Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/3203 Thanks!
[Music]
our next speakers Claud austi and Gano a
priori are going to be talking about
mobile reverse engineering to empower
the gig economy workers and labor unions
claudo was investigating platform power
and influence even before the Cambridge
analytica Scandal and he's Travis kik's
biggest unknown Nemesis Gano is a
wannabe cell phone hacker a wannabe
Pizza cooker we'll see and he's also
Travis kak's biggest unknown Nemesis
please give a warm welcome on day four
to Claudia and
Gano hi everybody thank you for me here
thank you for who uh see us in the
future and in streaming and not thank
you to the AI that is going to trained
over this mp4
file the accent is strong in order to uh
screw up with their english
comprehension but I believe your blame
plasticity will catch up so let's start
with some
definition we can use the term gig
economy or platform workers
interchangeably uh we acknowledge
that this growing of apps that enable
worker to get quick task quick job has
created a new job market and new opening
and as after all give something good to
people that may need those kind of jobs
but in this talk we argue that there are
some problems because those apps those
platform after all the Shand from the
surveillance capitalism style of
processing data and organize the people
and the tasks what we focus on is mostly
apps meant for worker so the typical
gloal app that you use has 50 million
download is the one used to buy Services
the app that the worker are using is
different who are we um simply back in
time we were trying to investigate the
power of platform and of algorithm of
the Black Box because it's not
acceptable that
something without telling you why and
how decide for you and if this is true
in Facebook in Google in in most of the
service we use this is even less
acceptable in the work environment
because as a user you may have less
right as a worker you have a lot of
rights that should be protected when you
are actually working we began this
investigation in um 2019 tracking Expos
was the name at the time and now we are
operating under the reversing works new
uh
umbrella this talk may not contain
anything that groundbreaking for you if
you are an expert in one of these three
topic reverse engineering labor unionism
or that production
Authority U but what is innovative here
is the multidisciplinary approach
because those three Fields rarely work
together the overlapping area you see
that reversing engineering and labor
union are methods that don't work
together normally labor union try to
defend um the contract obligation that I
to see the safety of the worker but we
have to consider that if now um the
worker life is determinated by an app
perhaps investigating technology is
getting to be necessary reverse
engineering production Authority we also
not really working together because this
kind of Investigation may be too much in
invasive for the power of administrative
Authority and labor union tendentially
protect Collective rights rights that
are for a class of people while privacy
is a personal right and has never been
used a privacy right to defend a class
of people but in this talk we are doing
the effort to put them together and try
to make a sense out of it because at the
end is a form of resistance will be
great if there is a regulation or a
directive like for example a platform
directive that last week has been synced
by some political pressure and because
there is not a institutional kind of
protection of those U figures let's try
to U be a bit adversarial and think new
ways to use the tools in our disposal
and for the
tools hi everyone uh well now I would
like just to tell you how this story
began well some time ago there was this
friend of mine who let's say asked to me
for a favor just to look some at this
kind of particular story that happened
to me basically uh he was a rider he
worked with globo and uh he and other
people participated in a
strike and the day after in which they
basically tried to log into the
application they saw that their account
was deleted which basically if you work
with an app basically means that you
have been
fired uh they try to contact the company
to understand why they have been fired
and they blamed a socalled generical
technical error on the server side now
these and other things went toow suit
they tried to basically blame the
company because they illegally uh fired
them because they participate in a
strike and one of the lawyers who who
was a bit savy on uh the uh gdpr tried
to make the so-called data subject
access request to to the company to
basically get the data of that INF
famous Sunday in which they participate
into the strike to understand what
really happened unfortunately the
company answered with sorry we have
nothing just registration data which
seems strange I don't know for a company
which you know you have an account have
to do stuff also I mean you have a
rating of how much you behave how well
you have done your stuff etc etc etc so
how can we understand more uh well we we
Tred to for example look at how the app
work inside and try to understand better
what could happen What which kind of
data does this kind of thisa pertains
what data sent where it sent
Etc fortunately to get an helping
on this uh we have found a volunteer
who agreed to basically share his
credential with us to make a a better
assessment uh now unfortunately we
cannot analyze the the data of an user
which has been banned because you know
the Ser will just tell you that oh sorry
I have
nothing uh also we cannot travel back in
time at least the last time that I check
