOS releases for nearly a decade. I'd love to use many offline note taking apps, but not if they're liable to randomly upload my notes to a potentially adversarial third party. And the actively privacy-hostile behavior of maintaining a separate branch just to disallow access to this feature is not appreciated.
        • nuker 3y ago
          If you don’t trust app’s developer just don’t use it, why fiddling with network access? Have you tried iOS Notes?
          • CaptainNegative 3y ago
            I'm not using it. Same goes for the rest of the junk operating system it's built for.
• jbombadil 3y ago
  Phones already have app permissions: can access you contact, can access your location... But no major phone OS provides a reliable "can access the internet" permission (without jailbreak/root). This would solve this issue much above the stack. I can install the dubious app. If the app can't access the internet at all (properly enforced by the OS) then by definition it can't leak anything. I find it particularly disappointing from Apple. If they were truly committed to privacy as they claim, this would be a feature already.
  • throitallaway 3y ago
    GrapheneOS has this function, and it's great. My phone is not rooted.
  • hnburnsy 3y ago
    Yeah my old One Plus phone I could block mobile and wifi data from any app of the phone. I don't know if Google is to blame here for this going away.
    • deleted 3y ago
      [deleted]
  • bluetidepro 3y ago
    This would be the best feature ever.
  • deleted 3y ago
    [deleted]
  • CharlesW 3y ago
    A temporary workaround is to turn off Wi-Fi and the Cellular Data permission for the app. Once you know what it’s trying to reach, you can block it with an iOS firewall or something like NextDNS.
  • gotmedium 3y ago
    On iOS you can disable cellular data and it won't allow the app to connect to the Internet, and you can work on Wifi Assist to remove cellular data even on wifi https://support.apple.com/guide/iphone/view-or-change-cellular-data-settings-iph3dd5f213/ios#:~:text=Go%20to%20Settings%20%3E%20Cellular%2C%20then%20turn%20Cellular%20Data%20on%20or,Assist%20is%20on%20by%20default https://support.apple.com/guide/iphone/view-or-change-cellul....
• hnburnsy 3y ago
  Why the f@#k on Android can't the user stop Apps from 1. Running at start up 2. Running in the background. At a minimum why aren't these user granted permissions? This would stop a great deal of the apps that hover up data like this. Google is complicit here. Change my mind.
  • HeckFeck 3y ago
    Yeah, mobile really sucks for this compared to the 90s and 00s desktop experience. It really feels like a step backwards; at least you could delete things from the StartUp folder on Windows 98.
    • MBCook 3y ago
      You can delete things real easy on iPhones.
      • yakubin 3y ago
        Except Keychain credentials. I still don’t know how to make my iPhone forget how to log into Discord after deleting the app. (It logs back in after reinstallation.)
        • Daneel_ 3y ago
          This is readily exposed to the user, and has been for a long time. Settings --> Passwords, then just delete the entry for Discord. Or have I misinterpreted your issue?
          • sumuyuda 3y ago
            This is because each app has their own private keychain (separate from the saved passwords) which is not cleared when the app is deleted. Apple tried to change the behavior and have it wiped on delete, but many developers complained. This allows apps to track you across installs of the app.
• londons_explore 3y ago
  I suspect that all the location data stuff is to prevent someone pirating the app and building/selling their own hardware. Sure, the Chinese manufacturer is a factory making gadgets on the other side of the world - they have no real avenue to monetize your location data. They likely don't even know your name. Hence, my suspicion is this is all a complex way to stop someone else making a 'compatible' device and selling it without developing their own app. Thats why the app checks the mac address is valid, and uploads location data so the manufacturer can see if one device is in two locations at once, confirming piracy must have occurred.
  • drewda 3y ago
    For better or worse, there are lots of channels for "no name" apps and gadgets to make money selling location data. See, for example: https://themarkup.org/privacy/2021/09/30/theres-a-multibillion-dollar-market-for-your-phones-location-data https://themarkup.org/privacy/2021/09/30/theres-a-multibilli...
