Database Users

Protecting Privacy - Compiling TaintDroid into Kernel to find leaky apps

Most people don't yet know that many Android software leak all sorts of information to the internet with only scant user acknowledgement (basically what you accept when you install the app).
Due to this and the fact that there are already privacy information harvesting apps for Android on the marketplace - a team of security experts have created TaintDroid:
What is TaintDroid?
From the project's web page: "A realtime monitoring service called TaintDroid that precisely analyses how private information is obtained and released by applications "downloaded" to consumer phones."
From: http://appanalysis.org/index.html
How can I install TaintDroid?
As TaintDroid is currently compiled into the kernel, you cannot easily install it, but you have to cook your own kernel. Instructions (for Nexus 1) are available at the project web site: http://appanalysis.org/download.html
How does TaintDroid work?
Here's a video demonstrating how TaintDroid works once it is installed and configured:
http://appanalysis.org/demo/index.html
Why would you want to install this?
There can be many reasons for installint TaintDroid:
- You want to learn about privacy features and play with Android kernel
- As it is currently impossible to differentiate between innocent and sneaky Android apps based only on what access rights they request, you may want to dig in deeper
- You are worried about what apps are doing behind your back and you want to know which apps to uninstall
- You want to help create Android a more secure and privacy-protected platform, instead of the swiss cheese it currently is
What can you do?
As compiling kernels is mostly beyond the reach of mere mortals currently, consider cooking TaintDroid into your kernel, if you are cooking one yourself and offering it available for others to try and use.
Hopefully increased awareness and usage will bring this program eventually into other modders and perhaps even Google's attention and something more easily accessible is offered for the public at large.
BTW, I'm just a user, interested in getting TaintDroid on my own Galaxy S. I'm not affiliated with the research program, but I like what they are doing. This information is purely FYI.

+1 for the idea
Sent from my GT-I9000 using XDA App

+1
Since we cannot expect information gatherer Google to come up with a good privacy protection mechanism soon I think we are forced to take measures ourselves.
I also learned that several of my bought applications are constantly forcing me to enable synchronisation and/or 3G internet. They either randomly uninstall (Asphalt 5), their icons disappear (for example: Mini-squadron) or won't start, with (Schredder Chess) or without a message. Angry Birds Beta2 lite (free game) and Hungry Shark are 2 more examples. So much for an incentive to buy games...
It would be great if applications used a well-defined mechanism to check their validity on-line, and not have this sneaky, lingering attack from all sides to any privacy or battery consumption aware user.

I can not cook Kernels, but this is something i want to use.
Not that i am worried, but i dont know what apps are sending when you open them. Thats something i want to know!
I am sure i am not the only one.

+1
Yes please... This should be in all android phones... as a security option you could turn on!!!

Antonyjeweet said:
Not that i am worried, but i dont know what apps are sending when you open them. Thats something i want to know!
Click to expand...
Click to collapse
And do some of these applications only send stuff when you open them?
--
From a user perspective it currently is really difficult to judge applications that need to start at boot-up and deal with many facets of your computer (Launchers, tools combining lots of divers features).

Do you know some ROM where Taindroid is included?

I've posted in hardcore and laststufo kernel threads to ask if they could add it.
We just need more people wanting it so they think about adding it

exadeci said:
I've posted in hardcore and laststufo kernel threads to ask if they could add it.
We just need more people wanting it so they think about adding it
Click to expand...
Click to collapse
glad you did that

+1 support the idea. hope some of our hardworking kernel builders will add this in.

My concern is how much another real time service will affect battery life. For people trying to make the leanest, fastest kernel I'm not sure it's viable.

I have been wanting TaintDroid built into android by default since the day it was announced, but I really do not think google cares about this, so please, please ROM cookers out there (Maybe Doc?), lets add this into our galaxy S roms.

Well, this seems to work only on android 2.1

Make it so.
+1
Combined with walldroid (or other firewall) this could put back power into users hands. Would really love to see this inside hardcores kernel. Maybe as an option for the stable releases?