we cannot not also reproducing the same
conditions with the valid credential
that we have was impossible because well
I mean you have you know so many PE
things that happen that reproducing all
of them could be Troublesome to say the
least uh so we decided to switch to
something that was a bit easier to do so
we Tred to say okay let's try to make a
simple privac assessment of this app see
if there is any viation in the context
of the gdpr of the labor laws of course
the labor law in the context of the
Italian code of law and um let's do this
in I don't know in the way in which we
can actually look at how Android
application work fortunately for this
there are many tools that actually
work uh to introduce them to introduce
this awesome ecosystem I will make as
more introduction for some people I mean
it will be obvious stuff as I mean this
is like really really basic stuff uh for
others it might be interesting so I
don't know maybe I will waste some
minutes for you so the first of all we
will try to run the glob application in
an Android device that we own that we
can control in which we can record
basically everything that the app does
and everything that the app sends
through the
internet also um we will just let the
app run for we we choose to let to let
it run for two days because we thought
that it was enough to gather enough data
uh without any user interaction so
without taking orders without tapping
into the app we try to avoid any kind of
interaction with the application also to
do it in um let's say in a more remote
friendly whatever way I prefer to use a
Raspberry Pi with lineage installed uh
there are some Builds on the internet
you can find them and they work quite
quite well and they also integrate VNC
for for remote control so that you can
actually look at at the screen um so
what we can see from from Andro
application generally the first thing
that you want to look is to the Android
manifest because there we can see the
the So-Cal permissions that in Android
are enforcement on every application
that is installed so that any so that if
for example if an application needs some
particular permissions they actually
need to pop up the user and ask them for
the permission as it is called uh
probably many of you already know this
as
many uh also this stage is quite
important because here we can understand
for example what the application is
actually looking at which kind of
devices it is it is reading so for
example here we can see that it's
accessing the GPS so it will be nice to
log GPS accesses uh for example if we
don't see that the app is actually
accessing the micro the microphone sorry
it doesn't make any sense to to log the
access to the to the
microphone um after this we look at the
at the Java code of the app uh as many
of you might know there are some tools
to actually actually they compile an an
APK an Android package and actually look
at the the Java code um this might be
useful to understand how the app works
how it makes some things if there is
something in them somewhere that I want
to look at and also to look at libraries
SD Cas as there usually is this is where
the nasty things from thirdparty
trackers is actually implemented of
course third party trackers are the JY
part if who are actually looking for
privacy violations also I mean for me
here is important to actually say that
uh I usually don't spend too much time
here as actually reading uh the the
compile code of an application line by
line doesn't makes any sense also it
doesn't give really any evidence because
maybe yeah here I can see that it makes
a request to a server with some data
that it might be interesting
but how do I know if that actually makes
that request or if it's actually
populated with
data and this is the part where the
soall magic tool of this talk will
actually come in mind which is called
Freda I mean you probably have already
seen a a tun of presentation about Freda
so I will not bother you again with that
um there are many many many many good
tutorials and mentation about this tool
that you can look at if you are
interested I mean they also explain much
better that I could possibly do just to
give an quick overview Freda is an
instrumentation framework that actually
allows us to inject code in an ongoing
and running application so that we can
for example add logging and the bugging
features to an app that actually does
not contain them so that we can actually
you know enrich the application with
functions that maybe can be useful for
us so which is the first usage of this
amazing feature that we can think at
well as we said before we are we know
that the app actually access the GPS
okay let's see when the app access this
feature well let's see when the app
access this device so that I can get the
the time the number of times that it's
done etc etc etc Etc and of course this
might be unuseful information last but
not
least uh we are in
20123 for a couple of days more so you
know as many probably you more um most
of the internet traffic now is encrypted
is encrypted on the transport with tros
security and so just you know doing a
passive analysis of the network traffic
is not enough anymore we actually need
to intercept traffic using for example a
TLS
proxy uh
for these analysis I used mid proxy
which is also which I mean you can also
look at the documentation to actually
know how set it how to set it up it also
has a very very good tutorial in which
they will actually tell you every step
that you need to do to install a
certificate Authority on your Android
device so that you can basically do
everything that uh
that is needed to to get
