A Little Bird Told Me: Personal Information Sharing in Angry Birds and its Ad Libraries

    <b>IpAddress&quot;:&quot;fXXX...XXX9%eth0&quot;</b>,...</span></p>
  <p>According to <a href="http://whois.domaintools.com/appads.com">whois
  records</a>, the registrant organization of neptune.appads.com is
  Burstly, Inc. Therefore, the aforementioned information is
  actually transmitted to Burstly. It Both PCaps contain the keyword
  crParms. This keyword is also used in the source code to put
  personal information into a map sent as a payload.</p>
  <p>Skyrocket.com is an <a href="http://www.insidemobileapps.com/2013/05/21/burstly-restructures-company-and-opens-skyrocket-to-all-mobile-developers/" target="_blank">app
    monetization service provided by Burstly</a>. The following PCap
  shows that Angry Birds retrieves the customer ID from
  Skyrocket.com through an HTTP GET request:</p> <p>
  <span>HTTP/1.1 200
OK</span></p> <p>
  <span>Cache-Control:
private</span></p> <p>
  <span>Content-Type:
text/html</span></p> <p>
  <span>Date: Thu, 06
    Mar 2014 07:12:25 GMT</span></p> <p>
  <span>Server:
Microsoft-IIS/7.5</span></p> <p>
  <span>ServerName:
    P-ADS-OR-WEBA #5</span></p> <p>
  <span>X-AspNet-Version:
4.0.30319</span></p> <p>
  <span>X-Powered-By:
ASP.NET</span></p> <p>
  <span>X-ReqTime:
2</span></p> <p>
  <span>X-Stats:
geo-0</span></p> <p>
  <span>Content-Length:
9606</span></p> <p>
  <span>Connection:
keep-alive</span></p> <p>
  <span>GET
    /7.4/ad/image/1...c.jpg HTTP/1.1</span></p> <p>
  <span>User-Agent:
    Mozilla/5.0 (Linux; U; Android 4.4.2; en-us; Ascend Y300
    Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0
    Mobile Safari/534.30</span></p> <p>
  <span>Host:
cdn.skyrocketapp.com</span></p> <p>
  <span>Connection:
Keep-Alive</span></p> <p>
  <span>{&quot;type&quot;:&quot;ip&quot;,&quot;Id&quot;:&quot;9XXX8&quot;,...&quot;data&quot;:[{&quot;imageUrl&quot;:&quot;http://cdn.skyrocketapp.com/79...2c.jpg&quot;,&quot;adType&quot;:{&quot;width&quot;:300,
    &quot;height&quot;:250, &quot;extendedProperty&quot;:80},
    &quot;dataType&quot;: 64,
    &quot;textAdType&quot;:0,&quot;destType&quot;:1,&quot;destParms&quot;:&quot;&quot;,&quot;cookie&quot;:[{&quot;name&quot;:&quot;fXXXg&quot;,
    &quot;value&quot;:
    &quot;ref=1XXX2&amp;cr<b>1XXX8</b>=2,1&amp;cr1XXX8=1&amp;aoXXX8=&quot;,
    &quot;path&quot;:&quot;/&quot;, &quot;domain&quot;:
    &quot;neptune.appads.com&quot;, &quot;expires&quot;:&quot;Sat,
    05 Apr 2014 XXX GMT&quot;, &quot;maxage&quot;: 20},
    {&quot;name&quot;:&quot;vw&quot;,&quot;value&quot;:&quot;ref=1XXX2&amp;...},...,&quot;cbi&quot;:&quot;http://bs.serving-sys.com/Burstin...25&amp;rtu=-1&quot;,&quot;cbia&quot;:[&quot;http://bs.&quot;:1,&quot;expires&quot;:60},...&quot;color&quot;:{&quot;bg&quot;:&quot;00&quot;},
&quot;isInterstitial&quot;:1}</span></p> <p>2. In this PCap, the ad
  is fetched by including the customer id 1XXX8 into the HTTP POST
  request to jumptap.com, i.e. Millennial Media:</p> <p>
  <span>HTTP/1.1 200
OK</span></p> <p>
  <span>Cache-Control:
private</span></p> <p>
  <span>Content-Type:
text/html</span></p> <p>
  <span>Date: Thu, XX
    Mar 2014 XX:XX:XX GMT</span></p> <p>
  <span>Server:
Microsoft-IIS/7.5</span></p> <p>
  <span>ServerName:
    P-ADS-OR-WEBC #17</span></p> <p>
  <span>X-AspNet-Version:
4.0.30319</span></p> <p>
  <span>X-Powered-By:
ASP.NET</span></p> <p>
  <span>X-ReqTime:
475</span></p> <p>
  <span>X-Stats:
geo-0;rcf88626-255;rcf75152-218</span></p> <p>
