Ticked Off

Speaker 1: I think we gotta go back to the end of our last episode. If I am China and I'm looking for companies that could give me, like, a leg up in some future psy ops type situation, I'm gonna be trying to build the next Instagram, not the next Cisco. You

Speaker 2: know? Yeah. Well, we're just talking about TikTok. So Yeah.

Speaker 1: We're just talking about TikTok. You see, this episode was gonna have nothing to do with current events, and specifically nothing to do with China. But in the last five minutes of our last episode, like, Bloody Mary in front of the mirror, we evoked TikTok. And then, like, four days after that episode went live, this happened.

Speaker 3: President Trump has threatened to ban the Chinese owned video streaming app TikTok if it's not bought by September 15.

Speaker 1: So now we gotta pack our bags, throw on our headlamps, and go on a journey deep into the data mines. Let's imagine for a second that we live in China and we make socks. We're sock makers. We got a sock factory, and we wanna sell our socks to Western feet. So we've come here, deep into the mildewy depths of the data mines to try and get some good data about our Western consumers so we can sell them more socks. First steps first, consumers so we can sell them more socks. First steps first, we gotta go where our audience is, which are the ecosystems operated by Facebook and Google. Now, Facebook and Google, they'll take your money to run sock ads all day, but what they won't do is sell you user data because privacy, which is where companies called data brokers come in. Because while Facebook and Google will not sell you user data because privacy, they will effectively sell it to multimillion dollar data brokerages because money. So, Sockmaker, you gotta find yourself a data broker. Trouble is, you've got to find a data broker in China that works with Western companies with data on Western users, which brings us to a company you've probably never heard of called AdTiger. Generally speaking, data brokerages keep the supply chain of how they get user data a secret. But you see, AdTiger recently published this giant pile of information for investors interested in getting in on their multimillion dollar IPO, providing our HumbleSocks startup with a lot of insight into the flow of Western user data in China. Based on these documents, we have learned that AdTiger can get information on Facebook and Instagram users by buying it from another middleman company called MeetSocial. They can get information on Twitter users by buying it from a company called OneSite, information on Google and YouTube users from a company called Vidoed. Without ever contacting a Western tech firm, they can get millions of dollars worth of data on Western users by purchasing it through a series of intermediaries, each collecting and reselling this data in an increasingly complex supply chain. So if you, Chinese sock company, wanna know the exact moment that Ricky in Minneapolis expressed an interest in getting some ankle socks for a sporty new summer look, you can buy it today and start advertising to him tomorrow. Which brings us back to TikTok, and really the fear at the heart of this proposed ban. Central to any argument that we should ban Chinese tech is this law called the Cybersecurity Multi Level Protection Scheme. Now, this law basically says that Chinese based companies have an open door policy with the Chinese government when it comes to data, that the government has the right to access all information on or flowing through Chinese servers. There are no warrants for user data, no subpoenas, what's mine is yours. So if heaps of users in the West are using TikTok, and TikTok and its servers are based in China, That means that the Chinese state has access to all of that data, resulting in a very real security threat. As the logic of the ban goes, Western user data on Chinese servers is a security threat. But what about Socks? Because if it's a threat when TikTok does it, why Sock Factory owner isn't it a threat when it's Facebook data bought from MeetSocial held on AdTiger servers in China, or Google data bought from Vidode stored on servers in China, or Twitter data bought from one site stored on servers in China. Why TikTok? Why ban specifically TikTok? We're gonna try and answer that question on this episode of Hacked.

Speaker 2: I think that particular social networking app has had a lot of conversations happening around it for the last little while here in the right communities. Like, I believe Amazon had drafted a letter, that got leaked out that was gonna direct all their staff to not install it. So to have TikTok removed from your devices and other things. You know, there's been a lot of discussion about TikTok and what it's up to Mhmm. In certain circles. You're definitely now seeing a lot happening, especially now with the Department of Justice and the White House going after ByteDance, kind of trying to force the sale of it so that the company is owned and controlled by Americans, which is, I think, madness in today's kind of free market world. But, yeah, I think there's some interesting I think that the actions of the people around it are very indicative of something very interesting that we don't know. Does that make sense?

