AI

PIN AI Launches Mobile App Letting You Make Your Own Personalized, Private AI Model (venturebeat.com) 13

An anonymous reader quotes a report from VentureBeat: A new startup PIN AI (not to be confused with the poorly reviewed hardware device the AI Pin by Humane) has emerged from stealth to launch its first mobile app, which lets a user select an underlying open-source AI model that runs directly on their smartphone (iOS/Apple iPhone and Google Android supported) and remains private and totally customized to their preferences. Built with a decentralized infrastructure that prioritizes privacy, PIN AI aims to challenge big tech's dominance over user data by ensuring that personal AI serves individuals -- not corporate interests. Founded by AI and blockchain experts from Columbia, MIT and Stanford, PIN AI is led by Davide Crapis, Ben Wu and Bill Sun, who bring deep experience in AI research, large-scale data infrastructure and blockchain security. [...]

PIN AI introduces an alternative to centralized AI models that collect and monetize user data. Unlike cloud-based AI controlled by large tech firms, PIN AI's personal AI runs locally on user devices, allowing for secure, customized AI experiences without third-party surveillance. At the heart of PIN AI is a user-controlled data bank, which enables individuals to store and manage their personal information while allowing developers access to anonymized, multi-category insights -- ranging from shopping habits to investment strategies. This approach ensures that AI-powered services can benefit from high-quality contextual data without compromising user privacy. [...] The new mobile app launched in the U.S. and multiple regions also includes key features such as:

- The "God model" (guardian of data): Helps users track how well their AI understands them, ensuring it aligns with their preferences.
- Ask PIN AI: A personalized AI assistant capable of handling tasks like financial planning, travel coordination and product recommendations.
- Open-source integrations: Users can connect apps like Gmail, social media platforms and financial services to their personal AI, training it to better serve them without exposing data to third parties.
- "With our app, you have a personal AI that is your model," Crapis added. "You own the weights, and it's completely private, with privacy-preserving fine-tuning."
Davide Crapis, co-founder of PIN AI, told VentureBeat that the app currently supports several open-source AI models, including small versions of DeepSeek and Meta's Llama. "With our app, you have a personal AI that is your model," Crapis added. "You own the weights, and it's completely private, with privacy-preserving fine-tuning."

You can sign up for early access to the PIN AI app here.
Bug

Final Fantasy iOS Game Shuts Down Over Unfixable Bug (theverge.com) 37

The Verge's Jay Peters reports: Square Enix has shut down the iOS version of Final Fantasy Crystal Chronicles and removed it from the App Store following an unfixable bug that blocked people from accessing content they had paid for. [...] The company says that if you made in-app purchases in January 2024 or later, you're eligible to request a refund by contacting Apple Support. Square Enix says that Final Fantasy Crystal Chronicles will continue to be supported on other platforms. The game is also available on Android, PlayStation, and Nintendo Switch. "The issue is due to changes made to the in-app purchases model," Square Enix says in a post. "Further investigation revealed that we are unable to completely fix the bug and implement the new changes, making it unlikely to resume service for the game." Square Enix says it started receiving reports on January 24th about the issue, which "extends to the full paid version of the game."
Iphone

Apple Fixes Zero-Day Exploited In 'Extremely Sophisticated' Attacks (bleepingcomputer.com) 8

Apple has released emergency security updates for iOS 18.3.1 and iPadOS 18.3.1 to patch a zero-day vulnerability (CVE-2025-24200) that was exploited in "extremely sophisticated," targeted attacks. The flaw, which allowed a physical attack to disable USB Restricted Mode on locked devices, was discovered by Citizen Lab and may have been used in spyware campaigns; users are strongly advised to install the update immediately. BleepingComputer reports: USB Restricted Mode is a security feature (introduced almost seven years ago in iOS 11.4.1) that blocks USB accessories from creating a data connection if the device has been locked for over an hour. This feature is designed to block forensic software like Graykey and Cellebrite (commonly used by law enforcement) from extracting data from locked iOS devices.