  <span>Content-Length:
2537</span></p> <p>
  <span>Connection:
keep-alive</span></p> <p>
  <span>GET
    /img/1547/1XXX2.jpg HTTP/1.1</span></p> <p>
  <span>Host:
<b>i.jumptap.com</b></span></p> <p>
  <span>Connection:
keep-alive</span></p> <p>
  <span>Referer:
http://bar/</span></p> <p>
  <span>X-Requested-With:
com.rovio.angrybirds</span></p> <p>
  <span>User-Agent:
    Mozilla/5.0 (Linux; U; Android 4.4.2; en-us; Ascend Y300
    Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0
    Mobile Safari/534.30</span></p> <p>
  <span>Accept-Encoding:
gzip,deflate</span></p> <p>
  <span>Accept-Language:
en-US</span></p> <p>
  <span>Accept-Charset:
    utf-8, iso-8859-1, utf-16, *;q=0.7</span></p> <p>
  <span>{&quot;type&quot;:&quot;ip&quot;,&quot;Id&quot;:&quot;8XXX5&quot;,&quot;width&quot;:320,&quot;height&quot;:50,&quot;cookie&quot;:[],&quot;data&quot;:[{&quot;data&quot;:&quot;&lt;!--
    AdPlacement :
    banner_ingame_burstly&quot;,&quot;adType&quot;:{&quot;width&quot;:320,
    &quot;height&quot;:50, &quot;extendedProperty&quot;:2064
    },&quot;dataType&quot;:1, &quot;textAdType&quot;:0,
    &quot;destType&quot;:10, &quot;destParms&quot;:&quot;&quot;,
    &quot;cookie&quot;:[{&quot;name&quot;:&quot;...&quot;,
    &quot;value&quot;:&quot;ref=...&amp;cr<b>1XXX8</b>=4,1&amp;cr1XXX8=2,1&quot;,
    &quot;path&quot;:&quot;/&quot;,
    &quot;domain&quot;:&quot;neptune.appads.com&quot;,
    &quot;expires&quot;:&quot;Sat, 0X Apr 2014 0X:XX:XX GMT&quot;,
    &quot;maxage&quot;:2XXX0}, {&quot;name&quot;:&quot;vw&quot;,...,
    &quot;crid&quot;:7XXX2, &quot;aoid&quot;:3XXX3,
    &quot;iTrkData&quot;:&quot;...&quot;,
&quot;clkData&quot;:&quot;...&quot;,&quot;feedName&quot;:&quot;Nexage&quot;}]}</span></p>
  <p>In this pcap, the advertisement is retrieved from jumptap.com.
  We can use the same customer id 1XXXX8 to easily track the PCap
  of different ad libraries.</p> <p>3. For example, in another PCap
  from turn.com, customer id remains the same:</p> <p>
  <span>HTTP/1.1 200
OK</span></p> <p>
  <span>Cache-Control:
private</span></p> <p>
  <span>Content-Type:
text/html</span></p> <p>
  <span>Date: Thu, 06
    Mar 2014 07:30:54 GMT</span></p> <p>
  <span>Server:
Microsoft-IIS/7.5</span></p> <p>
  <span>ServerName:
    P-ADS-OR-WEBB #6</span></p> <p>
  <span>X-AspNet-Version:
4.0.30319</span></p> <p>
  <span>X-Powered-By:
ASP.NET</span></p> <p>
  <span>X-ReqTime:
273</span></p> <p>
  <span>X-Stats:
geo-0;rcf88626-272</span></p> <p>
  <span>Content-Length:
4714</span></p> <p>
  <span>Connection:
keep-alive</span></p> <p>
  <span>GET
/server/ads.js?pub=24</span></p> <p>
  <span>PvctPFq&amp;acp=0.51
HTTP/1.1</span></p> <p>
  <span>Host:
ad.turn.com</span></p> <p>
  <span>Connection:
keep-alive</span></p> <p>
  <span>Referer:
http://bar/</span></p> <p>
  <span>Accept:
*/*</span></p> <p>
  <span>X-Requested-With:
com.rovio.angrybirds</span></p> <p>
  <span>User-Agent:
    Mozilla/5.0 (Linux; U; Android 4.4.2; en-us; Ascend Y300
    Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0
    Mobile Safari/534.30</span></p> <p>
  <span>Accept-Encoding:
gzip,deflate</span></p> <p>
  <span>Accept-Language:
en-US</span></p> <p>
  <span>Accept-Charset:
    utf-8, iso-8859-1, utf-16, *;q=0.7</span></p> <p>
  <span>{&quot;type&quot;:&quot;ip&quot;,&quot;Id&quot;:&quot;0...b&quot;,&quot;width&quot;:320,&quot;height&quot;:50,&quot;cookie&quot;:[],&quot;data&quot;:[{&quot;data&quot;:&quot;&lt;!--
    AdPlacement : banner_ingame_burstly --&gt;