Speaker 1: I think so. But you could explain further.

Speaker 2: Well, remember in the Hawaii episode where, you know, there was lots of lots of significant moves happening at specific levels of government and nothing was really being told to the masses. That's generally probably pretty indicative of something large going on behind the scenes. I feel like we're seeing that now with TikTok.

Speaker 1: K.

Speaker 2: You've got lots of huge public, denouncements of it. You've got the president of The United States trying to force its sale. You've got talk of outright banning it in North America or at least in The United States. And I think that that's just very indicative to probably a larger problem that, you know, as normal people, we're not, you know, privy to.

Speaker 1: Mhmm. Before we talk about the technical side of of TikTok and kind of like the sort of types of data that TikTok could theoretically be harvesting, I feel like it's not really being honest and talking about whether or not you should ban TikTok without talking about the popularity of TikTok. Like, there's a reason that app is is in all the headlines. There's a reason that's the app that people who wanna go after China on the grounds of technology companies are going after. It's because it's the one everybody knows. It's like becoming this giant cultural phenomenon. Do you think any of this would be happening if TikTok was not kind of the cultural force that it is?

Speaker 2: Oh, I think we should open this discussion by giving credit to where credit is due and, you know, Vine really set the stage for what TikTok became and and I think Vine compilations are still some of the funniest social media content ever made.

Speaker 1: We did Vine so dirty as a society.

Speaker 2: Yeah. And and now it's been essentially reborn with the learnings of Instagram, and now is the most prevalent among, you know, certain demographics.

Speaker 1: Yeah. If nothing else, TikTok proved the premise of Vine.

Speaker 2: Yeah. RIP Vine. Rest in peace, Vine.

Speaker 1: Fucking Vine. Fucking Vine. About a week ago, a story came out about TikTok harvesting a certain type of user data that I guess we said the problem is that most apps harvest user data. But there's the sense of, like, whatever all of them are doing is okay, and if one does something that the rest aren't doing, it's not okay. And TikTok harvested a type of data that they're not really supposed to in 2020.

Speaker 2: Yeah. Apple banned, Mac address farming in 2013. Google apparently did it two years later in 2015, but there's an issue on the Android platform that allows you to kind of bypass those security checks and and access it. So the other thing I will note is that I don't think TikTok is the only app maker that is using this workaround or loophole to access this data. So it's just that they're the most, you know, discussed Chinese social media app that's accessing this data.

Speaker 1: That's currently in the middle of a trade war purchase agreement involving the president and Microsoft. Correct.

Speaker 2: Yeah.

Speaker 1: It's the only one that's all three of those things.

Speaker 2: Yeah. Yeah.

Speaker 1: So I guess first and foremost, they've been tracking a MAC address, what is a MAC address?

Speaker 2: Sure. So a MAC address is a physical ID. So each device, comes preset with a MAC address, which is a random, address, same as your IP address, but your IP address is granted to you by, you know, routers and switches and other things when you access the Internet. The IP address is literally just a public, moniker for your MAC address. So in, in the lower levels of the software and the address resolution protocols and stuff, all an IP address is is a pointer to a device's MAC address. So so, really, your MAC address is your device's private ID, and then your IP address becomes your public ID.

Speaker 1: So you can't really change your MAC address. Like, you you just have the wallet.

Speaker 2: Yeah. You can change it on computers. Like, an easy way to bypass paywall WiFi access is to quickly hack your MAC address to somebody's that has paid the paywall. Right. So, like, if you're flying on an airplane and somebody's paid for the $40 Right. WiFi access, you can just steal their MAC address and become them and the paywall ignores you.

Speaker 1: Pro tip.

Speaker 2: Pro tip.

Speaker 1: That's pretty good. Yeah. But you need one room to pay $25 Yeah. For like fifteen minutes worth of the slowest Internet in the universe.

