Database Users

Protecting Privacy - Compiling TaintDroid into Kernel to find leaky apps

Most people don't yet know that many Android software leak all sorts of information to the internet with only scant user acknowledgement (basically what you accept when you install the app).
Due to this and the fact that there are already privacy information harvesting apps for Android on the marketplace - a team of security experts have created TaintDroid:
What is TaintDroid?
From the project's web page: "A realtime monitoring service called TaintDroid that precisely analyses how private information is obtained and released by applications "downloaded" to consumer phones."
From: http://appanalysis.org/index.html
How can I install TaintDroid?
As TaintDroid is currently compiled into the kernel, you cannot easily install it, but you have to cook your own kernel. Instructions (for Nexus 1) are available at the project web site: http://appanalysis.org/download.html
How does TaintDroid work?
Here's a video demonstrating how TaintDroid works once it is installed and configured:
http://appanalysis.org/demo/index.html
Why would you want to install this?
There can be many reasons for installint TaintDroid:
- You want to learn about privacy features and play with Android kernel
- As it is currently impossible to differentiate between innocent and sneaky Android apps based only on what access rights they request, you may want to dig in deeper
- You are worried about what apps are doing behind your back and you want to know which apps to uninstall
- You want to help create Android a more secure and privacy-protected platform, instead of the swiss cheese it currently is
What can you do?
As compiling kernels is mostly beyond the reach of mere mortals currently, consider cooking TaintDroid into your kernel, if you are cooking one yourself and offering it available for others to try and use.
Hopefully increased awareness and usage will bring this program eventually into other modders and perhaps even Google's attention and something more easily accessible is offered for the public at large.
BTW, I'm just a user, interested in getting TaintDroid on my own Galaxy S. I'm not affiliated with the research program, but I like what they are doing. This information is purely FYI.

+1 for the idea
Sent from my GT-I9000 using XDA App

+1
Since we cannot expect information gatherer Google to come up with a good privacy protection mechanism soon I think we are forced to take measures ourselves.
I also learned that several of my bought applications are constantly forcing me to enable synchronisation and/or 3G internet. They either randomly uninstall (Asphalt 5), their icons disappear (for example: Mini-squadron) or won't start, with (Schredder Chess) or without a message. Angry Birds Beta2 lite (free game) and Hungry Shark are 2 more examples. So much for an incentive to buy games...
It would be great if applications used a well-defined mechanism to check their validity on-line, and not have this sneaky, lingering attack from all sides to any privacy or battery consumption aware user.

I can not cook Kernels, but this is something i want to use.
Not that i am worried, but i dont know what apps are sending when you open them. Thats something i want to know!
I am sure i am not the only one.

+1
Yes please... This should be in all android phones... as a security option you could turn on!!!

Antonyjeweet said:
Not that i am worried, but i dont know what apps are sending when you open them. Thats something i want to know!
Click to expand...
Click to collapse
And do some of these applications only send stuff when you open them?
--
From a user perspective it currently is really difficult to judge applications that need to start at boot-up and deal with many facets of your computer (Launchers, tools combining lots of divers features).

Do you know some ROM where Taindroid is included?

I've posted in hardcore and laststufo kernel threads to ask if they could add it.
We just need more people wanting it so they think about adding it

exadeci said:
I've posted in hardcore and laststufo kernel threads to ask if they could add it.
We just need more people wanting it so they think about adding it
Click to expand...
Click to collapse
glad you did that

+1 support the idea. hope some of our hardworking kernel builders will add this in.

My concern is how much another real time service will affect battery life. For people trying to make the leanest, fastest kernel I'm not sure it's viable.

I have been wanting TaintDroid built into android by default since the day it was announced, but I really do not think google cares about this, so please, please ROM cookers out there (Maybe Doc?), lets add this into our galaxy S roms.

Well, this seems to work only on android 2.1

Make it so.
+1
Combined with walldroid (or other firewall) this could put back power into users hands. Would really love to see this inside hardcores kernel. Maybe as an option for the stable releases?