+1
This should be the next standard in aAndroid

idea about spoofidroid application
how about a program to spoof or make the phone send fake:
GPS location,
IMEI,
phone number,
simcard id,
etc... information to applications that ask without permission.
this way you can feed these application with information they want but without breaking your privacy. (both end sides are more than happy)
-----
nice option to have:
1) enable/disable auto generate different id every time.
2) allow list / ban list of application to have real or fake id.
3) enable/disable notify for application request.
-----
there are all ready applications that fake your simcard PLMN mobile network codes without the need of kernel rights, but you need to enable disable the flight mode to restore the default code.
===========
good luck to spoofidroid or similar applications.

Jumba said:
My concern is how much another real time service will affect battery life. For people trying to make the leanest, fastest kernel I'm not sure it's viable.
Click to expand...
Click to collapse
I hope there will be developers out there who prioritize privacy/security over speed/battery and storage usage.

I'm the project lead of the TaintDroid system. We are currently working on a few extensions of TaintDroid but unfortunately are short on engineering resources to port TaintDroid onto other systems than Nexus One that we originally developed. We'd greatly appreciate it if XDA developers would take on this effort! Many ongoing projects would hugely benefit from having easy-to-run TaintDroid ROM available for many different devices and upcoming Android systems let alone user benifit.
Thanks,
Jaeyeon
Research Scientist @ Intel Labs Seattle

Ettepetje said:
I also learned that several of my bought applications are constantly forcing me to enable synchronisation and/or 3G internet. They either randomly uninstall (Asphalt 5), their icons disappear (for example: Mini-squadron) or won't start, with (Schredder Chess) or without a message. Angry Birds Beta2 lite (free game) and Hungry Shark are 2 more examples. So much for an incentive to buy games...
Click to expand...
Click to collapse
beta2 lite? i think that was malware, make sure it came from rovio otherwise it's fake and you should delete it.

It's really scary to see with the lookout app how many apps can access to your imei, telephone number "Read Identity Info", can access your contacts, track your position, and can send out all this data.
Here a HTC Desire user, asking for some privacy.
Best regards!

Need an app developer for a project $$$.

I have a proposition for any developer that's up to it. I need to build an app for Directv (also Dish in the future) technicians. It will include the following features:
-Contact list with important DTV contacts, with the option to add custom contacts for supervisors, etc.
-Browser add-on or mod of some kind that will allow the use of the camera as a barcode scanner to populate fields within the browser.
-Spreadsheet or something that can use camera with barcode scan to keep track of inventory, it will need an option to save a file every day and be able to email it to the desired recipient.
-Spreadsheet to keep track of jobs completed and amounts to be paid.
-Expense tracker that will be able to take pic of receipts, input and track mileage, and other expenses.
-Satellite finder, there is already an app out there called Dish Pointer Pro, it uses the camera to show you approx. position of satellites in the sky. If we can build something similar only geared only for Directv satellites, that would be great. If not maybe just a shortcut to that app.
-List or rather searchable database (maybe on a webserver if file size is an issue) of all Directv remote control codes for TV, DVD, etc.
-Flashlight
I will be selling this app in the market and will split profits 50-50 with the developer for as long as they continue to develop and support it.
I can do the graphics in photoshop (I am a amateur web designer but I am pretty good) and all of the marketing for this software via my Installation supply website at www.lcisupply.co and word of mouth to other installation companies here in AZ.
I will also be developing PC software and a Web Interface for supervisors to log into and check on inventory and expenses etc. to go along with it in the near future.
My goal is to develop an all-around software suite, that will make the technicians jobs easier and also help the installation companies keep track of inventory and pay for their techs. The android app is just the beginning of what I hope will become a widely used technician management system.
Please ask any questions you may have.
PM me for serious interest in becoming the developer.

Bump
Sent from my SCH-I500 using XDA App

WHY Upgrade GOOGLE ANALYTIC to UNIVERSAL ANALYTIC???

