Signs that your phone is listening to you, even when in your pocket

[iwantaskyline]

Is your mobile browser chrome? If it is and you are signed in to your google account and your desktop PC is also signed into that account it shares the history between each other.

So any searches done by your wife on your desktop PC could cause certain ads to appear on your mobile Chrome as well.

I use an ad blocker on my mobile so never noticed this myself.

[SkinnyPupp]

[Presto]

Relevant article:

How to block the ultrasonic signals you didn?t know were tracking you | Ars Technica
Dystopian corporate surveillance threats today come at us from all directions. Companies offer “always-on” devices that listen for our voice commands, and marketers follow us around the web to create personalized user profiles so they can (maybe) show us ads we’ll actually click. Now marketers have been experimenting with combining those web-based and audio approaches to track consumers in another disturbingly science fictional way: with audio signals your phone can hear, but you can’t. And though you probably have no idea that dog whistle marketing is going on, researchers are already offering ways to protect yourself.

The technology, called ultrasonic cross-device tracking, embeds high-frequency tones that are inaudible to humans in advertisements, web pages, and even physical locations like retail stores. These ultrasound “beacons” emit their audio sequences with speakers, and almost any device microphone—like those accessed by an app on a smartphone or tablet—can detect the signal and start to put together a picture of what ads you’ve seen, what sites you’ve perused, and even where you’ve been. Now that you’re sufficiently concerned, the good news is that at the Black Hat Europe security conference on Thursday, a group based at University of California, Santa Barbara will present an Android patch and a Chrome extension that give consumers more control over the transmission and receipt of ultrasonic pitches on their devices.

Beyond the abstract creep factor of ultrasonic tracking, the larger worry about the technology is that it requires giving an app the ability to listen to everything around you, says Vasilios Mavroudis, a privacy and security researcher at University College London who worked on the research being presented at Black Hat. “The bad thing is that if you’re a company that wants to provide ultrasound tracking there is no other way to do it currently, you have to use the microphone,” says Mavroudis. “So you will be what we call ‘over-privileged,’ because you don’t need access to audible sounds but you have to get them.”

This type of tracking, offered by companies like Tapad and 4Info, has hardly exploded in adoption. But it’s persisted as more third party companies develop ultrasonic tools for a range of uses, like data transmission without Wi-Fi or other connectivity. The more the technology evolves, the easier it is to use in marketing. As a result, the researchers say that their goal is to help protect users from inadvertently leaking their personal information. “There are certain serious security shortcomings that need to be addressed before the technology becomes more widely used,” says Mavroudis. “And there is a lack of transparency. Users are basically clueless about what’s going on.”

Currently, when Android or iOS do require apps to request permission to use a phone’s microphone. But most users likely aren’t aware that by granting that permission, apps that use ultrasonic tracking could access their microphone—and everything it’s picking up, not just ultrasonic frequencies—all the time, even while they’re running in the background.

The researchers’ patch adjusts Android’s permission system so that apps have to make it clear that they’re asking for permission to receive inaudible inputs. It also allows users to choose to block anything the microphone picks up on the ultrasound spectrum. The patch isn’t an official Google release, but represents the researchers’ recommendations for a step mobile operating systems can take to offer more transparency.

To block the other end of those high-pitched audio communications, the group’s Chrome extension preemptively screens websites’ audio components as they load to keep the ones that emit ultrasounds from executing, thus blocking pages from emitting them. There are a few old services that the extension can’t screen, like Flash, but overall the extension works much like an ad-blocker for ultrasonic tracking. The researchers plan to post their patch and their extension available for download after their Black Hat presentation.

Ultrasonic tracking has been evolving for the last couple of years, and it is relatively easy to deploy since it relies on basic speakers and microphones instead of specialized equipment. But from the start, the technology has encountered pushback about its privacy and security limitations. Currently there are no industry standards for legitimizing beacons or allowing them to interoperate the way there are with a protocol like Bluetooth. And ultrasonic tracking transmissions are difficult to secure because they need to happen quickly for the technology to work. Ideally the beacons would authenticate with the receiving apps each time they interact to reduce the possibility that a hacker could create phony beacons by manipulating the tones before sending them. But the beacons need to complete their transmissions in the time it takes someone to briefly check a website or pass a store, and it’s difficult to fit an authentication process into those few seconds. The researchers say they’ve already observed one type of real-world attack in which hackers replay a beacon over and over to skew analytics data or alter the reported behavior of a user. The team also developed other types of theoretical attacks that take advantage of the lack of encryption and authentication on beacons.

The Federal Trade Commission evaluated ultrasonic tracking technology at the end of 2015, and the privacy-focused non-profit Center for Democracy and Technology wrote to the agency at the time that “the best solution is increased transparency and a robust and meaningful opt-out system. If cross-device tracking companies cannot give users these types of notice and control, they should not engage in cross-device tracking.” By March the FTC had drafted a warning letter to developers about a certain brand of audio beacon that could potentially track all of a users’ television viewing without their knowledge. That company, called Silverpush, has since ceased working on ultrasonic tracking in the United States, though the firm said at the time that its decision to drop the tech wasn’t related to the FTC probe.

More recently, two lawsuits filed this fall—each about the Android app of an NBA team—allege that the apps activated user microphones improperly to listen for beacons, capturing lots of other audio in the process without user knowledge. Two defendants in those lawsuits, YinzCam and Signal360, both told WIRED that they aren’t beacon developers themselves and don’t collect or store any audio in the spectrum that’s audible to humans.

