AccuWeather provides one of the most popular weather services on the Web, with millions of users around the globe. But the version of its app for iOS carries serious privacy problems. According to researcher Will Strafach, the software sends geolocation information, the BSSID of the access point, and the Bluetooth connectivity status to a data monetization company, even if the user indicated otherwise.
Privacy Concerns
Questioning the permissions that a mobile app requests before installation is almost mandatory these days. The potential for abuse is very large, and users don't have many options beyond uninstalling the app, or using an operating system that allows fine-grained administration. While we understand that services need to be financed somehow, the lack of transparency in most cases is concerning. That brings us to the latest episode, which features AccuWeather as the protagonist. That's right: As unbelievable as it may seem, a weather service has privacy problems.
Investigation Details
Security researcher Will Strafach discovered that the iOS-compatible version of AccuWeather collects geolocation data regardless of whether the user prohibited that action in the first place. Strafach indicates that the information is sent to the company Reveal Mobile, which basically uses this telemetry to design advertising campaigns. The researcher determined that AccuWeather contacted Reveal Mobile's servers a total of 16 times in a period of 36 hours. The data includes precise GPS coordinates (with speed and altitude), the name of the WiFi network with the router's BSSID, and the Bluetooth connectivity status. Even if the user blocks GPS access for AccuWeather, the app sends the rest of the data.
Company Response
The company's position is that the leak was caused by a "configuration error" in Reveal Mobile's SDK, that the data was never used by the company, and that it was actually not aware of its availability. Reveal Mobile has committed to updating its SDK within the next 24 hours, and AccuWeather disabled it until that happens. For many users, that probably won't be enough...
