Tracking is one of the most profitable parts of the advertising business. The idea is that the more you know about a particular person's interests and habits, the better they will respond to ads.
Researchers have discovered a new tracking system used by Meta and Russia-based Yandex to track users on the Internet.
The tracking was specifically designed for a user's web browsing on Android, using any of the installed mobile browsers, and the use of apps, such as Facebook or Instagram.
A sandbox on Android protects data from being shared with apps or services outside that sandbox. This allowed Meta and Yandex to bypass security and privacy protections on devices.
Both Android and iOS implement various security and privacy features. In addition to sandboxing, partitioning is also used to separate data and make it inaccessible to processes that shouldn't "see" it.
The method used by the two companies requires two things. First, the user must have at least one of the Meta or Yandex applications installed on their device.
Second, users must visit websites that use Meta or Yandex tracking pixels. Millions of websites do.
Both companies send web requests to local Android ports when users visit websites with the tracking pixel. Native apps use the same ports, effectively bypassing the barriers to preventing this type of tracking.
How researchers describe monitoring:
“The Android operating system allows any installed application with INTERNET permission to open a listening socket on the loopback interface (127.0.0.1). Browsers running on the same device also have access to this interface, but without the user’s consent. This allows JavaScript embedded in web pages to communicate with native Android applications and share identifiers and browsing habits.”
Researchers say the tracking method bypassed standard privacy protections, such as deleting cookies or using private browsing mode. Why? Because installed apps still knew the user, even if all browsing data was deleted from the mobile browser.
This way, the tracking continued unhindered as soon as the user started browsing the device again.
The researchers at Local Mess They report that Meta has been using this method since September 2024, while Yandex on the other hand appears to have been implementing it since 2017.
George is still wondering what he is doing here….