+1
This should be the next standard in aAndroid

idea about spoofidroid application
how about a program to spoof or make the phone send fake:
GPS location,
IMEI,
phone number,
simcard id,
etc... information to applications that ask without permission.
this way you can feed these application with information they want but without breaking your privacy. (both end sides are more than happy)
-----
nice option to have:
1) enable/disable auto generate different id every time.
2) allow list / ban list of application to have real or fake id.
3) enable/disable notify for application request.
-----
there are all ready applications that fake your simcard PLMN mobile network codes without the need of kernel rights, but you need to enable disable the flight mode to restore the default code.
===========
good luck to spoofidroid or similar applications.

Jumba said:
My concern is how much another real time service will affect battery life. For people trying to make the leanest, fastest kernel I'm not sure it's viable.
Click to expand...
Click to collapse
I hope there will be developers out there who prioritize privacy/security over speed/battery and storage usage.

I'm the project lead of the TaintDroid system. We are currently working on a few extensions of TaintDroid but unfortunately are short on engineering resources to port TaintDroid onto other systems than Nexus One that we originally developed. We'd greatly appreciate it if XDA developers would take on this effort! Many ongoing projects would hugely benefit from having easy-to-run TaintDroid ROM available for many different devices and upcoming Android systems let alone user benifit.
Thanks,
Jaeyeon
Research Scientist @ Intel Labs Seattle

Ettepetje said:
I also learned that several of my bought applications are constantly forcing me to enable synchronisation and/or 3G internet. They either randomly uninstall (Asphalt 5), their icons disappear (for example: Mini-squadron) or won't start, with (Schredder Chess) or without a message. Angry Birds Beta2 lite (free game) and Hungry Shark are 2 more examples. So much for an incentive to buy games...
Click to expand...
Click to collapse
beta2 lite? i think that was malware, make sure it came from rovio otherwise it's fake and you should delete it.

It's really scary to see with the lookout app how many apps can access to your imei, telephone number "Read Identity Info", can access your contacts, track your position, and can send out all this data.
Here a HTC Desire user, asking for some privacy.
Best regards!

admob alternative

looking for admob like stuff.
admob simply too slow to show ads before user see the ads. instead they close the window.

you can try to use UnityAds service
its quite simple and easy to setup, but their support is so very slow

Maybe Mobvista does
dhsoft23 said:
looking for admob like stuff.
admob simply too slow to show ads before user see the ads. instead they close the window.
Click to expand...
Click to collapse
they use CPA model, but ads is quick, also, support is always there anytime you have some question.

MobClix, 2nd in popularity after AdMob, easy to integrate, multiple ad networks, pays more than AdMob but has high payment threshold before it will pay out, reportedly pays with 3 months delay.
MobFox, targets high revenue ads in US and Europe, allows you to control the minimum ad-click price.
MoPub, new kid on the block, multiple ad networks, different ad types (banner, full screen, video ads). Currently working on support for in-app payments, not really turnkey integration.
LeadBolt, multiple ad types like interstituals and video ads, high fill rate.
Airpush, pushes ads to the notification pane, some apps that use Airpush have been temporarily banned from Android Marketbecause users regarded this as malicious app behaviour. Has opt-out system either by entering your IMEI or installing an opt-out app.

Sure, there are quite a few networks out there to test, but results will depend heavily on your genre/user geos and also the active advertisers they have on the roster.
We have a full list here, with all their data: Thalamus.co
It's used more on the UA side, and we have average CPI + install rates by genre/platform/country, but it should be able to give you a good sense of potential eCPMs and other networks you might want to add into the mix.

Which is the best Mobile network

Hi, which is the best mobile ad network you all know?