In November, Apple introduced another security feature (dubbed "inactivity reboot") that automatically restarts iPhones after long idle times to re-encrypt data and make it harder to extract by forensic software. The zero-day vulnerability (tracked as CVE-2025-24200 and reported by Citizen Lab's Bill Marczak) patched today by Apple is an authorization issue addressed in iOS 18.3.1 and iPadOS 18.3.1 with improved state management.

The list of devices this zero-day impacts includes: - iPhone XS and later,
- iPad Pro 13-inch, iPad Pro 12.9-inch 3rd generation and later, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 7th generation and later, and iPad mini 5th generation and later

AI

DeepSeek IOS App Sends Data Unencrypted To ByteDance-Controlled Servers (arstechnica.com) 68

An anonymous Slashdot reader quotes a new article from Ars Technica: On Thursday, mobile security company NowSecure reported that [DeepSeek] sends sensitive data over unencrypted channels, making the data readable to anyone who can monitor the traffic. More sophisticated attackers could also tamper with the data while it's in transit. Apple strongly encourages iPhone and iPad developers to enforce encryption of data sent over the wire using ATS (App Transport Security). For unknown reasons, that protection is globally disabled in the app, NowSecure said. What's more, the data is sent to servers that are controlled by ByteDance, the Chinese company that owns TikTok...

[DeepSeek] is "not equipped or willing to provide basic security protections of your data and identity," NowSecure co-founder Andrew Hoog told Ars. "There are fundamental security practices that are not being observed, either intentionally or unintentionally. In the end, it puts your and your company's data and identity at risk...." This data, along with a mix of other encrypted information, is sent to DeepSeek over infrastructure provided by Volcengine a cloud platform developed by ByteDance. While the IP address the app connects to geo-locates to the US and is owned by US-based telecom Level 3 Communications, the DeepSeek privacy policy makes clear that the company "store[s] the data we collect in secure servers located in the People's Republic of China...."

US lawmakers began pushing to immediately ban DeepSeek from all government devices, citing national security concerns that the Chinese Communist Party may have built a backdoor into the service to access Americans' sensitive private data. If passed, DeepSeek could be banned within 60 days.

Security

First OCR Spyware Breaches Both Apple and Google App Stores To Steal Crypto Wallet Phrases (securelist.com) 24

Kaspersky researchers have discovered malware hiding in both Google Play and Apple's App Store that uses optical character recognition to steal cryptocurrency wallet recovery phrases from users' photo galleries. Dubbed "SparkCat" by security firm ESET, the malware was embedded in several messaging and food delivery apps, with the infected Google Play apps accumulating over 242,000 downloads combined.

This marks the first known instance of such OCR-based spyware making it into Apple's App Store. The malware, active since March 2024, masquerades as an analytics SDK called "Spark" and leverages Google's ML Kit library to scan users' photos for wallet recovery phrases in multiple languages. It requests gallery access under the guise of allowing users to attach images to support chat messages. When granted access, it searches for specific keywords related to crypto wallets and uploads matching images to attacker-controlled servers.

The researchers found both Android and iOS variants using similar techniques, with the iOS version being particularly notable as it circumvented Apple's typically stringent app review process. The malware's creators appear to be Chinese-speaking actors based on code comments and server error messages, though definitive attribution remains unclear.
China

China Weighs Probe Into Apple's App Store Fees, Practices (cnbctv18.com) 7

China's antitrust watchdog is laying the groundwork for a potential probe into Apple's policies and the fees it charges app developers, part of a broader push by Beijing that risks becoming another flashpoint in the country's trade war with the US. From a report: The State Administration for Market Regulation is examining Apple's policies, which include taking a cut of as much as 30% on in-app spending and barring external payment services and stores, people familiar with the matter said. Agency officials have spoken with Apple executives and app developers since last year, said the people, who asked for anonymity to discuss sensitive moves.