Speaker 2: Because the other thing is the MAC addresses aren't hidden. So if I'm sitting in an airplane with my laptop open scanning the Wi Fi traffic, I'm seeing the MAC addresses of all of the devices around me.

Speaker 1: This is kind of an aside to what we're talking about, but, like, you're saying that if a person wanted to connect to airplane Wi Fi, all they would have to do is spoof the MAC address of someone who's already connected, and they would get through pretty much no problem.

Speaker 2: Correct.

Speaker 1: Dope. Good to know.

Speaker 2: Yeah. Most paywalls, once you pay, they put your MAC address in a white list. And so then if you take over that MAC address or have the exact same MAC address, it has a hard time differentiating the traffic and adds you to the white list.

Speaker 1: If that works on airplanes, does that work on anything else?

Speaker 2: Well, it's mostly for network access because that's where your MAC address is most applicable, because your device's physical ID is that MAC address. So like when you connect your laptop to like a DHCP network, like a standard router network that most of us have in our houses with our, you know, cable internet or whatever, it makes a request to the network. We've covered this in a previous hacked episode where it says like, hey, I'm here. Give me an address. And it takes your MAC address, throws it into a table, and assigns you an IP address. And then anything inbound to that IP address gets converted to your MAC address and sent to it. So it's a critical part of, you know, network traffic. And so a lot of network based paywalls, for Wi Fi access, Internet access, generally use MAC address, even inside of quote unquote secured public Wi Fi. So there can be white lists on guest networks and stuff. The white list traffic is based off of MAC addresses. So if you know something that's on the white list, and you can access its, MAC address, which is generally pretty accessible, you can then just spoof your MAC address and kinda slide through any kind of security.

Speaker 1: So in the middle of this episode about TikTok, you have just given the people the secret

Speaker 2: Well, I don't think it works on all paywalls, especially, like, you know, your Wall Street Journal ones and stuff are probably related to accounts and or, cookies, which should also be spoofable if you really wanted to get into it. But I think for most network access, this is and, you know, I don't think it's I don't think it's a a master key, but, it's definitely another tool for the toolbox.

Speaker 1: So, it's 2013 and Apple has just pushed out iOS seven. It's the one where all the icons got flat. But something interesting happens behind the scenes when that beta goes live. Mobile ad marketing company Fisku reported in 2013 that as the first beta went up, the millions of participating devices all started returning this exact same MAC address, 0200000 and so on. So if, as Scott said, the MAC address is kind of like your name tag for your device, that update goes up and suddenly everyone is going kind of by the same name. So fast forward to 2020 and TikTok is in trouble for tracking MAC addresses even though Google and Apple prohibit it, the sort of obvious question comes up, why did they ban tracking Mac addresses to begin with? We're gonna get to that right after this break. Starting some new isn't just hard. It can be downright terrifying. You put a lot of work into a thing. You're not entirely sure it's gonna work out. You're taking a huge leap of faith. I've started a few things. Now I know I was right for believing in, you know, the idea, the product, despite all of those fears and hesitations. But boy, does it sure help when you have a partner like Shopify on your side. Shopify is the commerce platform behind millions of businesses around the world and 10% of all e commerce in The US. From household names like, well, hacked podcasts merch, to brands just getting started, you can get started with your own design studio with hundreds of ready to use templates. Shopify helps you build a beautiful online store that matches your brand style. Did I mention that that iconic purple shop pay button is used by millions of businesses around the world? I don't know why I wouldn't. I should. It's why Shopify has the best converting checkout on the planet. It also helps boost conversions, meaning less carts, sort of getting abandoned in the parking lot, and more sales for you. It's time to turn those what ifs into sign up for your $1 per month trial at shopify.com/hacked. Go to shopify.com/hacked. One more time, That's shopify.com/hacked.

Speaker 4: Sierra has all the best active and outdoor brands for the super athletic stuff, like running gear for cruising up the trail. Woo. And the super athletic ish stuff, like fishing gear for chilling by the creek. Nice cast. Fitness apparel to push for higher reps. You got this. And golf balls priced so you could afford to lose one. Or a few. Head to Sierra or sierra.com for the brands you want at the prices that let you do it all. From athletic to athletic ish, Sierra's got it.