But the researchers presenting at Black Hat argue that controversy over just how much audio ultrasonic tracking tools collect is all the more reason to create industry standards, so that consumers don’t need to rely on companies to make privacy-minded choices independently. “I don’t believe that companies are malicious, but currently the way this whole thing is implemented seems very shady to users,” says Mavroudis. Once there are standards in place, the researchers propose that mobile operating systems like Android and iOS could provide application program interfaces that restrict microphone access so ultrasonic tracking apps can only receive relevant data, instead of everything the microphone is picking up. “Then we get rid of this overprivileged problem where apps need to have access to the microphone, because they will just need to have access to this API,” Mavroudis says.

For anyone who’s not waiting for companies to rein in what kinds of audio they collect to track us, however, the UCSB and UCL researchers software offers a temporary fix. And that may be more appealing than the notion of your phone talking to advertisers behind your back—or beyond your audible spectrum.

[Eff-1]

I'm not as close to FB advertising products as I used to be, but to my knowledge FB doesn't yet sell to advertisers anything along the lines of "voice ads". If it fact this is happening, I would imagine FB would be actively selling this product. Unless it's still a beta being offered to select advertisers. For something like that, they could charge a significant premium over the usual rates.

For what it's worth, I feel like i've had this happen to me before too. I talk about something, and suddenly I see an ad on my FB news feed. I always assumed coincidence, but you never know these days...

[StylinRed]

Originally Posted by Presto

Relevant article:

Mind literally blown

[coneZONE]

Ok this is pretty weird. Granted that I work in an automotive shop and listen to Chinese music and other North American pop etc, I just noticed on my phone Chrome browser, it showed a Chinese Lexus ad on the RS site, and a Chinese Telus ad. Yet I never have searched (especially not in Chinese) for phone plans or new cars lol

[MeowMeow]

Originally Posted by cone275

Ok this is pretty weird. Granted that I work in an automotive shop and listen to Chinese music and other North American pop etc, I just noticed on my phone Chrome browser, it showed a Chinese Lexus ad on the RS site, and a Chinese Telus ad. Yet I never have searched (especially not in Chinese) for phone plans or new cars lol

I've been noticing a lot of Chinese advertisements too (even on rs)
.....but I'm not Chinese lol

[Marco911]

Originally Posted by SkinnyPupp

It wasn't facebook it was google. My facebook ad settings are so locked down, the ads and suggestions I get are actually ridiculous

Anyway, I'm going to enable google ad tracking, just to see what it looks like. Enabling EVERYTHING

Even if you're not on facebook, their ads can appear outside the app. If you're not logged out of your FB account, FB tracks your movements on other web pages, and can deliver content specific ads.

[SkinnyPupp]

Originally Posted by Marco911

Even if you're not on facebook, their ads can appear outside the app. If you're not logged out of your FB account, FB tracks your movements on other web pages, and can deliver content specific ads.

Only if those sites are running their code though. I saw this banner on sites I know are only running Google code

Unless they're buying ad inventory from Google? Which I doubt, they have plenty of their own

[Hondaracer]

So here's some fucked up shit.. (and yea 4chan I know)

So I'm walking around metro to look at appliances, went from bestbuy, to sears, to the bay. I was taking pictures of relevant models and discussing washer/dryer in my iMessage but I never once searched anything In safari

While I'm waiting for the sales associate in the bay I open safari and look at the pop up ad at the bottom of the page:



And the ad for sears none the less! I had wifi turned off so it's not like it connected to sears wifi or anything either..

[Armind]

So I was out late on Sunday night, drank but didn't drive.

4 instagram accounts about driving services followed me overnight lol

[Presto]

Probably, Location Service is what gave you away.

[underscore]

If it's only done it with one thing, it's likely a fluke. I know you said your wife had never heard of Keds before, but doesn't that make it more likely that she looked them up in the time between your conversation and the time you saw the ads?

[SkinnyPupp]

Originally Posted by underscore

If it's only done it with one thing, it's likely a fluke. I know you said your wife had never heard of Keds before, but doesn't that make it more likely that she looked them up in the time between your conversation and the time you saw the ads?

Nope, for one it was later that same day. Second her phone would have been on a different network from mine. If they're going to retarget her, it would be on her phone, not my PC. Third, our accounts aren't connected in any way. Although I may have logged onto her phone with my google account once to install an app, that would be long since removed.

[SkinnyPupp]

YouTube

[nsmb]

recently some recommended videos from youtube have been about topics i had discussed with the wife the night before, and even videos relating to a course i had to take for work... i mean come on..
anyone else experience this?

[asian_XL]

how can I disable google showing me ladyboy ad all the time? I keep getting it on Chrome at work.

[donk.]

Originally Posted by asian_XL

how can I disable google showing me ladyboy ad all the time? I keep getting it on Chrome at work.

quit lookin up vacations to vietnam man

[Mr.HappySilp]

Doesn't seem to affect me. Or maybe I just don't care enough for ads. I don't even bother reading or looking at them lo.

[coneZONE]

Not relating to ads but i think Google Maps listens too...
If i even just mention an address before looking it up on the app, like just an address i've never been to, be it a house or business, it would autocomplete the suggestion address once I've typed two digits of the building number it

[Ulic Qel-Droma]

we live in a super-deterministic world. that is all that needs to be known to understand what is happening.

[bcrdukes]

Get a dumb phone.

[Mr.HappySilp]

Originally Posted by bcrdukes

Get a dumb phone.

[bcrdukes]

You laugh now...
https://www.nokia.com/en_int/phones/nokia-3310

[welfare]

Metadata is big business.
Companies buy and sell people's every tracked move. Have been for quite some time.
It's funny, I was just watching a more recent Snowden interview last night. But on cointel, blm, and operation mk ultra.

I didn't read all of presto's posted article but I believe the gyst of it is that any device with a voice activated command is technically always listening for it's operational command.