AppCensus

The official account of privacy news, commentary, and product announcements.

Privacy Analysis as a Service. At Scale.

[AppCensus @AppCensusInc]

Want to find privacy issues in your mobile apps before others do? Talk to us.

[AppCensus @AppCensusInc]

Thanks to @dhsscitech for the shout out and all the support! They’ve been a great partner!

[DHS Science and Technology Directorate @dhsscitech]

Curious about what’s possible when partnering with S&T? Check out the final Tech Impact video to learn about @AppCensusInc’s success + how to work with us through the Silicon Valley Innovation Program. ⬇️

https://t.co/XKo1fOmoAQ

[Narseo Vallina @narseo]

This press article is based on the findings of our last USENIX'23 paper:
https://t.co/IQZGn6AbR7

Co-authored by A. Lyons, J. Gamba, A. Shawaga, J. Reardon, @0xjet, @v0max and myself, from @UCalgary @IMDEA_Networks @uc3m @ICSIatBerkeley and @AppCensusInc

[AppCensus @AppCensusInc]

Excited to see the work we did for @IDACwatchdog having more impact!

[Tonya Riley @TonyaJoRiley]

ICYMI: An FTC complaint confirmed findings I first reported in 2020 that the fertility app Premom was sharing user data with Chinese advertisers without user permission.
The company has settled for $200,000 w/ the FTC and state AGs.
https://t.co/SyANomjGnq

[AppCensus @AppCensusInc]

We're excited to be working on this!

[Allan is @allanfriedman on bsky & infosec.exchange @allanfriedman]

Excited for the announcement of @dhsscitech SVIP awardees for SW Supply Chain Tools and #SBOM. We're looking forward to working with these great teams.
@AppCensusInc @chainguard_dev @deepbits_tech @manifestcyber @ScribeSecurity @testifysec & Veramine
https://t.co/pudcKKqTZ0

[AppCensus @AppCensusInc]

(We exist, but are currently focused on serving our existing paying customers, so can’t keep our free services updated in the short term. Rather than having people use data that is now several years old, we removed the free dataset from the website.)

[AppCensus @AppCensusInc]

The reports of our death have been greatly exaggerated.

[Bjarke Lindsø Andersen @bjarkeLA]

@AppCensusInc and Lumen Privacy Monitor by @narseo exist no more. What other/new tools are there for investigating private data sharing in apps? Using it for teacher education #twitterhjerne

[AppCensus @AppCensusInc]

@bjarkeLA @narseo Yes, we made it very clear why on the website: https://t.co/52D3ybXClB

We repurposed that infrastructure to better serve our customers. Long term, we would like to rebuild it and continue offering it as a free service. But unfortunately we’re way too busy in the short term.

[Narseo Vallina @narseo]

The awarded paper was presented at @USENIXSecurity'19 and it is available at:

https://t.co/FSkBZwaK9v

This paper is a collaboration of @IMDEA_Networks researchers with Joel Reardon, @v0max @primalw and @AmitElazari from @ucalgary, @ICSIatBerkeley and @AppCensusInc

[AppCensus @AppCensusInc]

@edyshor No idea, that’s a question for Google!

[AppCensus @AppCensusInc]

New blog post: https://t.co/1Q86nHT2ro

We discovered a spyware SDK that collects various identifiers, the contents of the clipboard, scans home networks to identify devices, as well as hashes of files on the user’s phone.

[AppCensus @AppCensusInc]

@TommyBurazin They definitely were removed a week or so ago. We assume that after they were booted, they were allowed to submit updates that removed the SDK. There was evidence the app devs didn’t know what the SDK did, so forcing them to fix it vs. permanently banning them seems appropriate.

[AppCensus @AppCensusInc]

Oh hey, the WSJ has picked up our story!

https://t.co/UdQqYOzQ6a

[AppCensus @AppCensusInc]

New blog post: https://t.co/1Q86nHT2ro

We discovered a spyware SDK that collects various identifiers, the contents of the clipboard, scans home networks to identify devices, as well as hashes of files on the user’s phone.

[AppCensus @AppCensusInc]

We reported it to Google back in October, and as of now, all apps we identified as containing it have been removed from the Play Store.

[AppCensus @AppCensusInc]

It’s being distributed by a Panamanian shell company, Measurement Systems, which appears to be affiliated with a US defense contractor, Vostrom Holdings.

Developers are being lied to about what it does, which may induce them to violate various privacy laws.

[AppCensus @AppCensusInc]

@sramakk @kpoulsen

[AppCensus @AppCensusInc]

New blog post on a previously-undisclosed side channel in the Olympics app (My 2022): https://t.co/7f1uzEM0Ho

[AppCensus @AppCensusInc]

Check out our new blog post, the first in a new series of privacy tips for app developers:

https://t.co/zofNkCr7ep

[Narseo Vallina @narseo]

@AEPD_es @AlvaroFeal @primalw @AmitElazari @v0max Today, we received the AEPD Emilio Aced Award in privacy research. It is very satisfying and a great honour seeing how our research contributions to improve online privacy are recognized by public data protection agencies.

[AppCensus @AppCensusInc]

Another research award recognizing our co-founders for their contributions to online privacy!

The award is for this paper: https://t.co/SWY98azLZj

We're also happy to report that Google has fixed many of these privacy vulnerabilities.

[AppCensus @AppCensusInc]

In the same vulnerability report, we noted that the Huq SDK contained code to do the same thing. They’ve also been in the news recently…

https://t.co/5x6cShuici

[AppCensus @AppCensusInc]

Glad to see the FTC taking action on this!

We reported the underlying vulnerability to Google in 2018, which allowed Android apps to access location data (BSSIDs) without permission by accessing the ARP cache.

[FTC @FTC]

Advertising platform OpenX will pay $2 Million for collecting personal information from children in violation of children’s privacy law: https://t.co/JFQIystNgK