The conversations stem from long-running disputes between Apple and developers such as Tencent and ByteDance over iOS store policies -- a source of tension between the US company and regulators worldwide. While Beijing has since 2024 targeted the practices of US tech firms from Nvidia to most recently Alphabet's Google, regulators may not formally move against Apple if the current conversations go well.

Iphone

IPhones and Some Android Phones Will Support Starlink Direct-to-Cell Coverage in US (yahoo.com) 30

"iPhone devices are now eligible to test SpaceX-owned Starlink's direct-to-cell capability," Reuters reported this week, citing an announcement from T-Mobile: T-Mobile and Elon Musk's SpaceX are currently testing the Starlink cell network on a trial basis after receiving approval from the Federal Communications Commission in November last year. The trial offers 'text via satellite', while voice and data features will be added in the future, according to the T-Mobile website. T-Mobile initially only listed a few Android smartphones as eligible devices to test the network, but has now added iPhone devices with the latest iOS 18.3 software update.
The next day stock prices fell for several direct-to-smartphone satellite companies, reports SpaceNews: Shares in Globalstar, which enables connectivity beyond the reach of cellular towers on the latest iPhones via a far-reaching partnership with Apple, closed down nearly 18% the following day. Constellation developer AST SpaceMobile slipped 12%. Canada's MDA, which is building at least 17 satellites for Globalstar after Apple agreed to cover most of the costs to replenish the constellation, also saw its shares fall more than 9%...

"Combined, today's price action in Globalstar and satellite manufacturer MDA suggest a real investor fear that SpaceX could disintermediate the Apple-Globalstar partnership," said Adam Rhodes, a senior telecoms analyst at Octus. "However, it appears to us that there is room for both services. Based on the information we have seen, we do not anticipate that Apple views the T-Mobile-Starlink service as a replacement for the Globalstar MSS network, but rather it is choosing to enable the added feature on its T-Mobile phones...." B. Riley analyst Mike Crawford noted that Apple's two binding contracts with Globalstar extend well into the next decade, ensuring both capital expenditure (capex) and recurring service revenues.

Thanks to Slashdot reader jjslash for sharing the news.
Displays

The 25-Year Success Story of SereneScreen (pcgamer.com) 24

A recent video from retro tech YouTuber Clint "LGR" Basinger takes a deep dive into the history of the SereneScreen Marine Aquarium, exploring how former Air Force pilot Jim Sachs transformed a lackluster Windows 95 screensaver into a 25-year digital phenomenon. PC Gamer reports: The story centers on Jim Sachs, a man with one of those "they don't make this type of guy anymore" life stories so common to '80s and '90s computing, one Sachs recounted to the website AmigaLove back in 2020. After a six-year career in the US Air Force flying C-141 Starlifters, Sachs taught himself programming and digital art and began creating games for Commodore 64 and Amiga computers. From his first game, Saucer Attack, to later efforts like Defender of the Crown or his large portfolio of promotional and commissioned pieces, Sach's pixel art remains gorgeous and impressive to this day, and he seems to be a bit of a legend among Commodore enthusiasts.

It's with this background in games and digital art that Sachs looked at Microsoft's simple aquarium-themed screensaver for Windows 95 and 98 and thought he could do better. "Microsoft had an aquarium that they gave away with Windows where it was just bitmaps of fish being dragged across the screen," Sachs told the Matt Chat podcast back in 2015. "And they had that for like, three or four years. And I thought, I've given them enough time, I'm taking them to market. I'm gonna do something which will just blow that away."

Using reference photographs of real aquariums -- Sachs thanked a specific pet shop that's still around in an early version of his website" -- Sachs created the 3D art by hand and programmed the screensaver in C++, releasing the initial version in July 2000. Even looking at it all these years later, the first iteration of the SereneScreen Marine Aquarium is pretty gorgeous, and it has the added charm of being such a distinctly Y2K, nostalgic throwback.

