Skip to content

Commit 859ce0b

Browse files
d4rkend4rken
committed
Target covert identifiers placed by analytics SDKs
See paper: > Exploring Covert Third-party Identifiers through External Storage in the Android New Era https://www.usenix.org/conference/usenixsecurity24/presentation/dong-zikan
1 parent e019885 commit 859ce0b

File tree

2 files changed

+98
-4
lines changed

2 files changed

+98
-4
lines changed

‎app/src/main/java/eu/darken/sdmse/systemcleaner/core/filter/stock/AnalyticsFilter.kt

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import eu.darken.sdmse.common.debug.logging.logTag
1818
import eu.darken.sdmse.common.files.APathLookup
1919
import eu.darken.sdmse.common.files.GatewaySwitch
2020
import eu.darken.sdmse.common.files.segs
21+
import eu.darken.sdmse.common.files.toSegs
2122
import eu.darken.sdmse.systemcleaner.core.SystemCleanerSettings
2223
import eu.darken.sdmse.systemcleaner.core.filter.BaseSystemCleanerFilter
2324
import eu.darken.sdmse.systemcleaner.core.filter.SystemCleanerFilter
@@ -68,11 +69,32 @@ class AnalyticsFilter @Inject constructor(
6869
log(TAG) { "initialized() with $config" }
6970

7071
val antiTracking = Config(
71-
areaTypes = setOf(DataArea.Type.SDCARD),
72+
areaTypes = setOf(DataArea.Type.SDCARD, DataArea.Type.PUBLIC_DATA),
7273
pfpCriteria = setOf(
7374
SegmentCriterium(segs(".tlocalcookieid"), Mode.Equal()),
7475
SegmentCriterium(segs(".INSTALLATION"), Mode.Equal()),
7576
SegmentCriterium(segs(".wps_preloaded_2.txt"), Mode.Equal()),
77+
SegmentCriterium(".UTSystemConfig/Global/Alvin2.xml".toSegs(), Mode.Equal()),
78+
SegmentCriterium(".DataStorage/ContextData.xml".toSegs(), Mode.Equal()),
79+
SegmentCriterium("com.snssdk.api.embed/cache/clientudid.dat".toSegs(), Mode.Equal()),
80+
SegmentCriterium("Tencent/ams/cache/meta.dat".toSegs(), Mode.Equal()),
81+
SegmentCriterium("com.tencent.ams/cache/meta.dat".toSegs(), Mode.Equal()),
82+
SegmentCriterium("backups/.SystemConfig/.cuid".toSegs(), Mode.Equal()),
83+
SegmentCriterium("backups/.SystemConfig/.cuid2".toSegs(), Mode.Equal()),
84+
SegmentCriterium("backups/.adiu".toSegs(), Mode.Equal()),
85+
SegmentCriterium("Mob/comm/dbs/.duid".toSegs(), Mode.Equal()),
86+
SegmentCriterium(segs(".mn_1006862472"), Mode.Equal()),
87+
SegmentCriterium(segs(".imei.txt"), Mode.Equal()),
88+
SegmentCriterium(segs(".DC4278477faeb9.txt"), Mode.Equal()),
89+
SegmentCriterium("Android/obj/.um/sysid.dat".toSegs(), Mode.Equal()),
90+
SegmentCriterium(".um/sysid.dat".toSegs(), Mode.Equal()),
91+
SegmentCriterium(".pns/.uniqueId".toSegs(), Mode.Ancestor()),
92+
SegmentCriterium(segs(".oukdtft"), Mode.Equal()),
93+
SegmentCriterium("libs/com.igexin.sdk.deviceId.db".toSegs(), Mode.Equal()),
94+
SegmentCriterium("data/.push_deviceid".toSegs(), Mode.Equal()),
95+
SegmentCriterium("msc/.2F6E2C5B63F0F83B".toSegs(), Mode.Equal()),
96+
SegmentCriterium(".lm_device/.lm_device_id".toSegs(), Mode.Equal()),
97+
SegmentCriterium("LMDevice/lm_device_id".toSegs(), Mode.Equal()),
7698
),
7799
)
78100
antiTrackingSieve = baseSieveFactory.create(antiTracking)

‎app/src/test/java/eu/darken/sdmse/systemcleaner/core/filter/stock/AnalyticsFilterTest.kt

Lines changed: 75 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package eu.darken.sdmse.systemcleaner.core.filter.stock
22

3-
import eu.darken.sdmse.common.areas.DataArea.Type
4-
import eu.darken.sdmse.common.areas.DataArea.Type.SDCARD
3+
import eu.darken.sdmse.common.areas.DataArea.Type.*
54
import eu.darken.sdmse.common.areas.currentAreas
65
import eu.darken.sdmse.systemcleaner.core.filter.SystemCleanerFilterTest
76
import eu.darken.sdmse.systemcleaner.core.sieve.BaseSieve
@@ -31,7 +30,7 @@ class AnalyticsFilterTest : SystemCleanerFilterTest() {
3130