    \&quot;http://burstly.ads.nexage.com:80...&quot;
    destParms&quot;:&quot;&quot;,
    &quot;cookie&quot;:[{&quot;name&quot;:&quot;f...g&quot;,
    &quot;value&quot;:&quot;ref=1...0&amp;cr<b>1XXXX8</b>=k,1&amp;cr...8=i,
    1&quot;,&quot;path&quot;:&quot;/&quot;,
    &quot;domain&quot;:&quot;neptune.appads.com&quot;,
    &quot;expires&quot;:&quot;Sat, 0X Apr 2014 0X:XX:XX</span></p> <h3>
  <b>How is the personal information shared?</b></h3> <p>We also
  researched the source code of the Burstly (ad mediation platform)
  to trace the method calls for the information sharing. First in
  com/burstly/lib/conveniencelayer/BurstlyAnimated Banner.java, when
  Angry Birds tries to initialize the connection with Burstly,
  <i>initNewAnimatedBanner()</i> is called as follows:</p> <p>
  <span>this.initNewAnimatedBanner
    (arg7.getActivity(), arg8, arg9, arg10, arg11);</span></p> <p>
  <span>Inside
    initNewAnimatedBanner(), it instantiates the BurstlyView object
    by calling:</span></p> <p>
  <span>BurstlyView v0
    = new BurstlyView(((Context)arg3));</span></p> <p>
  <span>v0.setZoneId(arg6);</span></p>
  <p>Before the ZoneId is set, the <i>initializeView()</i> method is
  called in the constructor of BurstlyView. Furthermore, inside the
  <i>initializeView()</i> method, we found the following:</p> <p>
  <span>new
BurstlyViewConfigurator(this).configure(this.mAttributes);</span></p>
  <p>Finally in the <i>BurstlyViewConfigurator.configure()</i>
  method, it sets a series of parameters:</p> <p>
  <span>this.extractAndApplyBurstlyViewId();</span></p> <p>
  <span>this.extractAndApplyCrParams();</span></p> <p>
  <span>this.extractAndApplyDefaultSessionLife();</span></p> <p>
  <span>this.extractAndApplyPublisherId();</span></p> <p>
  <span>this.extractAndApplyPubTargetingParams();</span></p> <p>
  <span>this.extractAndApplyUseCachedResponse();</span></p> <p>
  <span>this.extractAndApplyZoneId();</span></p>
  <p>These method calls are to retrieve information from
  burstly.com. For example, in the extractAndApplyCrParams() method,
  it retrieves parameters from burstly.com and stores them in the
  BurstlyView object:</p> <p>
  <span>String v0 =
    this.mAttributes.getAttributeValue(&quot;http://burstly.com/lib/ui/schema&quot;,
&quot;crParams&quot;);</span></p> <p>
  <span>if(v0 != null)
{</span></p> <p>
  <span>BurstlyViewConfigurator.LOG.logDebug(&quot;BurstlyViewConfigurator&quot;,
    &quot;Setting CR params to: {0}&quot;, new
Object[]{v0});</span></p> <p>
  <span>this.mBurstlyView.setCrParms(v0);</span></p> <p>
  <span>}</span></p>
  <p>The key <i>crParms</i> is the same one used in the first PCap
  to label the values corresponding to personal information such as
  age and gender.</p> <h3>
  <b>Conclusion</b></h3> <p>In summary, Angry Birds collects users
  personal information and associates with customer id before
  storing it in the smart phone storage. Then the Burstly ad library
  embedded in Angry Birds fetches the customer id, uploads the
  corresponding personal information to the Burstly cloud, and
  transmits it to other advertising clouds. We have caught such
  traffics in the network packet captures and the corresponding code
  paths in the reversed engineered source code.</p> <p>For FireEye
  ThreatScore information on Angry Birds and more details about the
  applications behavior, FireEye Mobile Threat Prevention customers
  can access their Mobile Threat Prevention (MTP) portal.</p> </li> </ul>