Blocking Android spyware

Several models of Android mobile devices that contained firmware that collected sensitive personal data about their users and transmitted this sensitive data to third-party servers without disclosure or the users' consent.
These devices actively transmitted user and device information including the full-body of text messages, contact lists, call history with full telephone numbers, unique device identifiers including the International Mobile Subscriber Identity (IMSI) and the International Mobile Equipment Identity (IMEI).
So consider blacklisting these domains:
bigdata.adups.com (primary)
bigdata.adsunflower.com
bigdata.adfuture.cn
bigdata.advmob.cn

I've searched through my blocklists and found these 3 lists that are blocking all 4 of those domains.

  1. https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

  2. http://someonewhocares.org/hosts/hosts

  3. https://raw.githubusercontent.com/quidsup/notrack/master/trackers.txt

Well, for me those are not blocked so I posted it here. Do I need to remove the post?

Don't do that. I just wanted to help by looking up if there are blocklists that are blocking these links.

My friend connected to my network and there were requests from these domains. 4~5 requests an hour

You should probably block these domains or use the blocklists then. But i'm pretty sure you already did that.

1 Like

I can confirm @Skittels finding using the Pi-hole's standard set of lists:

pihole -q bigdata.a
::: /etc/pihole/list.0.raw.githubusercontent.com.domains (4 results)
0.0.0.0 bigdata.adfuture.cn
0.0.0.0 bigdata.adsunflower.com
0.0.0.0 bigdata.adups.com
0.0.0.0 bigdata.advmob.cn

::: /etc/pihole/list.1.mirror1.malwaredomains.com.domains (0 results)

::: /etc/pihole/list.2.sysctl.org.domains (0 results)

::: /etc/pihole/list.3.zeustracker.abuse.ch.domains (0 results)

::: /etc/pihole/list.4.s3.amazonaws.com.domains (0 results)

::: /etc/pihole/list.5.s3.amazonaws.com.domains (0 results)

::: /etc/pihole/list.6.hosts-file.net.domains (0 results)

::: /etc/pihole/list.7.raw.githubusercontent.com.domains (4 results)
bigdata.adfuture.cn #Chinese Android Data Collection
bigdata.adsunflower.com #Chinese Android Data Collection
bigdata.adups.com #Chinese Android Data Collection
bigdata.advmob.cn #Chinese Android Data Collection

::: /etc/pihole/list.preEventHorizon (4 results)
bigdata.adfuture.cn
bigdata.adsunflower.com
bigdata.adups.com
bigdata.advmob.cn

::: /etc/pihole/blacklist.txt (0 results)
1 Like

Thanks for the confirmation DL6ER :clapping:
:slight_smile:

There is a new research about android spying on users.
https://www.scss.tcd.ie/Doug.Leith/Android_privacy_report.pdf

Can we block spy server as many as we can?
eg.
com.miui.analytics
data.mistat.intl.xiaomi.com
mitv.tracking.intl.miui.com

Sure, just add corresponding lists and Pi-hole will do this for you. If there are none, you can consider using a local list you maintain yourself or step up and publish such a list yourself. When you decide to do the latter, you should be aware of the responsibility implied by others using the list (= trusting you) and the need for continued research and list maintenance.

Where the current stock block list is located at?
Is there any option to add multiple lists (like checkboxes) or it's only one list now?

Not much trust is needed, either it works or causes problem, but it's certainly better than nothing.

You add adlists to Pi-hole in the web admin GUI > Group Management > adlists

We ship with one list. You can add additional lists in the location noted above. You can add multiple lists at a time if they are separated by spaces or carriage returns.