Covert web-to-app tracking via localhost on Android
summary
Researchers disclose a covert localhost channel on Android that links browser cookies to app identities, found active in Meta and Yandex deployments and observed on millions of sites. Tests crawling 100k top sites show over 78% of Meta Pixel sites and 83% of Yandex Metrica sites probe localhost before consent. Techniques include HTTP/WebSocket probes and WebRTC SDP munging to exfiltrate FBP cookies and advertising IDs, and platform patches (Chrome port blocks and SDP checks) partially mitigate it.
AI-written summary · about
chapters (24)
- 0:00Introduction by host
- 1:04Talk overview and motivation
- 3:56Discovery of localhost tracking channel
- 7:06Meta’s localhost tracking mechanism
- 9:16Yandex’s localhost tracking method
- 12:06Privacy risks and data leakage
- 14:14Platform-wide implications
- 16:01Industry response and browser fixes
- 18:53Regulatory and policy impact
- 20:16Q&A session begins
- 20:36iOS analysis limitations
- 22:21Play Store policy violations
- 23:32Google’s localhost blocking history
- 24:34IPv6 and localhost tracking
- 25:16Protocol evolution by Meta
- 25:58Research methodology discovery
- 27:04Google’s future permissions plans
- 27:48Current status of Meta and Yandex
- 28:30Other apps using localhost tracking
- 29:34Desktop and Safari considerations
- 30:58Facebook Pixel in mobile apps
- 31:41WebRTC server manipulation risks
- 32:44Blocking pixels to prevent tracking
- 33:06Summary and conclusion
related talks
49mBeyond Cookies: The Unseen Privacy Risks of Web Analytics
27mBypassing Browser Security Policies for Fun and Profit
25mInvestigating Privacy Issues on Mobile Platforms
49mWeb Side Story: A Privacy Odyssey through Tracking and Fingerprinting
33mMeasuring the Insecurity of Mobile Deep Links of Android
36mMaliciously Monetizing AppSec Feature. Its All About The Money.
17mSidewinder Targeted Attack Against Android in the Golden Age of Ad Libs
36mRevisiting Stealthy Sensitive Information Collection from Android Apps