See Thousands of Applications Hijacked to Spy on Your Location

This article done with support from WIRED.

Some of the world’s most popular apps have likely been co-opted by rogue members of the advertising industry to harvest sensitive location data on a massive scale, with that data ending up with a company of location data whose subsidiary previously sold global location data to US law enforcement.

Thousands of apps, included in the hacked files from location data company Gravy Analytics, include everything from games like Candy Crush to dating apps like Tinder, to pregnancy tracking and religious prayer apps on Android and iOS. Because most of the collection happens through the advertising ecosystem—not code created by the app creators themselves—this data collection tends to happen without the knowledge of users and even app developers.

“For the first time publicly, it appears we have proof that one of the largest data brokers selling to commercial and government clients, appears to be getting its data from the online advertising ‘bid stream,'” rather than code embedded in the apps themselves, Zach Edwards, senior threat analyst at cybersecurity firm Silent Push, who follows the location data industry closely, told 404 Media after reviewing the SOME you data.

The data provides a unique look inside the world of real-time bidding (RTB). Historically, location data companies paid app developers to include code bundles that collect location data on their users. Many companies instead turn to search location information through the advertising ecosystemwhere companies bid to place ads within apps. But a side effect is that data brokers can listen to that process, and harvest the location of people’s cellphones.

“This is a terrible scenario for privacy because not only does this data breach contain data obtained from RTB systems, but there are some companies out there that are acting like a global honey badger, that does whatever it wants with every piece of data that comes its way,” Edwards added.