Investigating Privacy Issues on Mobile Platforms
summary
Research finds Instagram injects a remotely changeable 480-line JavaScript into every webpage shown in in-app browsers, with code that can monitor keystrokes; a demo site inAppBrowser.com proves it and draws ~17 million impressions. Tests read EXIF GPS from 10,000 photos in about 0.5 seconds to reconstruct a user’s movements. A vulnerable SDK install pattern (curl | sh over HTTP) enables on‑network takeover, keylogger installation and remote access. Responsible disclosure precedes public publication.
AI-written summary · about
chapters (19)
- 0:00Intro
- 1:38In-app browsers
- 2:33Why I looked into it
- 4:43Write a post
- 5:19Responsible disclosure
- 6:45Public comments
- 7:54inAppBrowser.com
- 9:19What else?
- 14:06Hijacking SDKs
- 17:56"Just don't use the app"
- 18:20It's our job to protect the user
- 19:46Think about the worst case
- 20:14Build it out
- 20:34Responsible disclosure
- 21:20How to go public?
- 22:33Why your report might get ignored
- 23:04Why going public is important
- 24:01Go for it
- 24:42Outro
related talks
35mFrom Mindless Scrolling to Meaningful Discovery: Finding Security
24mRecent Mobile App Security Incidents from Real-World Cases
11mMobile App Privacy: Gone in 6 seconds
49mAll Your Code Belongs To Us (Dismantling Android Secrets With CodeInspect)
40mStealing User's Identity
34mCovert web-to-app tracking via localhost on Android
58mUncovering OWASP’s Mobile Risks in iOS Apps
36mRevisiting Stealthy Sensitive Information Collection from Android Apps