Speaker 1: Without even getting into, like, their connection to the Chinese government and the kind of trade war that they're in the middle of, TikTok is in trouble for tracking MAC addresses. Why can't you track MAC addresses? It's a

Speaker 2: good question. The reason why they would ban it with MAC addresses is because they are the true device ID. So we have all this obfuscation, and we talked about this a lot previous episodes, where, you know, there's an advertiser ID, which is essentially a fake ID that kinda points to our MAC address. Well, not really, but, like, essentially, it's a way for them to track our ad traffic but not know who we are. Then there's all these other layers of it. Like, we talked about this in the COVID tracking stuff where how can they obfuscate who we really are? You know, you got all this, like, soft Bluetooth pairing stuff and, like, all these different ways to do it rather than actually track our devices. MAC address is literally the exact physical ID of our device. So once they know that, if they have all the rest of the IDs, the obfuscation is gone. So if they know our advertiser ID, our IP address, our etcetera, etcetera, etcetera, they can tie those all back to the MAC address. So next time that MAC address requests or accesses one of their servers, because as they control the servers, inbound traffic from devices comes from a MAC address, they can say, oh, that's actually Jordan Blumen requesting that Reddit thread or that whatever, that TikTok dance video. So once you have it's essentially a way to break the obfuscation. So to to to reveal you know, to remove the veils because that's the real core address of the device. So anything that's done or any connections, any inbound traffic, outbound traffic to that device

Speaker 1: can

Speaker 2: then be associated with all the rest of your obfuscations.

Speaker 1: So when Apple made that switch and they said, okay. Third party apps, you can't track Mac addresses anymore. You have to track you you can use this other thing called an IDFA, which is, I I think, an identifier for advertisers, advertiser identifier. The fact that that is the alternative to this suggests to me that the reason they were banning this track and the reason that people wanted to track MAC addresses to begin with didn't really have anything to do with, like, surveillance, less than it had to do with marketing and advertising, less than it had to do with money.

Speaker 2: Well, the location so all of these things tie together, all of our, like, you know, last episodes because they're all kind of about the similar theme of of tying back and connecting and and breaking through the veil of privacy. And that's a big thing, like location based advertising now is associated with your advertiser ID, was originally probably associated with your IP and or MAC address. So then all of a sudden, if you're a social media company that also knows the MAC address of the device, and if, say, you also get data from three or four other third party apps that also have the MAC address, you can start to really build up a demographic and psychographic profile of who that device is owned by. And, you know, that's better advertising, but it's also better, you know, surveillance.

Speaker 1: Why would TikTok do this? Because my sense is that in, like, the evolution of this, we we had MAC addresses, and then a lot of the platforms said whether for genuine reasons or for optics, some combination of the two, we're gonna make it so you can't track this anymore. And advertisers devised their own tools to be able to say, okay. Now you're gonna have an ID that we associate with you. That's how we're gonna do this. TikTok is of the skill where they could institute any kind of system themselves. Like they TikTok can track TikTok users however they damn well please within the rules created by the App Store. And that is significant. That's like a big playground they're operating in. They can get a lot of information out of it through users. Why would they try and circumvent Google's security systems in order to track this? Why is it so why do you think it would be so valuable to them?

Speaker 2: I this would have to be a think. This would all be hypothetical, but I think it's just knowing the exact device ID when you're a company as big as TikTok that does the integrations and collaborations and, you know, whatever you wanna say about the national state of China and and what they might have for third party reasonings for it. The more data, the better. You know? It's you're better armed and better equipped for whatever their outcome is. If it's advertising, if it's surveillance, if it's, you know, etcetera, etcetera. The more data, the better. And if you know the exact device ID, and you can track that device ID every time it connects to any other related service, third party that you collaborate with, that you integrate with, data sharing. Like, I'm sure I'm sure in the world behind closed doors, there's big data sharing agreements between certain app makers and certain manufacturers. And, you know, having that as the base key to connect all of the other data values is great. Because then we really know that we're talking about Jordan Blumman's iPhone, you know, XR in this specific location.