• bri3d 3y ago
  Pretty much everything that uses AMap does this - any popular Chinese-developed application with mapping functionality will exhibit the same behavior. I have trouble seeing this as being quite as sinister in motivation as it first appears; while this data is certainly invasive and valuable, it's the same data that Google and Apple collect to build their mapping services, as well. It's a tough problem. I think the Big Issue exposed by this car battery monitor is the lack of granularity in mobile OS permissions. By granting the Android app BLE access, you also give it "fine location" access which lets AMap slurp your data. I think this write-up is pretty good but I wish OP hadn't buried the lede as much in the first paragraphs. Why not mention it's AMap in the tl;dr summary?
  • haxrob 3y ago
    Hey OP here - I mostly agree with your points in respect to AMap. It's a legitimate mapping service and location SDK. > Why not mention it's AMap in the tl;dr summary? The GPS data is being sent to two different companies - the battery monitor developer and AMap. I could make this clearer in the tl;dr. The cell phone tower data (MNC,MCC,LAC,Cell ID) and Wifi BSSID collection is AMap only. That said, none of the AMap behavior is disclosed by the application developer. Literally apps that use the AMap SDK in this way turns the user's handset into a continuous scanner. This impacts user experience - just check all the complaints on the 1.75k reviews on the Play store [1]. I doubt many devs are aware of this - It took me countless hours to figure the AMap side of things due to obfuscation techniques in the AMAp code. (See part 2 on the blog post series). The primary issue is that all this data is collected, sent to multiple 3rd parties (AMap being one of them) and none of this was disclosed to consumers when they download the applications. [1] https://play.google.com/store/apps/details?id=com.dc.battery.monitor2 https://play.google.com/store/apps/details?id=com.dc.battery...
• XorNot 3y ago
  Huh, I think I bought one of these. Or a knock off of one of these. Either way, it's not in my car because it never actually read battery voltages (well it did, but evidently would crash after sending them or something).
• causality0 3y ago
  Why would somebody use this instead of a five dollar Bluetooth OBD dongle?
  • Daneel_ 3y ago
    Because it's not always used for monitoring the main battery in a car. If you have a caravan, camper trailer, boat, etc with a battery in them then you often want to know what the charge is, but they don't have OBD2. Why would a caravan, etc have a battery you ask? Inverters, lighting, fridges, USB chargers.. Lots of reasons.
• qwertox 3y ago
  Absolutely unacceptable. This should be considered a crime.
• sleepybrett 3y ago
  While I'm happy that apple and others have added these access grants (for location, disk access, etc) to their systems, I'm less happy that the way to do whatever the fuck you want is to ask the user to give you whatever grant under some thin pretext and then exploiting the fuck out of your generosity. 'We need you to grant us access to location services so we can adjust for your timezone... PSYCH! We're actually tracking your every goddamned move and selling all that data to all comers including law enforcement in your area!' If you say no to these grants often the app will go into whiner mode, where it constantly asks and fails to perform even the most basic function.
  • shepherdjerred 3y ago
    What apps have done this to you? I've been pretty happy with Apple's ability to: * Restrict permissions * Prompt me with the ability to allow an app a permission forever, or just one time * Have the OS prompt me later on about how often an app has been using my location, and ask if I want to modify my approval I don't think I've run into many apps that have refused to work without something like locations services. If an app does do that, I simply uninstall it.
    • Arainach 3y ago
      Thinkware Cloud: https://play.google.com/store/apps/details?id=com.thinkwaresys.thinkwarecloud&hl=en_US&gl=US https://play.google.com/store/apps/details?id=com.thinkwares... Their dashcams are optically fairly nice for the price, but their app is a monstrosity. It demands: 1) The ability to run unrestricted in the background, ignoring battery restrictions and autosuspend 2) Location access. Not "allow this time", it detects that, it wants perpetuity 3) Access to all phone storage. Not "allow this time", it detects that, it wants perpetuity. If you refuse to grant any of these it will simply show you "the following permissions are required" and refuse to proceed. Do you simply want to have a live view from your dash cam to check the angle of its placement? Too bad. If you grant these permissions and later go back to settings and remove them, then the next time you start the app it happens all over again. It is an absolute abomination and I will never buy their products again.
