JPush Away Your Privacy: A Case Study of Jiguang’s Android SDK
Our investigations into Android apps found that Chinese company Jiguang invasively monitors the activity of consumers who install apps that include their SDK. Jiguang’s SDK can collect consumers’ GPS locations, immutable device persistent identifiers, and even the names of all the apps they have installed—including when new ones are added or old ones removed. It does this collection even if the app that contains their code is not used. They send data over UDP sockets with misused cryptography, resulting in consumers’ personal data being trivially vulnerable to eavesdroppers. We observed their SDK communicating with Jiguang in 31 apps.
目前观测到的：
1.117.187.27.10 IP（贵州贵阳，中国移动） 之前可以用 safebrowsing.googleapis.com 的 SNI 成功握手（后来无法复现），并且此域名的解析结果也是此 IP。后来又在 Clash 日志中发现 s.jpush.cn 也被指向此 IP。
2.NextDNS 的内置追踪器列表中包含 jpush.cn jpush.io 及其子域名
3.端传媒安卓 APP 使用 jpush，没有看到使其使用 FCM 的方法，虽然 apk 包中有 FCM 相关 string