Speaker 1: So TikTok right now, I think the best reason most people would argue in favor of banning TikTok is because TikTok's parent company operates out of China. And we know that China has laws that entitle that government to access information stored on servers in China. Therefore, the Chinese government theoretically has access to the data of foreign users. Yeah. Theoretically. Theoretically. The solution then within the idea of this ban is that, okay, force them to sell it to an American company. And I guess I'm curious how that would solve the problem because my understanding is that so Microsoft, we're talking about Microsoft buying TikTok. Microsoft has a huge footprint in Shanghai. Where they operate attempting to sell Bing based user data to Chinese advertisers. Facebook does this. Google does this. Microsoft, who's talking about buying TikTok, does this. They all do it and they do it legally. They're selling this information to Chinese companies and then sell it to advertisers. So if our root fear is that Western user data is being sold to Chinese, advertisers, making it visible to the Chinese state. Isn't this just purely an optical win? Isn't this we're gonna find the biggest dude in the yard and we're gonna go sock him in the face?

Speaker 2: I see your point. I think I think it's a couple things. I think it's a, it's the w no, not the w don't. You know, it's an obvious one. You know, we, as North Americans, understand the tech culture that we have. And I think we're more comfortable with it. Sure. And I think that we don't fully understand the motivations and reasoning behind foreign tech and that, you know, it could be completely benevolent, but we don't know. And I think that that that's just enough of a thing to make people's stomach, you know, tingle a bit. I think that's one of the things. And then I think the second big important piece of that is is that the, you know, quote unquote American tech, North American tech, the tech that we're comfortable with, answers to the governments that we're comfortable with.

Speaker 1: Oh, interesting.

Speaker 2: So I think that if the American government didn't want Microsoft selling Bing user data, not that it really matters, or Facebook selling Facebook data, which does really matter, to the Chinese government, they could say, no. You can't do that. You're under our policing, under our controls, under our trade policy, and you're violating our national security. Stop that. Where I think when it's fully third party controlled and owned, that makes the government's tummy tingle. And I think that's really the the two points of that. Not to mention the third point that it's, you know, politically advantageous for certain politicians to go after certain countries.

Speaker 1: Sure. It's a trade war.

Speaker 2: Yeah. Sure. Everybody likes a wartime president. Right?

Speaker 1: Right. So we just talked about the TikTok band as like a kind of a choice motivated by, you know, some sort of mix of politics and optics and trade. And we've talked about how it maybe doesn't really get to the heart of securing domestic data from foreign actors. And I guess to give sort of the other side of this discussion today. Earlier you answered my question about, like, why TikTok would even take this risk, and it's that Mac addresses are like, they're useful. And we've talked about how they're useful to ad driven businesses like TikTok. How is it useful to a government? If we accept the premise that, like, we should be skeptical of TikTok because their parent company has potential ties to a foreign government that engages in surveillance, why does that foreign government even want this data? Why do they want Mac addresses? Why do they want data generated by a music based video app?

Speaker 2: Yeah. And I think just furthermore to, you know, what you were mentioning about, you know, certain national governments having certain controls and demands on on information from the technology companies, something like the MAC address, would be a very key part of telecommunications traffic. You know, our smartphones and devices are connected to potentially national telco infrastructures made by other Chinese companies. That MAC address would be shared across, So they would be able to then correlate the data from TikTok and anybody else that they bought it from, or any traffic to their inbound servers or through their proxies. Any every part of that would tie back to the MAC address, and they would be able to then, you know, kind of congregate it and mine it.

Speaker 1: I think I have a hard time with this one. A hard time not flip flopping on it because I'm I'm so used to thinking of these tech companies as being kind of sovereign states. Like, intellectually I know that the government is just a warrant away from being able to get information from these big tech companies, but I do think of them as autonomous and if anything having like kind of an adversarial relationship with the government regardless of how true that is. And this just totally breaks that, understanding.