3231
@Test fun testFilter() = runTest {
3332
mockDefaults()
34-
val areas = setOf(SDCARD, Type.PUBLIC_DATA)
33+
val areas = setOf(SDCARD, PUBLIC_DATA)
3534
areaManager.currentAreas()
3635
.filter { areas.contains(it.type) }
3736
.distinctBy { it.type }
@@ -47,6 +46,79 @@ class AnalyticsFilterTest : SystemCleanerFilterTest() {
4746
pos(SDCARD, ".INSTALLATION", Flag.File)
4847
neg(SDCARD, "wps_preloaded_2.txt", Flag.File)
4948
pos(SDCARD, ".wps_preloaded_2.txt", Flag.File)
49+
50+
// https://www.usenix.org/conference/usenixsecurity24/presentation/dong-zikan
51+
neg(SDCARD, ".UTSystemConfig", Flag.Dir)
52+
neg(SDCARD, ".UTSystemConfig/Global", Flag.Dir)
53+
pos(SDCARD, ".UTSystemConfig/Global/Alvin2.xml", Flag.File)
54+
55+
neg(SDCARD, ".DataStorage", Flag.Dir)
56+
pos(SDCARD, ".DataStorage/ContextData.xml", Flag.File)
57+
58+
neg(PUBLIC_DATA, "com.snssdk.api.embed", Flag.Dir)
59+
neg(PUBLIC_DATA, "com.snssdk.api.embed/cache", Flag.Dir)
60+
pos(PUBLIC_DATA, "com.snssdk.api.embed/cache/clientudid.dat", Flag.File)
61+
62+
neg(SDCARD, "Tencent", Flag.Dir)
63+
neg(SDCARD, "Tencent/ams", Flag.Dir)
64+
neg(SDCARD, "Tencent/ams/cache", Flag.Dir)
65+
pos(SDCARD, "Tencent/ams/cache/meta.dat", Flag.File)
66+
67+
neg(PUBLIC_DATA, "com.tencent.ams", Flag.Dir)
68+
neg(PUBLIC_DATA, "com.tencent.ams/cache", Flag.Dir)
69+
pos(PUBLIC_DATA, "com.tencent.ams/cache/meta.dat", Flag.File)
70+
71+
neg(SDCARD, "backups", Flag.Dir)
72+
neg(SDCARD, "backups/.SystemConfig", Flag.Dir)
73+
pos(SDCARD, "backups/.SystemConfig/.cuid", Flag.File)
74+
pos(SDCARD, "backups/.SystemConfig/.cuid2", Flag.File)
75+
76+
pos(SDCARD, "backups/.adiu", Flag.File)
77+
78+
neg(SDCARD, "Mob", Flag.Dir)
79+
neg(SDCARD, "Mob/comm", Flag.Dir)
80+
neg(SDCARD, "Mob/comm/dbs", Flag.Dir)
81+
pos(SDCARD, "Mob/comm/dbs/.duid", Flag.File)
82+
83+
neg(PUBLIC_DATA, ".mn", Flag.Dir)
84+
pos(PUBLIC_DATA, ".mn_1006862472", Flag.File)
85+
86+
neg(SDCARD, "imei.txt", Flag.File)
87+
pos(SDCARD, ".imei.txt", Flag.File)
88+
89+
neg(SDCARD, "DC4278477faeb9.txt", Flag.File)
90+
pos(SDCARD, ".DC4278477faeb9.txt", Flag.File)
91+
92+
neg(SDCARD, "Android/obj", Flag.Dir)
93+
neg(SDCARD, "Android/obj/.um", Flag.Dir)
94+
pos(SDCARD, "Android/obj/.um/sysid.dat", Flag.File)
95+
96+
neg(PUBLIC_DATA, ".um", Flag.Dir)
97+
neg(PUBLIC_DATA, ".um/sysid", Flag.Dir)
98+
pos(PUBLIC_DATA, ".um/sysid.dat", Flag.File)
99+
100+
neg(SDCARD, ".pns", Flag.Dir)
101+
neg(SDCARD, ".pns/.uniqueId", Flag.Dir)
102+
pos(SDCARD, ".pns/.uniqueId/file", Flag.File)
103+
104+
neg(SDCARD, "oukdtft", Flag.Dir)
105+
pos(SDCARD, ".oukdtft", Flag.Dir)
106+
107+
neg(SDCARD, "libs", Flag.Dir)
108+
pos(SDCARD, "libs/com.igexin.sdk.deviceId.db", Flag.Dir)
109+
110+
neg(SDCARD, "data", Flag.Dir)
111+
pos(SDCARD, "data/.push_deviceid", Flag.File)
112+
113+
neg(SDCARD, "msc", Flag.Dir)
114+
pos(SDCARD, "msc/.2F6E2C5B63F0F83B", Flag.File)
115+
116+
neg(SDCARD, ".lm_device", Flag.Dir)
117+
pos(SDCARD, ".lm_device/.lm_device_id", Flag.File)
118+
119+
neg(SDCARD, "LMDevice", Flag.Dir)
120+
pos(SDCARD, "LMDevice/lm_device_id", Flag.File)
121+
50122
confirm(create())
51123
}
52124

0 commit comments

Comments
 (0)