All ad networks have their ups and downs. They'll have a good campaign, then it will end, then later they'll get another, and so on. It's best to have multiple networks and mediate them. That way you get the benefit of the ups, and can mitigate the downs.
What is the best? That is a question that is always asked but can never really be answered. But now you CAN try out these different networks without wasting valuable time and resources.
Using Enhance, you can now integrate all of the services that providers offer without ever having to touch an SDK again. With little to NO coding at all and without touching source code, Enhance® is the easiest way to integrate 3rd party services into your project or to keep them up to date. (Ads, Mediation, Analytics, Attribution, Crash Reporting and more) No more SDK integration!!!
Gone are the days of spending hours or even days implementing and updating SDKs. How does a few clicks and a few minutes sound? Well, follow the link for more information on how to get started with Enhance® : https://goo.gl/kufiQQ

Use mediation
shaboss said:
Hi, which is the best mobile ad network you all know?
Click to expand...
Click to collapse
You will probably never get the same answer to this question, as ad networks performance depends on many factors and each app is different. Geo, segmentation, ad formats and impressions are some of the settings that can drastically change revenue.
To make sure you are getting the highest paying bid, the best you can do is mediation. This allows you to integrate several ad networks in one SDK. You won't believe the time you'll save doing this. So go ahead and try some mediation platforms until you find the one that fits you better.
I recommend Appodeal. They not only have good performance, but also a very stable SDK, great support team, upfront payment options and work with different payment platforms (including cryptocurrencies). The one thing that makes Appodeal different from other mediation platforms is that they started as an in-house solution for publishers. So they don't own a marketplace. That means mediation will stay unbiased.

X-Mediate
Hi
Using a mediation solution is the best way to make sure you always receive the best ad revenue.
With X-Mediate, you access a mediation platform fully powered by artificial intelligence to optimise your revenue at every ad request.
You only need 1 SDK to integrate to monetize your app with the best ad networks and RTB partners.
We also provide greats tools so you can monitor the ads displayed in your app, understand every decision taken by our algorithm...
Do not hesitate to contact me if you want to know more.
Jane
[email protected]

APK installs/Android traffic monetization solution

Hi there!
Let us introduce ourselves. We specialize in monetizing APK installs as well as any other Android traffic.
We are in the business for over 6 years already and this is what we can offer you right now:
-NET0 payouts
-Automatic ads integration/mass integration into any APK file
-0 detections
-APK tuning (changing package name, app name, icon e.t.c)
-Flexible ads behavior (settings delays, ads frequency, hide app icon, don't show ads for GP installs e.t.c.)
-For GP app updates our ads start after the update, without the need to launch the app itself, thus covering the whole userbase with the single update
-Sub IDs support,postbacks and direct download links for mediabuyers
-Advanced reporting system with GEO/CPM/APPS breakdown as well as average system CPM rates
-Flexible referral system starting from 7% and more
-Great support
-Up to 20 ads per day.
Please feel free to contact us at support[at]madmobile.biz

hey thanx for your knowledge

Hi, mad.mobile
I have developed SDK with proxy inside. I have TOS and SLA. It very big project with proxy buyers, app owners, dashboard, per-week payments and so on. I asking user to give to me access to his internet connection and working absolutely with white solutions. Does it interested for you to have additional profit with me by injecting my SDK to your APKs?
check out here: monkeysocks.net/sdk/ (please copy and paste because i have not 10 posts to post links)

MadMobile-APK installs/Android Download traffic monetization. Auto-SDK and Smartlinks
We are glad to introduce new type of ads, which is not connected in any way with our automatic SDK: Smartlinks.
This is a well-known format on the market and, if you used it, you should probably know how it works and we hope that you will like it.
What we can offer you in terms of smartlink ads is:
-No irritating endless redirects
-All OS are accepted: Android, iOS, Win, MacOS, Other mobile/desktop devices (Java, WM e.t.c.)
-NET0 by default. Bi-weekly/weekly payouts, depending on your volumes
-Average daily smartlink system rates per GEO
-Decent CPM rates
-100% fill rates for all GEOs
Please feel free to sign up and check it out yourself. We will help you squeeze out the maximum from your traffic.

