Exodus Privacy

Exodus Privacy

• Group of French hacktivists
• 6 months old non-profit organization
• Undefined number of members
• Strict legal rules
• 2 collaborations:
  • Yale Privacy Lab
  • F-Droid
• We do FLOSS

Make people aware of permanent tracking on smartphones

How we do

• Develop the εxodus privacy auditing platform
• Identify trackers by code signatures
• Statically analyze APK files

We develop a transparency tool allowing people to know what is embedded in applications.

What we call a tracker

A tracker is a piece of software meant to collect data about you or your usages.

How we detect them

Static analysis

• List Java classes embedded in the APK
• Find classes matching the tracker code signature
• Dexdump, Androguard, Gplaycli

Static analysis

Static analysis

Exodus Privacy Application

• Show the trackers in apps in your smartphone
• Lists permissions required by the apps in your smartphone
• Available on F-Droid and Google Play!

Exodify: Exodus Privacy in your browser

• Browser extension for Firefox and Chrome
• Displays the number of trackers of each application
• Quick link to submit the application for an analysis

Exodify: Exodus Privacy in your browser

What we did during the last 6 months

• We effectively exist since 11/24/2017 - first public release
• We have identified 135 trackers and analyzed +8000 applications
• We helped developers and companies like Qwant to decontaminate their applications
• We provided lot of advices/courses to developers who want to respect privacy
• We did deep audits of several applications like Baby+
• We provided statistics and datasets to journalists and labs
• We opened a REST API

Everything is free and open 🎄

We are in the press too

• MotherBoard - The Targets of Mobile Apps: Your Health, Your Ancestors, [...]
• Numerama - Lutter contre les mouchards des apps, une cause citoyenne : [...]
• The Guardian - Three quarters of Android apps track users with third party tools
• BoingBoing - Researchers craft Android app that reveals to find horrific [...]
• Le Monde - Des mouchards cachés dans vos applications pour smartphones
• Next Inpact - Rencontre avec Exodus Privacy, qui révèle les trackers [...]
• The Intercept - Staggering Variety of Clandestine Trackers Found in Popular [...]
• +8000 articles in +20 languages during the last 6 months

We are known by the CNIL

On Feb. 14th 2018 we meet CNIL people in their office in Paris.

The CNIL will use εxodus for preliminary investigations.

Exchanges were very intersting in both sides and their interest is promising.

Even french TV knows about us

We made, for France2, a TV report about Waze application and all the "unknown leaks" of GPS data.
The report was broacasted on Feb. 24th 2018

The replay can be found on Youtube.

What's next

• Compare Google Play and F-Droid versions of a same application
• Improve static analysis by integrating LibScout
• Federate actors in the field of privacy protection
• εxodus will be used by Yale during cybersecurity classes
• Create videos and podcasts explaining tracking on mobile
• Animate a Facebook page and a Youtube channel

What we need