• VcZar 3y ago
  Appreciate the deep dive x1sec. The worst issue here is that Google and Apple do not seem to care that apps can claim "no data collected". Should Google and Apple take some sort of care to make sure the claim have some validity if they require that info to be disclosed? Or it is just marketing to make us feel safe?
• 31337Logic 3y ago
  Excellent work. And this is why we should never stop fighting for digital privacy and the laws that protect it. It's not a matter of "we have nothing to hide", it's a matter of not letting 3rd parties spy on you and sell your personal data without your overt knowledge and consent. Makes no mistake, we're in the middle of an all-out data war now. Fight hard.
• thwoi432u2o4234 3y ago
  [flagged]
• Inhibit 3y ago
  I... just assume any bluetooth device that requires a vendor supplied locked-in application is exfiltrating every piece of data it can get it's grubby mits on. As the business model. Unless it provably states otherwise. Is that a minority opinion?
  • dotancohen 3y ago
    If so, then I'm in the minority with you.
• WalterBright 3y ago
  I've wanted many times a voltmeter dash gauge, something that used to be standard. A voltmeter will tell you if your charging system is working properly, and if your battery is dying. Having an app do that for you is like firing an 88mm flak gun at a cockroach. I don't know why Apple cannot vet these apps for transmitting data irrelevant to its stated purpose before they approve it for the walled garden.
  • fingerlocks 3y ago
    You can DIY this in an afternoon. Get a red LED from any auto parts store. Connect it to the alternator and the positive battery terminal. It will illuminate when there is a voltage differential. Brighter is worse. Optionally add switch if you want to prevent full illumination when vehicle is off. Or add a relay spliced into the radio / ignition / accessories circuit.
    • WalterBright 3y ago
      I never thought of that, it's a good idea. I do prefer gauges, though! I've installed them before.
  • vaporary 3y ago
    One option is to use a voltmeter that plugs into the cigarette lighter outlet. There are a bunch of cheap options on Amazon.
• contingencies 3y ago
  AMap is the equivalent of Google Maps in China, so when Google started collecting wifi SSIDs and cell IDs on android and using them for faster-than-GPS or GPS-denied location determination, it was only a matter of time until AMap added it. The article seems to be suggesting the device itself is gathering data and reporting back covertly ... but I believe it's just the AMap library included by the app developer doing its thing. In all likelihood, the data comes from phone sensors and is gathered by the app library, not from the device. And indeed, the Chinese language app logs on the Part 3 page only seem to refer to bluetooth and power related functions. This supports a hypothesis of the app and device developers not knowing this collection is going on - ie. standard-library-using-developer not international-covert-surveillance-product-conspiracy. I think that is far more likely.
  • x1sec 3y ago
    > The article seems to be suggesting the device itself is gathering data and reporting back covertly ... but I believe it's just the AMap library included by the app developer doing its thing. If this is the take away, then I need to think about how I have phrased things. The GPS co-ordinates are sent two separate companies: 1) The Bluetooth device developer (bm2.quicklynks.com) 2) AMap (dualstack-cgicol.amap.com) Looking at the decomplication and HTTP REST messages, it is very clear the app developer is deliberately sending GPS to their servers. They send a JSON object with the battery voltages, bluetooth device address and lat/lng in the same request. The cell data, wifi beacon data - this is exclusively collected by AMap services and is not apparent without investing significant time reverse engineering their SDK.
    • contingencies 3y ago
      Oh right, fair enough. So the actual breach of trust is the non-premium (non-tracking) app version sends GPS to the app developer, when they'd claimed otherwise and only the premium version is supposed to do so. This doesn't really justify delving in to device firmware, but more power to you.
      • x1sec 3y ago
• PinguTS 3y ago
  Not directly related to this. I own a CTEK one car battery charger. CTEK is not some Chinese company but a very reputable Swedish company. Their car battery chargers are very reputable. But the CTEK one has an accompanying App. Both are connected via Bluetooth like in this reversed battery monitor. You can add the battery charger to the app only, when you have a CTEK cloud account. Just this weekend, their cloud servers had problems. So you I was unable to connect to the local device in front of me. What I'd like to say: CTEK requires a working cloud account to access their latest device via Bluetooth from within their app.