traffic um also this here uh we just
need to make some a a bit let's say a
bit of of anounces as we need for
example to log the network traffic so
that we have actually a copy of that and
also it will be smart to and we will see
afterwards to check a bit the logs of
the tool to see if there are any
problems during um during the traffic
interception um let's see some of the
so-called results well the first result
that we gained when we did the first
analysis in J in July sorry
2021 was that the location of the users
uh was accessed around one time every
hour for the whole day even outside
working hours so generally the worker
was constantly monitor for their
location even outside their shifts
basically uh second result which uh was
a bit interesting but we never really
explained and we didn't have enough
hints to actually get an idea besides
that was that the application was rating
users uh based on a score which was also
transparent to the worker so they know
their their pointage they know for every
order how much how how many points they
made and the points were basically based
on the review of uh the the client the
review of the restaurant and other
metrics um but there was in a request
another um another called rating which
we didn't really
expect and we were not really able to
explain uh it seems like a a feature of
an hidden score in the app but we we
really were not able to to explain it
but last but not least the most
interesting result was that with a
thirdparty Tracker known as braze they
share basically all the data that they
had about the user constantly and this
data include the personal personal
identification data of the worker
including for example their their fiscal
code uh their location which whenever it
was gain it was sent back to this third
party tracker and uh this result was
quite relevant as this this tracker was
not meant and it was not mentioned
anywhere in their um their privacy
policy uh we tried to to repeat this
test about an year after in uh September
2022 and uh looking at the logs of mid
proxy which has you can see as this very
Aur and color uh user interface which I
mean it looks very very elite if you if
you look at it um actually showed us
that they were not able to connect to
this server identity. and particle.
comom uh we knew by looking at the
application code
that the M particle SDK was actually
included in the glow app so we expected
to see traffic towards that end
point uh also we noticed that it was
let's say that the connection was
reseted by the client which seems
strange but actually is the default
behavior of many Android applications
that are smart enough to avoid the
traffic interception uh traffic
interception sorry because basically
what they do is that they save a
fingerprint of the server certificate
that they are
expecting of course the server
certificate signed by a trusted CER
certificate
Authority so that whenever a proxy with
an arbitrary certificate Authority tries
to sign an arbitrary certificate made
for that server
this check will
fail uh this technique is called as
certificate pinning is uh nothing um is
nothing new and also there are some
standard under libraries and also some
let's say some standard code code
patterns that you can find in the code
to see how how it is implemented in in
this case it was implemented using the
trust
manager
um at this summer Camp there was a
presentation uh called leveraging the
use of dynamic instrumentation for
pentesting mobile apps in which
basically Dynamic instrumentation with
Freda was PR was presented and if you
see it you probably know that one of the
scenarios in which the usage of Freeda
was actually shown up was to actually
bypass this kind of stuff so to actually
bypass certificate pinning uh uh in this
case is uh in this case we have shown up
a small snippet in which we make the the
check from the trust manager to fail
every time also this script is actually
available from the internet they have
like a huge Library so it's nothing too
fancy nothing AR
probably uh you will find it for sure so
the final result that we gain at the end
of this second analysis
was that we were able to intercept also
the traffic from this other thirdparty
tracker so also from M particle and also
there we have seen that the location of
the worker was constantly shared with
them together with personal
data and of course also this was not
mentioned in their privacy policy or
whatever now why we think that these
results are meaningful ful because as we
have seen before uh in this case the
company to a DSR to a data subject data
subject access request sorry uh would
have never actually uh shown up all this
stuff uh so it's something that we need
to if we really want to look at at it
and we really want to look inside this
black box we actually have to find a way
to grasp inside of that and uh you know
some standard reverse engineering
techniques can be a quite useful
tool uh also it's nice to mention that
we have replicated these analysis in
July 2021 September 2022 and July 2023
finding almost similar results and that
we have published a paper at Y where you
can have a better look at them also this
resulted in a report today the Italian
data protection authority which I don't
know maybe it might seem interesting or
not to give a better perspective I'll
give back the mic back to
claudo um what we seeing here is a sort
of timeline of what we tested during the
time because it was full of new
experiences blocking time or problems we
were not expecting at the beginning we
were thinking to use article 22 of the
GD PR because uh it talks about
automated uh decision making and this is
