Showing posts with label security. Show all posts
Showing posts with label security. Show all posts

Saturday, December 6, 2014

AppNana behind the scenes: what is send with an offer?

When clicking on one of the AppNana offers from the first Appnana Offers section, when actually clicking the following is happening:

The AppNana app connects to aarki.net (to be prcecise: http://hs.aarki.net/adpick/garden), and with a lot of parameters. A lot of your personal phone information is handed out!

Here is an example of a call from my Dutch HTC phone:

http://hs.aarki.net/adpick/garden?
src=49D4B67277BAA3E4AA
&xbtn=y
&platform=android
&sdk_version=3.0
&device_platform=android/4.2.2
&device_model=HTC One X
&device_manufacturer=HTC
&device_brand=htc
&device_product=htc_europe
&uixe=6c1c1b586f671f0f101a07406f686f
&pixe=691b195466671f401314014e606869
&dixe=631b1d5a6b65194414120716696d6f61
&nixe=6b4d100f6f6816411f42034d3d6c64300a
&user_agent=Mozilla/5.0 (Linux; U; Android 4.2.2; en-nl; HTC One X Build/JDQ39) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
&app_sec_key=TfSMSG6o3wrtFGzBKhIhG33Vf60N
&advertising_id=06484d41-c02f-490f-997c-67465feae167
&tracking_limited=n
&package_name=com.appnana.android.giftcardrewards
&country_code=NL
&current_locale=en_NL

As you can see, my AppNana number n6215050 is probably somewhere encrypted in one of the uixe, pixe, dixe and/or nixe parameters.
Aarki.net is the production advertisement domain of aarki.com, a media advertisement company.
This all seems within the bounderies of the standard AppNana app  permissions.

Saturday, November 15, 2014

Is Mapiz, the creator of AppNana, safe?

Browsing to a non-existing page like http://s.mapiz.com/appjoy reveals (on 29-Oct-2014) that nginx/1.1.19 is being used. However, Nginx 1.6.2 is the current stable version.

This might make the Mapiz website possibly vulnerable.

An e-mail has been send to support@Mapiz.com at 29-10-2014 to inform them.
However, no reply was received yet.

Comments or advisories are welcome!

Tuesday, November 11, 2014

AppNana daily return is tricky!

There are restrictions to the daily Nana's; one need to earn enough points from offers and/or invitation codes to keep qualifying for the Daily Nanas.

AppNana claims a daily return to give you a daily bonus of 400 Nanas. However in an earlier post I found out that after 6 times the daily bonus won't work as such any longer; one need to have at least 4000 Nanas by the Nana offers or invite 3 friends.
Further more, the word 'daily' might not be exactly accurate here. The 'daily' reward is granted after 24 hours after the previous daily payout. So for example checking your AppNana app tonight at 11pm and tomorrow at 6am won't count as 2 daily visits! So it is rather a 24 hour countdown after the last reward rather than a daily visit. If you wait longer than 24 hours to log in, the new 24 hour countdown will start from that time on, not from your previous time expiration. To me it makes sense, but it's a little unexpected catch!