Skip to main content

Zeptolabs Spying on You?

I am a developer. Today, I hooked up the device log to my android tablet which has Cut The Rope on it (Zeptolabs). Surprised, I found a curious series of log entries: 

01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.djinnworks.StickmanBaseJumper.lite
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.duckduckmoosedesign.ibs
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.facebook.katana
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.fandango
Furthermore, it even sends application usage information: 
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): CommManager: processesRequest() [thread:467] [request:1230252154] Sending POST data as part of the request [length: 5221]:
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): app_usage_data=%5B%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%224.4.54%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%224040054%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22Mono.Android.DebugRuntime%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%224.4.41%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%224040041%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22Mono.Android.Platform.ApiLevel_14%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%224.4.54%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%224040054%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22Mono.Android.Platform.ApiLevel_8%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%221.0%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%221%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22Tests.Tests%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%221.33%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%2233%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22br.com.beholdstudios.knightspp%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%221.0.4%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%225%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22com.MikaMobile.Zombieville%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%223.12.2%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%2245%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22com.about.CalorieCount%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2

Apparently this game is enumerating all of the installed apps that I have on the tablet and is sending it to their server.

Here is where they upload the payload to their servers: 

01-14 20:54:17.843 V/GetJar SDK [com.zeptolab.ctr.paid](14868): CommManager: processesRequest() [thread:467] [request:1230252154] ROUTE [ResolvedIP: 204.138.26.182  ProxyHost: null  TargetHoust: https://rptuse20120814.getjar.com:443  Secured: true  Tunnelled: false]
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868): The request properties for this request:
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868):       Content-Language = 'en-US'
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868):       Content-Type = 'application/x-www-form-urlencoded'
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868):       User-Agent = 'GetJarSDK/20120921.02 com.zeptolab.ctr.paid/18 android/4.2.1 (google; nakasi; Nexus 7)'
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868):       Authorization = 'client_app.token=&user.user_access_id=&app.capabilities=18&legacy.client_app.soft_id=75206&user.id=000103e90000000000d78ce4&client_app.sandbox=false&user.capabilities=14&sdk.level=6&Issuer=http%3A%2F%2Fauthorize.getjar.com&Audience=getjar.com&ExpiresOn=1358398421155&HMACSHA256='
The IP address (204.138.26.182) belongs to Getjar, inc., located at: 
Getjar, Inc. 
ICANN Handle GETJA 
Street 1510 Fashion Island Blvd, Suite 300
 
City San Mateo 
State/Province CA 
Postal Code 94404 

http://whois.arin.net/rest/org/GETJA.html

Popular posts from this blog

THE RISE OF FASCIST SOCIAL MEDIA

The Merriam-Webster dictionary defines fascism as: a tendency toward or actual exercise of strong autocratic or dictatorial control .  The phrase "dictatorial control" is important for the case that I am going to make about fascism in social media. The word "dictatorial" means "of or relating to a dictator," and a dictator is "one ruling in an absolute and often oppressive way." In 2020, social media has seen a rise in the number of autocratic events of censorship. The two social media outlets that I am going to focus on are Facebook and Twitter.  Background Facebook is a semi-private curated blogging platform where you, the user, share information at your leisure. The public part of Facebook is in Facebook Groups. With a group, outside people who are not privy to your "Facebook Wall" will join your group and establish a communal discourse. This can be private, by invitation only, or public. The Facebook is auth-walled so that you must
Read more

Clustered Foolishness

I had morning coffee with a well respected friend of mine recently. Aside from chatting about the usual wifery and family, we touched on the subject of clustered indices and SQL Server performance. A common misconception in the software industry is that a clustered index will make your database queries faster. In fact, most cases will demonstrate the polar opposite of this assumption. The reason for this misconception is a misunderstanding of how the clustered index works in any database server. A clustered index is a node clustering of records that share a common index value. When you decide on an index strategy for your data, you must consider the range of data to be indexed. Remember back to your data structures classes and what you were taught about hashtable optimizations. A hashtable, which is another way of saying a database index, is just a table of N values that organizes a set of M records in quickly accessible lists that are of order L, where L is significantly less than M.
Read more

Trademarks In The Dark

If you have a business, then you know that filing for a trademark is pretty easy in the USA. You just go to the USPTO web site ( www.uspto.gov ) and start filling out the form. The cost is significantly less now, nearly a third of what it was a couple of years ago. That's great news. What you don't know about your mark, though, is that there is a plethora of common law that dictates whether or not you can file with your specimens. The specimens are documents that clearly show your mark being used in commerce. Well, my last mark registration came back to me with the examiner asking for a better specimen that places the mark in closer proximity to evidence of commerce. Closer proximity. Yeah. Right. Apparently Lands’ End, Inc. v. Manbeck, 797 F. Supp. 511, 514, 24 USPQ2d 1314, 1316 (E.D. Va. 1992); In re Dell Inc., 71 USPQ2d 1725, 1727-1729 (TTAB 2004); In re MediaShare Corp., 43 USPQ2d 1304 (TTAB 1997); TMEP §§904.06(a) and (b), establish some common law that determines an acce
Read more