• loxdalen 3y ago
  Just want to add to the need of access_fine_location to scan nearby devices. In fact scanning nearby access points or Bluetooth devices is much faster and more precise than GPS. If this sort of scanning could be done without requesting the access_fine_location permissions, it would be very misleading to the user. So I definitely understand Androids reasoning of requiring that permission.
  • alias_neo 3y ago
    Passive bluetooth devices can be used for very accurate indoor positioning. In fact, I'm looking to set up a bluetooth LE beacon based positioning system at home to detect when I move between rooms and switch things like fans/lights/music. Over a decade ago when I was in university there was practical experimentation going on into this form of indoor positioning (it was a project option in undergrad EEE), these days it's a done deal.
• dandongus 3y ago
  It seems that software on your cell phone is collecting and sending this data, not the battery monitor device. Am I misunderstanding the title?
• tiku 3y ago
  Why is this a surprise? There is a trip function in the app. They see it as a service to sync it with a cloud solution perhaps.
• ocfnash 3y ago
  Presumably one could now punish this behaviour by spamming the API with a firehose of fake data?
• tinus_hn 3y ago
  I wonder if and if so, how, they get around the notification iOS sends after an application tracks location in the background (‘Background Location Tracking Transparency’).
• Ajedi32 3y ago
  > For the application to work, you must give the Android application permissions that let it obtain location information otherwise it won’t work: For Bluetooth scanning, Android requires this permission This is not entirely true anymore as of Android 12 (API level 32). See https://developers.google.com/nearby/connections/android/get-started https://developers.google.com/nearby/connections/android/get..., which suggests declaring maxSdkVersion="31" for the ACCESS_FINE_LOCATION permission, since it isn't required for Nearby Connections in Android versions newer than that. The hard part about locking down permissions after the fact like this is that it requires app developers to play ball. Forcibly blocking location access to apps that currently rely on those APIs to scan for Bluetooth connections would break a lot of apps, and not forcibly blocking it makes it easy for app developers to just continue requesting those permissions even though they no longer need them. Furthermore, users are already conditioned to expect location access permissions for apps that need Bluetooth so it doesn't even look suspicious, and there's a lot of outdated documentation out there telling developers to request that permission in that situation even though they no longer need it.
• JohnBooty 3y ago
  Google and Apple app store pages say no personal data is collected or sent to 3rd parties. "It turns out it's sending GPS, cell phone tower cell IDs and Wifi beacon data to servers in Hong Kong and mainland China on a continued basis" It seems to me that app store providers should drop the "no personal data collected or sent to 3rd parties" language entirely. Instead, the warning should be: "this app has permissions to do network stuff and can potentially send whatever the f-- it wants to whomever it wants" or "the app maker claims it won't give data to 3rd parties but we have absolutely zero way of verifying this." Because the reality is that neither Apple nor Google can have any idea what a "3rd party" is. Those servers in China and HK may well be 1st party. Who knows? Who can know? Nobody but the app maker.
  • toss1 3y ago
    Exactly! More importantly, simply expect that if you are touching any digital/electronic technology that touches China, you should expect that they are extracting and collecting every bit of available personal, location, and other data, and that it is available to the CCP. And, while the CCP likely does not GAF about your particular data, they do care a LOT about the aggregate data. They also will find it very handy when in intersects for particular targets, such as any of the millions of US govt employees whose data they harvested over years [0][1]. The Great Experiment, in which it was thought that open commerce and exchange would lead to democracy and freedom for China's millions, has failed, resoundingly. All it did was further empower a ruthless dictatorship bent on global expansionism. Do not do business with China. [0] https://en.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.wikipedia.org/wiki/Office_of_Personnel_Management... [1] https://www.nbcnews.com/tech/security/china-spent-years-collecting-americans-personal-information-u-s-just-n1134411 https://www.nbcnews.com/tech/security/china-spent-years-coll...
    • JohnBooty 3y ago
      Amen. The insights that can be gleaned from even innocuous-seeming data at scale are impressive and terrifying.
• demarq 3y ago
  Is it me or has this got nothing to do with the battery monitor. Sounds like run of the mill malware in the app, could even be the authors of the app are unaware, ie it’s embedded in a library they are using?