Hello MadMobile! I would like to discuss a potential partnership. Please contact me on skype for the further details: juliacnv.

custom links and landings
Hello!
Due to multiple demands from our partners we released a separate section with landing pages. Now all you have to do is simply launch the traffic, landings will handle the rest! Currently we have 50 landings in public and over 50 landings in a row to be integrated, and we will do our best to have at least 3-5 of them integrated daily. Please note that all landings are multilingual.
Also, if you have a demand for some specific landings, or if you have any landings that you world like to be integrated with us, please feel free to contact us.
Please note, that our landings also have a {post} variable, which is extremely useful for any torrent/download/mp3 traffic, which might requite to pass a user a specific variable file name (e.g. if a user looks for "witcher-the-movie.torrent" file, he will be redirected to a torrent download landing page with "witcher-the-movie.torrent.apk" file name). Such variable will increase clicks-to-downloads conversion rate dramatically.
We are ready to offer our partners CPI payouts! (For verified partners only). You can get up to 10 cents for US install instantly! However, please keep in mind that revshare will eventually get you much more.
If you have any questions, please contact us [email protected]. We will be happy to assist you with the integration or answer any of your questions.
skype:mad.mobile1
[email protected]
tg://madmobile_support

retention
Hello!
Few words about retention:
This information will be useful for our traffic brokerage partners, who are able to target the traffic by manufacturers. Let’s talk about the retention – the ability of our service to generate ads on various types of devices.To put it simple, there are two types of retention – technical and human based. While we are taking care of the latter, it’s up to our partners to improve the technical retention.
Doing this is simple – just target the right manufacturers.
The best performing vendors are the ones that are mostly present in Tier 1 and Tier 2 countries and less – in Tier 3 countries.
The best one is, of course, Samsung.
Our service will keep running for months - at least approximately 25-30% of initial installs.
The same good retention can be observed on Motorola, Asus, LG, Nokia, Lenovo, Sony, Alcatel, HTC, Asus and others international vendors.
The bad retention is typical for Chinese vendors, largest of which are Huawei, Xiaomi, Oppo and Vivo.
Please avoid targeting these ones, because it would be just a waste of money and, while targeting good-performing vendors, you would increase your ROI dramatically.

traffback
We are glad to announce, that we have added a traffback URL to all of our landings and custom links.
With its' help you are able to boost your monetization heavily and drive the significant part of your traffic (normally, it is 10%-40% of the total number of clicks on your landing page) anywhere you want - for example, to push subscription landings.
Technically, this traffback is a popunder, which pops up when a user hits "download" button or any other part of the LP. This popunder is shown only when a user closes the LP. That means, that the traffback URL doesn't affect the conversion rate in any way. Also, our tests showed, that the traffback converts very good.
Properly speaking, this is not a traffback remnant low quality traffic, but more like a proper HQ additional popunder traffic.

our rates
Dear partners, you keep asking us, how much can you get for this or that number of installs for a specific geo.
If you already have an account with us, you can find the answer in the “Rates” section. Specifically, you can see system average CPM rates for the last 7 days, as well as estimated CPI rates, which you can keep in mind while buying the traffic from ad networks. For example, such data is super useful if you work with Smart CPM. You can set those rates per each geo and ad network will do the campaign optimization by itself.
Also, please keep in mind, that those CPI rates are calculated for a one month pay-off period, considering standard traffic structure and behavioral pattern. In other words, if you work on a revshare, you should get those rates within the first month of the install, but, eventually, for the whole life cycle of the install, you will get twice more revenue.
Currently our rates are following:

Formats?
Demand for which all ad formats do you support? I might have something we can discuss about.

What is the best ad network? If it was only that easy....

All ad networks have their ups and downs. They'll have a good campaign, then it will end, then later they'll get another, and so on. It's best to have multiple networks and mediate them. That way you get the benefit of the ups, and can mitigate the downs.
What is the best? That is a question that is always asked but can never really be answered. But now you CAN try out these different networks without wasting valuable time and resources.
Using Enhance, you can now integrate all of the services that providers offer without ever having to touch an SDK again. With little to NO coding at all and without touching source code, Enhance® is the easiest way to integrate 3rd party services into your project or to keep them up to date. (Ads, Mediation, Analytics, Attribution, Crash Reporting and more) No more SDK integration!!!
Gone are the days of spending hours or even days implementing and updating SDKs. How does a few clicks and a few minutes sound? Well, follow the link for more information on how to get started with Enhance® : https://goo.gl/LUjTLt

Have you checked out Enhance lately?
Our team has been hard at work making it even easier to be GDPR compliant!
https://goo.gl/LUjTLt