Are Ultrasonic Beacons Tracking You?

What Are Audio Beacons?

An audio beacon is like a digital dog whistle -- a brief spurt of ultrasonic sound that cannot be heard by most humans. It can, however, be detected by the microphones in smartphones, tablets, laptops, and other devices. When detected by an app that includes Silverpush or similar software, the app passes data about the ad, the time time it was viewed, the channel and show during which it was viewed, and information about the device to a central server.

Audio beacon software made by LISNER and Signal360 are also useful in retail stores and event venues. A sidewalk sign advertising today’s specials may also include an audio beacon generator that causes your phone to alert you with a special offer on that very daily special, and it can further tell whether you entered the store. Another alert broadcast by a vendor’s bell-tray could tell you when beer or hotdogs are approaching at a ball game.

The new concerns about Silverpush, et. al., were inspired by a 13-page research paper released in May, 2017, by three German security researchers. They scanned 1,300,000 Android apps for traces of Silverpush, Lisner, or Signal360. Judging by some headlines inspired by this paper, audio beacons are everywhere:

“Ultrasonic tracking beacons rising.” -- “Hundred of apps are listening for marketing ‘beacons’ you can’t hear.” -- “Millions Of Android Devices 'Covertly Listening For Audio Beacons'” -- “ULTRASONIC BEACONS ARE TRACKING YOUR EVERY MOVEMENT”

The truth is a bit less terrifying. Among the 1,320,000 apps that the researchers examined, only 234 (0.018%) contained beacon-related code. Lisner was detected twice, Signal360 only once. It appears that after three years of effort, Silverpush has found only 231 customers. I was disappointed that there was no mention of whether those apps came from the official Google Play Store, or sketchy third-party app stores.

Where Is The Evidence?

The researchers also examined 9 TB worth of TV programming from 7 countries, almost six hours of content. They did not find any audio beacons.

On the assumption that audio beacons can also be inserted into Web ads, they expanded their search to the Web, examining the global, Indian and Philippine Top 500 Alexa websites. Again, they found no audio beacons.

The researchers are clearly disappointed by this “negative result” and came up with an “alternative fact” to explain it away. The data compression algorithms used by some TV stations may - repeat “may” - have filtered out high-frequency audio including beacons.

Silverpush’s CEO, Hitesh Chawla, told Ars Technica, "Even when we were live, our SDK was not present in more than 10 to 12 apps. So there is no chance that our presence in 234 apps is possible. Every time a new handset gets activated with our SDK, we get a ping on our server. We have not received any activation for six months now."

Turning to retail apps, the researchers visited 35 stores in two unnamed European cities. They found Shopkick audio beacons at four stores.

It seems that a couple of hundred or so apps are Silverpush-enabled, but none of them has been listening to any TV or Web audio beacons for six months or more. The Shopkick app seems fairly benign, and what ballgame attendee doesn’t want to know where the beer man is?

Hype and Vigilance

But once again, the mainstream tech press seized upon the slimmest possibility that something scary is happening, and hyped “ultrasonic audio beacons” way out of all proportion to their purported existence.

So is this a big nothing burger? For now, I'd say yes. The technology does exist for rogue apps on your phone to be listening for audio beacons from various sources. There's no evidence that it's being used for nefarious purposes, and no evidence of any usage at all outside of a few retail shops in Europe.

But this is a good reminder that "eternal vigilance" is still required when installing software on your mobile device. My advice is to check the permissions requested before adding any app to your smartphone. If it asks for permission to use your microphone, and there's no apparent reason for that, don't install the app.

Your thoughts on this topic are welcome. Post your comment or question below...