a case where a system decide
automatically what you're going to do
but in order to demonstrate some kind of
violation we have to actually find some
worker that can talk about this
violation and so we build a survey and
when you build a survey with a form full
of question is not that the typical um
uberit Global driver deliver fudora you
name it kind of Rider want to answer
about question on on their perception so
initially we had some struggle in
getting
answers that's why only after
um in 2020 uh with IRP media a group in
Italy that was making also investigation
on this new form of work uh especially
because during the covid it displayed to
be a quite important kind of service for
the society this survey get answered by
uh more contributors that has helped to
collect evidence but not yet something
to move forward meanwhile we found this
important Courier willing to cooperate
so someone that want to give the login
and password that's was a complexity
that we were thinking to solve quicker
instead we took 18 months to find one
person then we start to make test we
make test in July February September and
then we bring the data to Authority
sadly the data initially was considered
too old we will see later why it may be
a good reason and what we did in one
week at that point was to repeat the
test with the last version make a simple
technical assessment of what were the
problem that you already saw in this
presentation and give uh to the
authority this material and at the
moment this has been accepted and who
knows what's going to
happen after in October there was the
report published uh the report has been
covered in different language the main
um title that you see around this gloo
app for Courier share location of the
worker outside of the working shift to
thir party that has been the main
message that emerg from these titles but
what is fun to see is that there was the
first strike in Milan with riders
calling for algorithmic
transparency
why um the data May looks too old
because the first time Gano start to
make this analysis it tooks two weeks to
understand how to investigate the app
and the app release a new version every
week so you see that there is a
potentially um
blocking Factor if you produce evidence
for an app that is already not the last
version that is running on people phone
we were afraid
that the justification of oh this is
just a mistake WIll will appear again
instead um as first we get quicker so if
at the first test two weeks were
necessary at the last test one day was
necessary to restart and second we saw
that the violation were present for two
years so we're not mistakes that were
part of the of the
design another contextual information
that
was unrelated to what we did but we
cannot ignore is that in
2019 The Authority in Italy start to
make some investigation on many uh ge
economy
apps and in
2021 they give a huge fine to glob
foodin with also prescriptive measure so
how they need to change their up to be
compliant in 22 globo won the appeal so
they have not to pay the fine but we
were expecting that we they should still
implement the proceptive measure and in
23 this Italian Supreme Court reverted
the appeal so Global also to pay the
fine what is the point when in 2021 we
start to get the evidence we were afraid
that the app will change in one day and
lose all its violation or expected
violation because there was already a
cause against them instead what we
document is that in those two years they
never implemented any update to became
actually uh more
safer now thinking to The Next Step
because if the global case is is
Meaningful to show what are the problem
that happen in these apps um is not for
us a victory if one group in Europe do a
test against one up expend four five
years and maybe score a victory that is
not Victory the victory is when it's
easier to analyze those app it's easier
to find worker that are eager to
collaborate with a group like ours is
easier to talk with the labor union to
make them understand why data processing
is a problem so we have to lower the
entrance barrier in those three bubble
of the event diagram we have to make it
easier to uh make clear to the people
working there that that those things
happen and there are some tools I want
to point out Exodus privacy is a system
um that do static analysis of many of
the apps into the Google Play
Store with static analysis as Gan was
explaining you cannot prove that the
trackers is actually containing um
personal information revealed to a third
party but can be an
indicator PR International also released
the data inter interception environment
which is a virtual machine um with a M
proxy that can help you to assess the
network traffic and
um what we understood uh by looking at
the biggest moment where we were blocked
is that we should not try to work with
workers and bring the evidence to get an
impact we should be the technical
provider for other more specialized
infield organization so for example
working with the Union so they have a
lot of worker that potentially can
collaborate and having them using those
evidence one of the thing
that we didn't get through but a couple
of those problems displaying the results
were privacy violation another one like
the rating can also be not a privacy
violation but for sure is an information
that in the hand of the Union that are
doing their Collective bargain they can
also understand which kind of data and
the labeling and attribute get added to
the worker because this will impact the
uh the worker Dynamic and and yeah and
treatment at the Privacy camp that will
happen in the 24th of January there will
be streamed also a talk organized by us