Speaker 2: Well, when you've got Mark Zuckerberg asking the American government to tell him what to do do because he shouldn't be making moral decisions on behalf of the country. And they're saying, well, you should be doing a better job of it. And he's like, well, I'm not our moral compass, so help me. Yeah. I can see how it's pretty easy to convince or to to to mistake the two.

Speaker 1: Yeah. It's easy to mistake Western tech, as foreign states and Chinese tech is almost like appendages of this one big single organism. And I'm I'm super skeptical of that binary, but it's certainly how it feels.

Speaker 2: Yeah. Well, if you think about technology, the umbrella of all technology companies is a Excel spreadsheet. And then each social network or technology company has a sheet in it, and you put all of the information that they all hold on those sheets, and then you have the ability to cross reference them all, you'd probably be able to tell quite

Speaker 1: a bit about a lot of people. Would you use TikTok?

Speaker 2: I don't use TikTok. I've seen TikTok. I get sent TikToks. I don't like TikTok. I think that TikTok is bad for people's well-being, and they should go outside instead of staring at their phone for four and a half hours. So I I I I don't think I'm gonna be a very compelling target. I don't think you know? I'd like to think of myself as somebody who's real important and influential. I'm not. So I don't think I'd have any, like, major life concerns if I was, you know, an average teenager. I'm not too too worried about it. I think that they're gonna be able to mine just enough data. They've got a statistically large enough dataset that I'm not gonna I'm not gonna be a a marker in it. So Yeah. I I wouldn't be too too concerned at this point. I think it's more along the lines of what's happening at the mass scale. And also, I think what we don't know is the more interesting thing. Because I think in my lifetime, I can't remember, a US President demanding the sale of a company. So I'm not sure what else is going on. That's more where I'm it's more where my ears perk up and I go, oh, that's odd behavior. What's behind that?

Speaker 1: If you are interested in learning more about the truly wild ecosystem of Western data being sold and stored on foreign servers, I highly recommend you check out Shoshana Wodinski's wonderful piece in Gizmodo on AdTiger. It was a huge source of information for this episode. It's been a hot sec, but huge shout out to our patrons on Patreon. You're our everything. You're our world. You can follow us hackedpodcast on Twitter, and if you like it, rate and review the show. It means a lot to us. Thanks for listening. Sorry for the delay on this episode, and we're gonna catch you on the next one.

Speaker 5: Still waiting in line? Again? That's time you'll never get back. Save time and money with stamps.com. Over 4,000,000 businesses have skipped the line with stamps.com. Join them to save up to 90% off carrier rates from your computer or phone right now. Print postage for certified mail, registered mail, and packages in seconds, then schedule a pickup right from your home or office. For a limited time, go to stamps.com and use code podcast for a free welcome gift. Taxes and fees apply.

Speaker 6: From lashes for days with the viral liquid lash extensions mascara to awakening your eyes with lift and color from the brilliant eye brightener, Thrive Cosmetics is the go to when you want to amplify your everyday look. Plus, every product is 100% vegan, cruelty free, and made with clean skin loving ingredients that work with your skin. And for every product purchased, Thrive Cosmetics donates to help communities thrive. So every time you use your favorite Thrive Cosmetics product, you're helping communities you care about too. Amplify your everyday. Go to thrivecosmetics.com/shine26 for an exclusive offer of 20% off your first order. That's thrive cosmetics, causemetics.com/shine20six.

Speaker 7: Summer weekends are all about family, sunshine, and making memories together. Before everyone arrives, I stop by my local Total Wine and More to pick up a great bottle, maybe a favorite we already love, or something new to enjoy with dinner on the patio. With so many bottles to choose from, it's easy to discover something amazing. And with the lowest prices, it's easy to grab an extra bottle for the table. Not sure what to pick? Their friendly guides are always there to help. Find what you love and love what you find only at Total Wine and more. Curbside pickup and delivery available in most areas. Visit totalwine.com to learn more. Spirits not sold in Virginia and North Carolina. Drink responsibly. Must be 21.