Mobile Websites Can Tap Into Your Phone's Sensors Without Asking

guest · Sep 26, 2018

Mobile Websites Can Tap Into Your Phone's Sensors Without Asking
September 26, 2018
https://www.wired.com/story/mobile-websites-can-tap-into-your-phones-sensors-without-asking/

When an app wants to access data from your smartphone's motion or light sensors, iOS and Android require that it make that capability clear. [...] But a team of researchers has discovered that those rules don't apply to websites loaded in mobile browsers, which can often often access an array of device sensors without any notifications or permissions whatsoever.

The researchers found that of the top 100,000 sites—as ranked by Amazon-owned analytics company Alexa—3,695 incorporate scripts that tap into one or more of these accessible mobile sensors. That includes plenty of big names, including Wayfair, Priceline.com, and Kayak.

In past work, researchers have also shown that they can use the unique calibration features of motion sensors on individual devices to identify and track them across websites.

"There are limitations of the available protections for users," Acar says. "In general we don’t think ad blockers and black lists were efficient in blocking these scripts."
Click to expand...

142395 · Sep 27, 2018

"The researchers also found that the popular ad and tracking blockers they tested didn't reliably block scripts seeking sensor access, catching them less than 10 percent of the time, and in most cases only 2 to 3 percent of the time."
Click to expand...

Yes, often new tracking scripts (tho IDK they mention only about tracking scripts or all scripts which access sensor) slip through all major blacklists for days, weeks, or even months (and they're always emerging), especially marketing automation scripts which clearly claim in its official site track user activity are too often not in the lists. The reason is obvious, they're not visible unlike ads. I'm too lazy to report them (but I've reported significant FPs a few times).

This is why default-deny is inevitable if you really wanna block online tracker. But you can disable sensor access via about:config in Firefox too.

guest · Feb 4, 2019

To protect users’ privacy, iOS 12.2 will limit Web apps’ access to iPhone’s sensors
The latest iOS beta defaults Web access to motion sensors to "off."
February 5, 2019
https://arstechnica.com/gadgets/201...-plans-to-limit-ar-features-in-mobile-safari/

The beta for iOS 12.2 contains a change to mobile Safari that could have implications for the advertising and marketing worlds, as well as for Web-based augmented or virtual reality more generally.

Two Apple employees on Twitter elaborated on the change. Apple software engineer Ricky Mondello wrote in a tweet thread recounting the various notes in the Safari 12.1 release for iOS:

Safari 12.1 (iOS): "Added Motion & Orientation settings on iOS to enable the DeviceMotionEvent and DeviceOrientationEvent events.”
This is disabled by default.

The addition may have been made in response to a Wired article that revealed many Web apps had access to device's motion data without users' knowledge.
Click to expand...

guest · May 22, 2019

Fingerprinting iPhones
May 22, 2019
https://www.schneier.com/blog/archives/2019/05/fingerprinting_7.html

This clever attack allows someone to uniquely identify a phone when you visit a website, based on data from the accelerometer, gyroscope, and magnetometer sensors.

We have developed a new type of fingerprinting attack, the calibration fingerprinting attack. Our attack uses data gathered from the accelerometer, gyroscope and magnetometer sensors found in smartphones to construct a globally unique fingerprint.
Overall, our attack has the following advantages: [...]

• The attack can be launched by any website you visit or any app you use on a vulnerable device without requiring any explicit confirmation or consent from you.
• The attack provides an effective means to track you as you browse across the web and move between apps on your phone [...]
* Following our disclosure, Apple has patched this vulnerability in iOS 12.2.
Click to expand...

Research paper: "SENSOR ID: Sensor Calibration Fingerprinting for Smartphones" (PDF - 1.39 MB): https://www.ieee-security.org/TC/SP2019/papers/405.pdf

mirimir · May 22, 2019

Hmmm. My phone has no sensors. Except a microphone and camera. But it's just a dumb phone, so I doubt that anyone can control them.

Reality · May 23, 2019

mirimir said: ↑

Hmmm. My phone has no sensors. Except a microphone and camera. But it's just a dumb phone, so I doubt that anyone can control them.
Click to expand...

I'll go you one better mine is extra dumb, doesn't even have a camera

Log in or Sign up

Mobile Websites Can Tap Into Your Phone's Sensors Without Asking

guest Guest

142395 Guest

guest Guest

guest Guest

mirimir Registered Member

Reality Registered Member

Log in or Sign up

Mobile Websites Can Tap Into Your Phone's Sensors Without Asking

guest Guest

142395 Guest

guest Guest

guest Guest

mirimir Registered Member

Reality Registered Member

Useful Searches