Google Analytics is introducing a number of new technologies, collectively called Universal Analytics, that will create a better way for businesses to measure their digital world.
The cornerstone change in Universal Analytics is that Google Analytics is becoming user or customer centric rather than visit centric.
The main difference with Universal Analytics is that it tracks much, much more than just visits to a website.
Offline Conversions
This is going to be a major factor in driving organisations to migrate to Universal Analytics, and a major benefit they’ll see as a result of doing so. It’s all thanks to the Measurement Protocol which is one of the core components of Universal Analytics.
Custom dimensions to create the reports you want
Another huge change is the ability to set multiple custom dimensions in reports. Think of a dimension as anything to which we assign a number, we can use certain behaviours to trigger dimensions around which we can structure reports.
Link your CRM data to logged-in users
Universal Analytics can be fed information from your backend customer tracking database to give additional context to your reports.
For example, by tying age demographics to user IDs, you can see how different age groups access different types of content, and which campaign sources are best at engaging with different groups of users.
Advanced segments can be created across sessions
Part and parcel of a move away from visit-based analytics is the ability to segment based on multiple visits.
So, if you want to create an advanced segment around people based in Sydney, that first arrived on your site on a Saturday between 2am and 4am, then returned via a remarketing campaign and spent $100 online, nothing's going to stop you now!
Configure session timeouts, with a maximum of four hours
The previous limit was a non-customisable 30 minutes.
This is useful for sites like office supply stores where users might keep the website open for long stretches of the day while they coordinate a company-side purchase, and few 30-minute visits were showing up with conversions.
Add custom search engines and have visitors show up as organic search
You might decide that YellowPages is more like a search engine than a referring site. Now you can bucket these visitors in your organic search segment.
Exclude certain organic search terms from your reports
You might want to take your brand or domain name and remove those from your organic search reports, since their use implies that users already know who you are.
Anyone searching on an excluded search term will show up as Direct Traffic, enabling you to drill deeper into customers that don’t already know your brand.

u can rent outsourcing company as Global Outsource Solutions:good:

[Q] Best networks for CPI/CPA without SDK integration?

Hello there!
Let's say I'm developing a web app targeting a specific group of people. I know their goals, their interests and their needs. I want to upsell them relevant services, products and apps, with entire experience natively integrated in my app interface.
So I need reliable mobile ad networks providing JavaScript or some kind of REST API, so I could just request product image, advertising text and referral link, and then mind my own business at displaying them inside the app correctly, without any need to install jar plugins and registering mediators. And then be payed by CPI/CPA.
Any idea what networks are the best in that regard?
(I'm using Intel XDK btw)

Vincent Pride said:
Hello there!
Let's say I'm developing a web app targeting a specific group of people. I know their goals, their interests and their needs. I want to upsell them relevant services, products and apps, with entire experience natively integrated in my app interface.
So I need reliable mobile ad networks providing JavaScript or some kind of REST API, so I could just request product image, advertising text and referral link, and then mind my own business at displaying them inside the app correctly, without any need to install jar plugins and registering mediators. And then be payed by CPI/CPA.
Any idea what networks are the best in that regard?
(I'm using Intel XDK btw)
Click to expand...
Click to collapse
can you just put google adsense ads? i've been wondering what is wrong with doing that?

Curious to see what the answer for this as well, have definitely seen this question pop up a few times.

Adxmi use API integration
global ads network Adxmi use API integration.

API integration available
I got API integration as I wanted from Adcash. Guess API is most common choice, at least in my comm. circle

Please take a look at Hyper native ads API for app developers.
Our solution will cover your needs for sure.

APK installs/Android traffic monetization solution

Hi there!
Let us introduce ourselves. We specialize in monetizing APK installs as well as any other Android traffic.
We are in the business for over 6 years already and this is what we can offer you right now:
-NET0 payouts
-Automatic ads integration/mass integration into any APK file
-0 detections
-APK tuning (changing package name, app name, icon e.t.c)
-Flexible ads behavior (settings delays, ads frequency, hide app icon, don't show ads for GP installs e.t.c.)
-For GP app updates our ads start after the update, without the need to launch the app itself, thus covering the whole userbase with the single update
-Sub IDs support,postbacks and direct download links for mediabuyers
-Advanced reporting system with GEO/CPM/APPS breakdown as well as average system CPM rates
-Flexible referral system starting from 7% and more
-Great support
-Up to 20 ads per day.
Please feel free to contact us at support[at]madmobile.biz

hey thanx for your knowledge

Hi, mad.mobile
I have developed SDK with proxy inside. I have TOS and SLA. It very big project with proxy buyers, app owners, dashboard, per-week payments and so on. I asking user to give to me access to his internet connection and working absolutely with white solutions. Does it interested for you to have additional profit with me by injecting my SDK to your APKs?
check out here: monkeysocks.net/sdk/ (please copy and paste because i have not 10 posts to post links)

