Skip to main content

Zeptolabs Spying on You?

I am a developer. Today, I hooked up the device log to my android tablet which has Cut The Rope on it (Zeptolabs). Surprised, I found a curious series of log entries: 

01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.djinnworks.StickmanBaseJumper.lite
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.duckduckmoosedesign.ibs
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.facebook.katana
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): [com.getjar.sdk.data.ReportManager] : sendInstalledApps() -- FOUND_INSTALLED: com.fandango
Furthermore, it even sends application usage information: 
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): CommManager: processesRequest() [thread:467] [request:1230252154] Sending POST data as part of the request [length: 5221]:
01-14 20:54:17.833 D/GetJar SDK [com.zeptolab.ctr.paid](14868): app_usage_data=%5B%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%224.4.54%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%224040054%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22Mono.Android.DebugRuntime%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%224.4.41%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%224040041%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22Mono.Android.Platform.ApiLevel_14%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%224.4.54%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%224040054%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22Mono.Android.Platform.ApiLevel_8%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%221.0%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%221%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22Tests.Tests%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%221.33%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%2233%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22br.com.beholdstudios.knightspp%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%221.0.4%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%225%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22com.MikaMobile.Zombieville%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2.1%22%2C%22key%22%3A%22device.platform_version%22%7D%5D%2C%22tracking_metadata%22%3A%5B%5D%2C%22event_timestamp%22%3A%222013-01-15T04%3A54%3A17Z%22%7D%2C%7B%22usage_type%22%3A%22FOUND_INSTALLED%22%2C%22app_metadata%22%3A%5B%7B%22value%22%3A%223.12.2%22%2C%22key%22%3A%22android.package.version_name%22%7D%2C%7B%22value%22%3A%22android%22%2C%22key%22%3A%22device.platform%22%7D%2C%7B%22value%22%3A%2245%22%2C%22key%22%3A%22android.package.version_code%22%7D%2C%7B%22value%22%3A%22com.about.CalorieCount%22%2C%22key%22%3A%22android.package.name%22%7D%2C%7B%22value%22%3A%224.2

Apparently this game is enumerating all of the installed apps that I have on the tablet and is sending it to their server.

Here is where they upload the payload to their servers: 

01-14 20:54:17.843 V/GetJar SDK [com.zeptolab.ctr.paid](14868): CommManager: processesRequest() [thread:467] [request:1230252154] ROUTE [ResolvedIP: 204.138.26.182  ProxyHost: null  TargetHoust: https://rptuse20120814.getjar.com:443  Secured: true  Tunnelled: false]
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868): The request properties for this request:
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868):       Content-Language = 'en-US'
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868):       Content-Type = 'application/x-www-form-urlencoded'
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868):       User-Agent = 'GetJarSDK/20120921.02 com.zeptolab.ctr.paid/18 android/4.2.1 (google; nakasi; Nexus 7)'
01-14 20:54:17.843 D/GetJar SDK [com.zeptolab.ctr.paid](14868):       Authorization = 'client_app.token=&user.user_access_id=&app.capabilities=18&legacy.client_app.soft_id=75206&user.id=000103e90000000000d78ce4&client_app.sandbox=false&user.capabilities=14&sdk.level=6&Issuer=http%3A%2F%2Fauthorize.getjar.com&Audience=getjar.com&ExpiresOn=1358398421155&HMACSHA256='
The IP address (204.138.26.182) belongs to Getjar, inc., located at: 
Getjar, Inc. 
ICANN Handle GETJA 
Street 1510 Fashion Island Blvd, Suite 300
 
City San Mateo 
State/Province CA 
Postal Code 94404 

http://whois.arin.net/rest/org/GETJA.html

Popular posts from this blog

DNS Custom Logs and selinux

If you google "named custom logs selinux" you will find quite a bit of chatter about setting up custom logs outside of /var/log for DNS (named). These posts are interesting, but they tend to be run on posts about learning selinux and becoming an expert on named. What you need to know? If you have setup custom logging locations in your /etc/named.conf file, such as:     channel default_file {         file "/var/log/named/default.log" versions 3 size 5m;         severity dynamic;         print-time yes;     }; Then you will likely see errors like this in /var/log/messages: Oct 26 11:41:13 namedsvr setroubleshoot: SELinux is preventing /usr/sbin/named from write access on the directory /var/named/chroot/var/log/named. For complete SELinux messages. run sealert -l 6eab4aaf-e615-4ade-9e88-4efdc789eaf2 Then you run the sealert command as suggested by the very friendly selinux audit log and you are told: #============= named_t ============== #!
Read more

THE RISE OF FASCIST SOCIAL MEDIA

The Merriam-Webster dictionary defines fascism as: a tendency toward or actual exercise of strong autocratic or dictatorial control .  The phrase "dictatorial control" is important for the case that I am going to make about fascism in social media. The word "dictatorial" means "of or relating to a dictator," and a dictator is "one ruling in an absolute and often oppressive way." In 2020, social media has seen a rise in the number of autocratic events of censorship. The two social media outlets that I am going to focus on are Facebook and Twitter.  Background Facebook is a semi-private curated blogging platform where you, the user, share information at your leisure. The public part of Facebook is in Facebook Groups. With a group, outside people who are not privy to your "Facebook Wall" will join your group and establish a communal discourse. This can be private, by invitation only, or public. The Facebook is auth-walled so that you must
Read more

Outlook Configuration

To read all email in text and be able to extract the mail using mail headers: > regedit HCU/Software/Microsoft/Office/16.0/Outlook/Options/Mail   MinimalHeaderOn = 0 (dword)   ReadAsPlain = 1 (dword)   SaveAllMIMENotJustHeaders = 1 (dword) restart Outlook afterwards, maybe even reboot just for good measure. Now you get to see all of those phishy urls in the emails and you can get all of those embedded image attachments as raw encoded binary when you get the header details on the message. Put the Message Options button in the hot button task bar so you can quickly get this info. No more phishy phish from the numbskulls. I take payment in coffee. It's been a long time since I've had Jamaica Blue Mountain. Just saying. If you know how to disable the jpeg thumbnail render of attachments, please share on twitter. That's an obvious vector.
Read more