The standalone screensaver sold well, but then things came full circle with Microsoft licensing a version of the Marine Aquarium for the Windows XP Plus Pack and later standard releases of the OS. Since that time, the Marine Aquarium has continued to see new releases, and a section on the SereneScreen website keeps track of its various appearances in the background of movies and TV shows like Law and Order. Over on the SereneScreen website, you can purchase a real time, 3D-accelerated version of the Marine Aquarium for Mac, iOS, Android, and the original Windows. Echoing the Windows XP deal, Roku actually licensed this 3.0 version for its TVs, bringing it to a new generation of users.

EU

Epic Games To Cover Developer iOS Fees (theverge.com) 9

Epic Games is expanding its mobile app store to include nearly 20 third-party games on Android and EU iOS, launching a free games program, and temporarily covering Apple's Core Technology Fee for participating developers to counter platform restrictions. "Our aim here isn't just to launch a bunch of different stores in different places, but to build a single, cross-platform store in which, within the era of multi-platform games, if you buy a game or digital items in one place, you have the ability to own them everywhere," Epic CEO Tim Sweeney told reporters during a press briefing. The Verge reports: Under the program, Epic will offer new free games in the store each month before eventually switching to a weekly schedule. However, the games aren't actually in the store yet -- Epic said on Thursday that it "ran into a few bugs that we're working through now" and "we'll provide an update once the games are live and ready to play!"

To sweeten the deal for developers that participate in the free games program on iOS, Epic will help defray the cost of using third-party marketplaces. For one year, it will pay these developers' Core Technology Fee (CTF): a 50 euro cent fee levied on every install of an iOS app that uses third-party stores after it exceeds 1 million annual downloads. (Apple gives developers with less than 10 million euros in global revenue a three-year on-ramp.) [...] Epic writes in its blog post that covering the fee "is not financially viable for every third party app store or for Epic long term, but we'll do it while the European Commission investigates Apple's non-compliance with the law."

United Kingdom

UK Watchdog Targets Apple, Google Mobile Ecosystems With New Digital Market Powers (apnews.com) 21

Britain's competition watchdog launched investigations into Apple and Google's mobile ecosystems on Thursday under new powers to tackle digital market abuses that took effect this year. The Competition and Markets Authority will examine whether the tech giants' control over operating systems, app stores and browsers constitutes "strategic market status" requiring regulatory intervention.

The probe will focus on potential barriers to competition, preferential treatment of their own apps, and whether developers face unfair terms for app distribution. The regulator could force changes including mandatory access to key mobile functions or allowing users to download apps outside official stores.
Technology

Calm Tech Certification 'Rewards' Less Distracting Tech (ieee.org) 11

An anonymous reader quotes a report from IEEE Spectrum: [Amber Case is a speaker and author of Calm Technology.] Case's book, inspired by the work of Xerox PARC researchers Mark Weiser and John Seely Brown, outlines eight principles for calm technology; examples include the idea that technology "should require the smallest possible amount of attention" while in use, and that it "should work even when it fails." The book's ideas gained the attention of major technology companies, including Microsoft and Amazon, and Case gave talks at TED and the Thinking Digital Conference, among others. "But that wasn't enough," says Case. While her ideas received plenty of interest, she noticed that interest didn't translate to concrete action. Companies designing new products were unclear on what was right, or wrong, and uncertain about how they might put calm technology ideals into practice.

So, Case decided on a new approach. She founded the Calm Tech Institute in May 2024 to develop and promote a Calm Tech certification. "A standard is a good way of rewarding that behavior," says Case. The certification includes 81 points that span six categories: attention, periphery, durability, light, sound, and materials. Some of the certification's specifications are quite stringent. It outlines minimum standards for user interface (UI) design, such as consistent use of icons and font typography, asks that all but the "most crucial" notifications be turned off by default, and requires an instruction booklet with a list of replacements and compatible parts.

