Meta can track users through its Facebook and Instagram in-app browsers

guest · Aug 13, 2022

Via website code injection
August 12, 2022

A hot potato: Facebook has never boasted a reputation for protecting its users' privacy. Now, an ex-Google engineer writes that both the social network and another Meta-owned property, Instagram, are using their in-app browsers to track users by injecting code into websites.

Researcher Felix Krause looked into how Facebook and Instagram use custom in-app browsers when users visit webpages by clicking on a link; the apps don't redirect users to their default browser.

"The Instagram app injects their tracking code into every website shown, including when clicking on ads, enabling them [to] monitor all user interactions," Krause writes.
Click to expand...

The researcher investigated the iOS versions of Meta's apps. That's especially relevant as Apple's App Tracking Transparency (ATT) feature introduced in iOS 14 allows users to prevent apps from tracking their activities across other companies' apps and websites.

Meta said that it only injected tracking code based on a user's ATT preferences and that it was only used to aggregate data before being applied for targeted advertising or measurement purposes for those users who opted out of such tracking, writes The Guardian.

"We do not add any pixels," said a Meta spokesperson. "Code is injected so that we can aggregate conversion events from pixels. For purchases made through the in-app browser, we seek user consent to save payment information for the purposes of autofill."
Click to expand...

iOS Privacy: Instagram and Facebook can track anything you do on any website in their in-app browser

The iOS Instagram and Facebook app render all third party links and ads within their app using a custom in-app browser. This causes various risks for the user, with the host app being able to track every single interaction with external websites, from all form inputs like passwords and addresses, to every single tap.

Note: To keep this post simple, I'll use "Instagram" instead of "Meta" or "Facebook"
Click to expand...

What does Instagram do?

Links to external websites are rendered inside the Instagram app, instead of using the built-in Safari.

This allows Instagram to monitor everything happening on external websites, without the consent from the user, nor the website provider.

The Instagram app injects their JavaScript code into every website shown, including when clicking on ads. Even though pcm.js doesn’t do this, injecting custom scripts into third party websites allows them to monitor all user interactions, like every button & link tapped, text selections, screenshots, as well as any form inputs, like passwords, addresses and credit card numbers.

Click to expand...

guest · Aug 19, 2022

New tool checks if a mobile app's browser is a privacy risk
August 19, 2022

A new online tool named 'InAppBrowser' lets you analyze the behavior of in-app browsers embedded within mobile apps and determine if they inject privacy-threatening JavaScript into websites you visit.

The tool was created by developer Felix Krause who warned of this potentially risky behavior earlier in the month, explaining how easy it would be for in-app browsers to track anything the users see and do online by injecting JavaScript trackers on every web page they visit.
Click to expand...

The potential of these injections includes accessing browsing history, logging behavior characteristics to derive interests, log taps and key presses, monitoring screenshot actions, and even capturing passwords you enter into login forms.

The revelations shook the communities of popular apps that feature embedded browsers, so to help users determine the behavior of their app's activity, Krause released the 'InAppBrowser' online tool and open-sourced its source code.
Click to expand...

However, it is essential to clarify that reports of no detections don't mean that code injection can be excluded with certainty.

"This tool can't detect all JavaScript commands executed, as well as doesn't show any tracking the app might do using native code (like custom gesture recognizers)," explains Krause in his writeup.
Similarly, reports of code injection don't necessarily mean that the app is performing tracking activities but merely that the potential for abuse is present.

"Just because an app injects JavaScript into external websites doesn't mean the app is doing anything malicious." clarifies the report.
Click to expand...

Findings and dispute
The researcher claims to have found risky behavior on TikTok, Instagram, Facebook, and Messenger, while Snapchat and Robinhood came out clean in the tests.

For TikTok in particular, Krause found scripts that monitor keyboard input and screen taps. While there is no indication that TikTok abuses this ability, the researcher warns that it could be abused to gather sensitive information like passwords and credit card inputs.
A TikTok spokesperson shared the following statement with Bleeping Computer stating that they do not use these scripts to collect keystroke or text inputs.
Click to expand...

iOS Privacy: Announcing InAppBrowser.com - see what JavaScript commands get injected through an in-app browser

Last week I published a report on the risks of mobile apps using in-app browsers. Some apps, like Instagram and Facebook, inject JavaScript code into third party websites that cause potential security and privacy risks to the user.

I was so happy to see the article featured by major media outlets across the globe, like TheGuardian and The Register, generated a over a million impressions on Twitter, and was ranked #1 on HackerNews for more than 12 hours. After reading through the replies and DMs, I saw a common question across the community:
“How can I verify what apps do in their webviews?”
Introducing InAppBrowser.com, a simple tool to list the JavaScript commands executed by the iOS app rendering the page. [...]
Click to expand...

guest · Aug 20, 2022

For TikTok in particular, Krause found scripts that monitor keyboard input and screen taps.
Click to expand...

TikTok's in-app browser found to be recording your keystrokes
It's just for debugging, they swear
August 19, 2022

WTF?! Felix Krause, a software researcher and founder of Fastlane, recently made reports about popular social app TikTok. Krause claims that JavaScript code embedded into the in-app browser is currently being used to track keystrokes, screen taps, copied text, etc. Krause deems this to be a major security concern. TikTok claims that this code is strictly for debugging purposes, and is in no way used to track or log a user's information while they are using the app.

TikTok is widely regarded as one of the most popular mobile apps today, especially among the young. With 2.6 billion downloads since its launch in 2016, and TikTok's claims of up to one billion active global users, that statement certainly holds its weight.
Click to expand...

Krause states that TikTok has JavaScript code embedded into the in-app browser, used when users tap on links while scrolling through the app. He notes that the code being embedded into the browser is not the concern, as nearly all apps with integrated browsers have this form of code, including Facebook, Instagram, and Snapchat. Where the concern lies is what the JavaScript code is intending to do while the user interacts with the browser.

Krause reveals that the code is tracking the location of screen taps, what text a user copies while in the browser. But most importantly, the code tracks every single keystroke someone makes during their time inside the browser.
Click to expand...

TikTok was quick to attempt to disprove Krause's report, insisting the JavaScript code containing keylogging, screen tap data, and logging copied links from users is used strictly for debugging.

The company further points out that the code was included in a "third-party software development kit," also known as an SDK, and that the security concerns within the code are not being used or monitored by TikTok. However, when questioned regarding this, TikTok did not answer questions regarding the SDK or who specifically made it.
Click to expand...

Log in or Sign up

Meta can track users through its Facebook and Instagram in-app browsers

guest Guest

guest Guest

guest Guest

Log in or Sign up

Meta can track users through its Facebook and Instagram in-app browsers

guest Guest

guest Guest

guest Guest

Useful Searches