Every 3 Seconds. This Maps App Just Can't Stop Phoning Home.

A Really Good Navigation App?

Despite its size, Macau’s maze-like streets are easily a hundred times more intricate than those of neighbouring Zhuhai. I’ve been to Macau on several occasions and have had trouble navigating around using Google Maps. The location shown on Google Maps is always quite a bit off from where it actually is, which feels similar to what you get in mainland China. I was so confused and had no idea how to get around the problem. After all, Google isn’t blocked in Macau and the territory does not use the obfuscated GCJ-02 system. Just then, a friend I was with suddenly said, “Why don’t you try Amap?” I stared at the icon of Amap on my phone, lost in thought. Why? Because I had just used the very app to get around in Zhuhai, Guangdong before I crossed the border into Macau!

Amap, or AutoNavi, is the de facto monopoly in the Chinese navigation software market. It is the sole mapping provider for Apple Maps in China and also was also the provider for Google Maps on google.cn/maps until Google retired its mapping service on its China site. It is renowned for its accurate traffic light prediction (even patented) and “lane-level guidance”, both had been of real help for my life in China. Last year, I was surprised to find that it’s just as accurate in Macau, and even in Hong Kong, where Google Maps works perfectly fine and is widely used. Since Amap began allowing sign-ups in Taiwan, it has become more and more popular. Especially after the government in Taiwan banned officials from using this app, it briefly shot to the top of the App Store as the most downloaded free navigation app (it still ranks at #2 at the time of writing).

The Hidden Cost (Freaky!)

With a navigation app this good, you’d think there must be some sort of catch for the user, wouldn’t you? Well, there is, and it’s likely a much bigger catch than you’d imagine.

The Reporter, a media outlet in Taiwan specialising in in-depth reporting, released their findings on their website as well as on YouTube (in traditional Chinese). Using the same system, same route, and same network environment, they simultaneously tested Amap, Google Maps, and NaviKing (a local satnav app) while driving around in Taipei.

With mitmproxy provisioned, they were able to decrypt all the traffic and analyse data transmitted to and from these apps. The result is shocking, to say the least. In short, Amap uploaded location data with an identifiable user ID called CAID (which is explained below), once every 3 seconds on average, at almost 10 times the combined frequency of Google Maps and NaviKing!

You might think it’s only fair that Amap sends location data to its servers more frequently because it provides higher-precision navigation. But to point out the issue with Amap, we can actually set the frequency aside for a moment. The devil is in the details, specifically the data sent back by the server. In a more detailed account, The Reporter noted that, every time Google Maps or NaviKing sends location data to the server, the server returns the latest cloud-calculated route data; however, the data returned by Amap’s server is so absurdly simple that it can be pasted directly here:

{
"message": "OK",
"status": 200
}

YES! That’s freaking it! Basically, the phone keeps yelling at the server about its location and most of the time the information is “acknowledged” without further feedback. I do think the app is already freaky enough after seeing this.

Right Under Apple’s Nose: “What A Coincidence!”

But wait, there’s more! Remember the CAID we talked about earlier? Its full name is China Advertising Association Advertising ID. It’s an iOS-only attempt by the Association to keep fingerprinting Apple devices without user consent, after Apple began enforcing App Tracking Transparency for all apps (on App Store, at least). As you can tell, this is a clear violation of Apple’s rules, and Apple went as far threatening to remove such apps straight from the App Store.

In recent years, it seemed as though CAID had ceased to exist, at least as one industry website suggests, “attention toward CAID has clearly declined”, and “[…] CAID has not become the mainstream standard in the domestic mobile advertising industry”. In this case, users of Chinese apps might finally have been able to breathe a sigh of relief. However, The Reporter seems to have delivered a massive reality check: even the Taiwan versions of Amap and Baidu Search coincidentally calculated the exact same CAID and sent it back to their respective servers, even when the user hadn’t logged in or given explicit consent. Outside the test environment, it means a person’s behaviour across different apps from different companies could be linked without their knowledge. Those performing such tracking could include not only the companies themselves, but also the Advertising Alliance or even the Chinese government. Here is part of the table of CAIDs captured during their test:

(Source: The Reporter, parts of CAID omitted for better formatting and readability. See the original report for details.)

According to their test, the only way to reset the CAID is to factory reset an iPhone. Seeing this, I began searching for how the thing actually works. To my surprise, the Association actually revealed which pieces of information are used to calculate a “hash” of a device. Here is a detailed table with examples:

(Source: Technical specification for mobile Internet advertising identification - CAA)

Well, when Loupe came out, some seemed surprised by how much information can be used for fingerprinting. Now what’s different is that we have evidence of that much information actually being used for fingerprinting! And this is happening in a navigation app that, by design, requires precise location permission to work in the first place!

More Companies Involved Than You Think

I think it’s unnecessary to include screenshots of some webpages. Open https://www.china-caa.org yourself and scroll to the bottom. You’ll see a wall of logos of “会员及合作媒体”, which means “members and participating media companies”. You can find the phrase I mentioned on the left above the logos. Then, you can hover over different labels to its right to peek through different tiers of members of this association. I do want to point out some notable members:

• Major Chinese internet companies: Alibaba (owns Amap, shopping platform Taobao), ByteDance (owns TikTok), NetEase, Weibo, Baidu, Tencent (AD division)

• State-owned enterprises: China Mobile, China Unicom

• Phone/tech manufacturers: HONOR, Xiaomi, TCL, Hisense and even Qualcomm

• Foreign/international companies: P&G, Unilever, Domino’s

To be fair, there is no evidence that every company mentioned actually makes use of CAID or any other equally pervasive tracking methods, and it is very difficult to individually evaluate them unless you actually capture app traffic as The Reporter did. For example, apart from the official SDK provided by the China Advertising Association, Tencent’s DataNexus advertising platform can also calculate CAID on its own. This makes it nearly impossible to verify just by looking at privacy policies, despite the fact that the Chinese government mandates the disclosure of SDK usage there.

Stay Away From Maps?

My personal rule is “Stay far, far away from maps.”

– Raymond Chen

The Reporter revealed something interesting, not necessarily related to privacy or security. They chose a driving route that circled around various government office buildings. All of them were documented in Google Maps and NaviKing, but only one of these buildings was actually present in Amap – the Presidential Office (Traditional Chinese: 總統府), which Amap has chosen to call the “Office of the Leader of the Taiwan Region” (Simplified Chinese: “台湾地区领导人办公场所”). Oh yes, it also insists on showing the name in Simplified Chinese BTW.

I don’t even know what this article should be about at this point! I can’t stop thinking about Amap, an app I used to really like but somehow just can’t stop phoning home. Maybe sometimes it really is better to stay away from maps.

Postscript

Things I found but didn’t have the time to investigate before publishing:

• https://www.china-caa.org/uploads/downloads/digital/SDK.pdf (Simplified Chinese)

• https://gitee.com/MMAChinaSDK/MMAViewabilitySDK_iOS (MMA iOS SDK, Simplified Chinese), MMA stands for Mobile Marketing Association China

• https://msa-alliance.cn/col.jsp?id=122 (Mobile Security Alliance and its SDK, Simplified Chinese), MSA is the organisation behind OAID, a replacement for GAID/AAID in China where Google services aren’t available