The first handful of devices that earned the Calm Tech certification were announced at, or just before, CES 2025. This first batch included, for example, the reMarkable Paper Pro. Released on September 4, 2024, the Paper Pro looks like an iPad and has a color eInk display, but it's tightly focused on writing and organizing notes with the tablet's included stylus. ReMarkable purposefully constrains the device's features to maintain a distraction-free experience. Though it can sync notes online, the Paper Pro doesn't have an app store, a web browser, or widgets. It doesn't even display the time. [...]

Another early adopter was Mui Labs, creator of the Mui Board, a smart home device that looks like a piece of finely finished decorative wood but, when touched, illuminates to reveal a smart home interface. [...] Several other devices earned certification in late 2024. These include the AirThings View Plus, an air quality monitor with a simple eInk display that I highlighted during the 2021 wildfire season; the Daylight Computer, a portable PC with an eInk display and custom OS meant to reduce distractions; and Unpluq, a physical dongle that can lock apps on Android and iOS devices until the dongle is moved close to the device.
Calm Tech Institute's certification is not yet publicly available, though it does hope to have it published "soon," says Case.

Spectrum notes that Calm is "also exploring research into calm technology and working with neuroscientists to study the 'cognitive need for dimensionality and texture' in user interfaces."
Social Networks

'Decentralized Social Media Is the Only Alternative To the Tech Oligarchy' (404media.co) 170

An anonymous reader quotes an op-ed from 404 Media's Jason Koebler: If it wasn't already obvious, the last 72 hours have made it crystal clear that it is urgent to build and mainstream alternative, decentralized social media platforms that are resistant to government censorship and control, are not owned by oligarchs and dominated by their algorithms, and in which users own their follower list and can port it elsewhere easily and without restriction. [...] Mastodon's ActivityPub and Bluesky's AT.Protocol have provided the base technology layer to make this possible, and have laid important groundwork over the last few years to decorporatize and decentralize the social internet.

The problem with decentralized social media platforms thus far is that their user base is minuscule compared to platforms like TikTok, Facebook, and Instagram, meaning the cultural and political influence has lagged behind them. You also cannot directly monetize an audience on Bluesky or Mastodon -- which, to be clear, is a feature, not a bug -- but also means that the value proposition for an influencer who makes money through the TikTok creator program or a small business that makes money selling chewing gum on TikTok shop or a clothes brand that has figured out how to arbitrage Instagram ads to sell flannel shirts is not exactly clear. I am not advocating for decentralized social media to implement ads and creator payment programs. I'm just saying that many TikTok influencers were directing their collective hundreds of millions of fans to follow them to Instagram or YouTube, not a decentralized alternative.

This doesn't mean that the fediverse or that a decentralized Instagram or TikTok competitor that runs on the AT.Protocol is doomed. But there is a lot of work to do. There is development work that needs to be done (and is being done) to make decentralized protocols easier to join and use and more interoperable with each other. And there is a massive education and recruitment challenge required to get the masses to not just try out decentralized platforms but to earnestly use them. Bluesky's growing user base and rise as a legitimately impressive platform that one can post to without feeling like it's going into the void is a massive step forward, and proof that it is possible to build thriving alternative platforms. The fact that Meta recently blocked links to a decentralized Instagram alternative shows that big tech sees these platforms, potentially, as a real threat.
"This is all to say that it is possible to build alternatives to Elon Musk's X, Mark Zuckerberg's Instagram, and whatever TikTok will become," concludes Koebler. "It is happening, and it is necessary. The richest, most powerful people in the world have all aligned themselves and their platforms with Donald Trump. But their platforms' relevance and importance doesn't necessarily have to last forever. A different way is possible, if we build it."