MadMobile-APK installs/Android Download traffic monetization. Auto-SDK and Smartlinks
We are glad to introduce new type of ads, which is not connected in any way with our automatic SDK: Smartlinks.
This is a well-known format on the market and, if you used it, you should probably know how it works and we hope that you will like it.
What we can offer you in terms of smartlink ads is:
-No irritating endless redirects
-All OS are accepted: Android, iOS, Win, MacOS, Other mobile/desktop devices (Java, WM e.t.c.)
-NET0 by default. Bi-weekly/weekly payouts, depending on your volumes
-Average daily smartlink system rates per GEO
-Decent CPM rates
-100% fill rates for all GEOs
Please feel free to sign up and check it out yourself. We will help you squeeze out the maximum from your traffic.

Hello MadMobile! I would like to discuss a potential partnership. Please contact me on skype for the further details: juliacnv.

custom links and landings
Hello!
Due to multiple demands from our partners we released a separate section with landing pages. Now all you have to do is simply launch the traffic, landings will handle the rest! Currently we have 50 landings in public and over 50 landings in a row to be integrated, and we will do our best to have at least 3-5 of them integrated daily. Please note that all landings are multilingual.
Also, if you have a demand for some specific landings, or if you have any landings that you world like to be integrated with us, please feel free to contact us.
Please note, that our landings also have a {post} variable, which is extremely useful for any torrent/download/mp3 traffic, which might requite to pass a user a specific variable file name (e.g. if a user looks for "witcher-the-movie.torrent" file, he will be redirected to a torrent download landing page with "witcher-the-movie.torrent.apk" file name). Such variable will increase clicks-to-downloads conversion rate dramatically.
We are ready to offer our partners CPI payouts! (For verified partners only). You can get up to 10 cents for US install instantly! However, please keep in mind that revshare will eventually get you much more.
If you have any questions, please contact us [email protected]. We will be happy to assist you with the integration or answer any of your questions.
skype:mad.mobile1
[email protected]
tg://madmobile_support

retention
Hello!
Few words about retention:
This information will be useful for our traffic brokerage partners, who are able to target the traffic by manufacturers. Let’s talk about the retention – the ability of our service to generate ads on various types of devices.To put it simple, there are two types of retention – technical and human based. While we are taking care of the latter, it’s up to our partners to improve the technical retention.
Doing this is simple – just target the right manufacturers.
The best performing vendors are the ones that are mostly present in Tier 1 and Tier 2 countries and less – in Tier 3 countries.
The best one is, of course, Samsung.
Our service will keep running for months - at least approximately 25-30% of initial installs.
The same good retention can be observed on Motorola, Asus, LG, Nokia, Lenovo, Sony, Alcatel, HTC, Asus and others international vendors.
The bad retention is typical for Chinese vendors, largest of which are Huawei, Xiaomi, Oppo and Vivo.
Please avoid targeting these ones, because it would be just a waste of money and, while targeting good-performing vendors, you would increase your ROI dramatically.

traffback
We are glad to announce, that we have added a traffback URL to all of our landings and custom links.
With its' help you are able to boost your monetization heavily and drive the significant part of your traffic (normally, it is 10%-40% of the total number of clicks on your landing page) anywhere you want - for example, to push subscription landings.
Technically, this traffback is a popunder, which pops up when a user hits "download" button or any other part of the LP. This popunder is shown only when a user closes the LP. That means, that the traffback URL doesn't affect the conversion rate in any way. Also, our tests showed, that the traffback converts very good.
Properly speaking, this is not a traffback remnant low quality traffic, but more like a proper HQ additional popunder traffic.

our rates
Dear partners, you keep asking us, how much can you get for this or that number of installs for a specific geo.
If you already have an account with us, you can find the answer in the “Rates” section. Specifically, you can see system average CPM rates for the last 7 days, as well as estimated CPI rates, which you can keep in mind while buying the traffic from ad networks. For example, such data is super useful if you work with Smart CPM. You can set those rates per each geo and ad network will do the campaign optimization by itself.
Also, please keep in mind, that those CPI rates are calculated for a one month pay-off period, considering standard traffic structure and behavioral pattern. In other words, if you work on a revshare, you should get those rates within the first month of the install, but, eventually, for the whole life cycle of the install, you will get twice more revenue.
Currently our rates are following:

Formats?
Demand for which all ad formats do you support? I might have something we can discuss about.