wlug

Download

wlug@list.wlug.org.nz

June 2025

1 participants
2 discussions

Meta and Yandex Are De-Anonymizing Android Users' Web Browsing Identifiers
by Peter Reutemann 04 Jun '25

04 Jun '25

'"It appears as though Meta (aka: Facebook's parent company) and Yandex have found a way to sidestep the Android Sandbox," writes Slashdot reader TheWho79. Researchers disclose the novel tracking method in a report: We found that native Android apps -- including Facebook, Instagram, and several Yandex apps including Maps and Browser -- silently listen on fixed local ports for tracking purposes. These native Android apps receive browsers' metadata, cookies and commands from the Meta Pixel and Yandex Metrica scripts embedded on thousands of web sites. These JavaScripts load on users' mobile browsers and silently connect with native apps running on the same device through localhost sockets. As native apps access programmatically device identifiers like the Android Advertising ID (AAID) or handle user identities as in the case of Meta apps, this method effectively allows these organizations to link mobile browsing sessions and web cookies to user identities, hence de-anonymizing users' visiting sites embedding their scripts. This web-to-app ID sharing method bypasses typical privacy protections such as clearing cookies, Incognito Mode and Android's permission controls. Worse, it opens the door for potentially malicious apps eavesdropping on users' web activity. While there are subtle differences in the way Meta and Yandex bridge web and mobile contexts and identifiers, both of them essentially misuse the unvetted access to localhost sockets. The Android OS allows any installed app with the INTERNET permission to open a listening socket on the loopback interface (127.0.0.1). Browsers running on the same device also access this interface without user consent or platform mediation. This allows JavaScript embedded on web pages to communicate with native Android apps and share identifiers and browsing habits, bridging ephemeral web identifiers to long-lived mobile app IDs using standard Web APIs. This technique circumvents privacy protections like Incognito Mode, cookie deletion, and Android's permission model, with Meta Pixel and Yandex Metrica scripts silently communicating with apps across over 6 million websites combined. Following public disclosure, Meta ceased using this method on June 3, 2025. Browser vendors like Chrome, Brave, Firefox, and DuckDuckGo have implemented or are developing mitigations, but a full resolution may require OS-level changes and stricter enforcement of platform policies to prevent further abuse.' -- source: https://yro.slashdot.org/story/25/06/03/205251 Cheers, Peter

1 0

Beware of the Browser-in-the-Middle Attack: What It Is and How to Protect Yourself
by Peter Reutemann 04 Jun '25

04 Jun '25

'A new security threat called the browser-in-the-middle (BITM) attack has recently been uncovered, exposing users—especially those using Apple’s Safari browser—to potential exploits that could compromise their privacy and security. Reports from BleepingComputer and GBHackers highlight how attackers can take advantage of browser fullscreen features to trick users into revealing sensitive information. [...] A browser-in-the-middle attack is a phishing-like technique that leverages the browser’s fullscreen mode to impersonate legitimate websites or system dialogs. By forcing the browser to enter fullscreen mode, attackers can overlay fake login screens, pop-ups, or security warnings that look authentic but actually capture user input such as passwords, credit card numbers, or other personal data. Unlike traditional man-in-the-middle attacks that intercept communications, BITM attacks manipulate the user interface itself to create convincing illusions. Because fullscreen mode hides browser UI elements like the address bar or tabs, users may be unaware they are interacting with a fraudulent page. According to the reports, Safari’s fullscreen API is particularly vulnerable to BITM attacks. Attackers can use JavaScript to force fullscreen without user consent or notification and then display spoofed content that mimics trusted websites or system alerts. This makes Safari users a prime target, although the risk isn’t limited to this browser alone.' -- source: https://cyptd.com/beware-of-the-browser-in-the-middle-attack-what-it-is-and… Cheers, Peter

1 0