Further reading: 'The Tech Oligarchy Arrives' (The Atlantic)
AI

macOS Sequoia 15.3 and iOS 18.3 Enable Apple Intelligence Automatically 55

Apple's upcoming updates -- macOS Sequoia 15.3, iOS 18.3, and iPadOS 18.3 -- will enable Apple Intelligence by default on compatible devices, requiring users to manually disable it if undesired. From Apple's developer release notes: "For users new or upgrading to iOS 18.3, Apple Intelligence will be enabled automatically during iPhone onboarding. Users will have access to Apple Intelligence features after setting up their devices. To disable Apple Intelligence, users will need to navigate to the Apple Intelligence & Siri Settings pane and turn off the Apple Intelligence toggle. This will disable Apple Intelligence features on their device." MacRumors reports: With macOS Sequoia 15.1, macOS Sequoia 15.2, iOS 18.1, and iOS 18.2, Apple Intelligence was opt-in rather than opt-out, and users who wanted the feature needed to turn it on in the Settings app. Going forward, it will be enabled by default, and Mac, iPhone, and iPad users who do not want to use the feature will need to turn it off. The report notes that macOS Sequoia 15.3 introduces Genmoji, allowing Mac users to create custom emoji characters, and enhances Notification summaries with clearer indicators for AI-generated information.

Public releases of this and other software updates are expected next week, following today's release candidate versions.
United Kingdom

UK To Launch Digital Wallet For Passports, Driving Licences, and More (www.gov.uk) 49

Britain will launch a digital wallet app later this year allowing citizens to store government documents on their smartphones, UK Science Secretary Peter Kyle announced on Tuesday. The GOV.UK Wallet, available on Android and iOS, will first support veteran cards followed by driver's licenses in late 2025, with plans to eventually include passports, marriage certificates and benefit documents.

The app will use facial recognition for security. "The overflowing drawer rammed with letters from the government and hours spent on hold to get a basic appointment will soon be consigned to history," Kyle said. The Labour government aims to have all UK agencies offering digital alternatives to physical documents by 2027. Officials said users can recover their digital credentials if phones are lost, adding the system complies with existing data protection laws.
Facebook

Meta Announces a New CapCut Rival Called Edits (techcrunch.com) 16

Meta announced a new video editing app called Edits to fill the gap left by ByteDance's CapCut editor, which was temporarily removed from the App Store and Google Play Store as part of the TikTok ban. While the ban was lifted, the new app serves to capitalize on the uncertainty of TikTok's future. TechCrunch reports: Instagram head Adam Mosseri (pictured above) said on Threads that the app will launch next month on iOS, with an Android version following later. He added that the company is working with select creators to gather feedback about the app. "Today we're announcing a new app called 'Edits,' for those of you who are passionate about making videos on your phone. There's a lot going on right now, but no matter what happens, it's our job to provide the best possible tools for creators," he wrote.

Mosseri said the app will have a suite of creative tools, including a dedicated tab for inspiration, a tab for keeping track of ideas, and a high-quality camera. Plus, it will have the ability to share draft versions of creations with friends or collaborators. He added that creators would be able to see insights on how videos made through Edits are performing on Instagram after publishing. In a separate post, he emphasized that the app is "more for creators than casual video makers," which is hard to quantify in measurable terms.

IT

Canon's New Livestreaming App Doesn't Support Canon Cameras (engadget.com) 18

Canon has launched a new iOS livestreaming app that allows users to switch between three camera views -- but initially excludes support for Canon cameras. The "Live Switcher Mobile" app, compatible only with Apple devices, offers automated camera switching and streaming to platforms including YouTube, Twitch, and Facebook through RTMP protocol.

The free version supports 720p resolution with ads and watermarks, while an $18 monthly subscription unlocks 1080p quality and additional features. Canon plans to add support for its cameras in future updates, it says.

Further reading: Canon Draws Fire for Charging Subscription Fee To Use Cameras as Webcams.
AI

Apple Pulls AI-Generated Notifications For News After Generating Fake Headlines 20

An anonymous reader quotes a report from CNN: Apple is temporarily pulling its newly introduced artificial intelligence feature that summarizes news notifications after it repeatedly sent users error-filled headlines, sparking backlash from a news organization and press freedom groups. The rare reversal from the iPhone maker on its heavily marketed Apple Intelligence feature comes after the technology produced misleading or altogether false summaries of news headlines that appear almost identical to regular push notifications.

On Thursday, Apple deployed a beta software update to developers that disabled the AI feature for news and entertainment headlines, which it plans to later roll out to all users while it works to improve the AI feature. The company plans to re-enable the feature in a future update. As part of the update, the company said the Apple Intelligence summaries, which users must opt into, will more explicitly emphasize that the information has been produced by AI, signaling that it may sometimes produce inaccurate results.
Social Networks

Pixelfed, Instagram's Decentralized Competitor, Is Now On iOS and Android (engadget.com) 15

Pixelfed has launched its mobile app for iOS and Android, solidifying its position as a viable alternative to Instagram. The move also comes at a pivotal moment, as a potential Supreme Court ban on TikTok could drive users to explore other social media platforms. Pixelfed is ad-free, open source, decentralized, defaults to chronological feeds and doesn't share user data with third parties. Engadget reports: The platform launched in 2018, but was only available on the web or through third-party app clients. The Android app debuted on January 9 and the iOS app released today. Creator Daniel Supernault posted on Mastodon Monday evening that the platform had 11,000 users join over the preceding 24 hours and that more than 78,000 posts have been shared to Pixelfed to date. The platform runs on ActivityPub, the same protocol that powers several other decentralized social networks in the fediverse, such as Mastodon and Flipboard. The iOS and Android apps are available at their respective links.

Further reading: Meta Is Blocking Links to Decentralized Instagram Competitor Pixelfed
Privacy

See the Thousands of Apps Hijacked To Spy On Your Location (404media.co) 49

An anonymous reader quotes a report from 404 Media: Some of the world's most popular apps are likely being co-opted by rogue members of the advertising industry to harvest sensitive location data on a massive scale, with that data ending up with a location data company whose subsidiary has previously sold global location data to US law enforcement. The thousands of apps, included in hacked files from location data company Gravy Analytics, include everything from games likeCandy Crushand dating apps like Tinder to pregnancy tracking and religious prayer apps across both Android and iOS. Because much of the collection is occurring through the advertising ecosystem -- not code developed by the app creators themselves -- this data collection is likely happening without users' or even app developers' knowledge.

"For the first time publicly, we seem to have proof that one of the largest data brokers selling to both commercial and government clients appears to be acquiring their data from the online advertising 'bid stream,'" rather than code embedded into the apps themselves, Zach Edwards, senior threat analyst at cybersecurity firm Silent Push and who has followed the location data industry closely, tells 404 Media after reviewing some of the data. The data provides a rare glimpse inside the world of real-time bidding (RTB). Historically, location data firms paid app developers to include bundles of code that collected the location data of their users. Many companies have turned instead to sourcing location information through the advertising ecosystem, where companies bid to place ads inside apps. But a side effect is that data brokers can listen in on that process and harvest the location of peoples' mobile phones.

"This is a nightmare scenario for privacy, because not only does this data breach contain data scraped from the RTB systems, but there's some company out there acting like a global honey badger, doing whatever it pleases with every piece of data that comes its way," Edwards says. Included in the hacked Gravy data are tens of millions of mobile phone coordinates of devices inside the US, Russia, and Europe. Some of those files also reference an app next to each piece of location data. 404 Media extracted the app names and built a list of mentioned apps. The list includes dating sites Tinder and Grindr; massive games such asCandy Crush,Temple Run,Subway Surfers, andHarry Potter: Puzzles & Spells; transit app Moovit; My Period Calendar & Tracker, a period-tracking app with more than 10 million downloads; popular fitness app MyFitnessPal; social network Tumblr; Yahoo's email client; Microsoft's 365 office app; and flight tracker Flightradar24. The list also mentions multiple religious-focused apps such as Muslim prayer and Christian Bible apps, various pregnancy trackers, and many VPN apps, which some users may download, ironically, in an attempt to protect their privacy.
404 Media's full list of apps included in the data can be found here. There are also other lists available from other security researchers.

Slashdot Top Deals