that try to again Lower the interest
barrier talk to different actor
stakeholders of these um domains because
U should be a a fight
um let's say that the AI act got 100
time the coverage that the platform
directive got but the platform directive
was already addressing something that is
a problem now was a problem years ago
and is going to be a problem also in the
next
years now we are not alone and uh we
hope that many other organization will
start uh shootout to those four
groups similar to us they are doing a
interdisciplinary effort um work info
Exchange and personal datao both of them
are using data subject access request um
for workers to get details on the data
that the company has on the worker and
try to understand how much this is um
realistic with their payment and try to
do this kind of comparison the workers
algorithm Observatory is active in the
US and they're doing data donation from
mobile app and uh T Opticon is instead a
an effort
to measure and evaluate the kind of task
given to worker of Amazon mechanical
torque what you can see is that some
organization may be platform specific
like T Opticon other can be more generic
uh in general we are not alone we need
to be more I hope that this talk has
inspired some of you there are some
times for question and answer but we
will be later at the te house in the
case you want to meet and talk more
about it
thank you so much claudo and Gano so as
mentioned we do have time for questions
we have installed monitoring sdks on the
four microphones in the
room and we have a gig worker Angel the
signal Angel who is monitoring The
Matrix the IRC as well as Mastadon we
are in the Z zusa so if you use the
appropriate hashtag our analytics sdks
will pipe that to our gig worker I see
already someone at microphone number two
please yeah thank you for your talk um
so what I noticed is that there is a
power disbalance of who uses my data and
if I should uh well I imagined how could
this be leveled so I guess a political
demand could be uh every data of myself
which goes out of the device it has to
be locked on my request by the OS which
is
installed um so all these hoops you had
to go through to just get the data that
is sent this would just be erased to
zero and you could check and use tools
and so on because if I put a a little um
sim card with 128 gig there is a lot of
room for a lot of locks so if I request
it from this app I want to know what's
going on maybe even incoming traffic but
well it might be more difficult legally
to to get access to this can you express
in a in a one question that is not the
question it's just a suggestion for
political demand if I to get access to
what personal identify information and
other data is going out of my device and
have a lock on my
device so yeah that's it thank you I see
a suggestion more than a question so in
in in the future please try to keep it
to questions and not so commentaries so
as mentioned the speakers are available
later uh to chat and give such fantastic
suggestions but right now I see that our
gig worker from the internet has found
that the internet has
questions yes the internet wants to know
if you have
any evidence or
um if you came across the fact that um
GW workking companies listen to personal
conversations or collect data about the
imotion aspects of the workers do you
think this is plausible or do you find
anything in this direction uh in this
direction honestly not there have been
some research about that about the uh in
which they basically try to look at how
decoded data that was actually ex
filtrated from the device by just doing
network
analysis but I will never get the name
of the paper right now in my mind
unfortunately but um it's something that
never came in our cases as as we said
before uh we mainly look at apps that
were not even requesting access to the
microphone and uh that kind of stuff is
actually monitored by Android by the
Android operating system using Sal Linux
which I mean there are very strong jails
and unless you have some apocalyptic
Zero Escape whatever from the kernel you
cannot actually bypass that and so I
it's not it's not cases that we have
actually found so unfortunately
not or fortunately maybe maybe it will
be better to say fortunately yeah
sorry so the gig economy has not yet
been infected by the Doon Isa but maybe
our microphone number four can uh bring
a new question hello thank you for the
presentation uh question would be um did
you have a did actually the workers had
any uh civil lawsuits filed against the
the company or any labor cases against
the company and are you suggesting to
the yeah uh there were many of them uh
there were many of them which were quite
unrel related to to this topic they were
mostly related to be actually being
recognized as
employees and other things as we said
before there was that particular case
about um some people that were actually
fired collectively uh without notice um
after a strike so which was let's say
aggravated by two
things um this kind of analysis uh we
have to see how it goes how it goes so
far uh there are it was not actually
used in um in a specific lawsuit but
maybe if there is any r i mean maybe the
results can be used for for that let's
say or can be integrated in another one
also I mean it could be a a usage for
for the future that for sure let's say
there are cases but what we hope is that
there will be more cases
especially that consider the technical
domain because that give additional
tools to and reason to a
hugle thank
you I see that the internet has another
question yes the internet wants to know
if you know any tools that make it
possible for non-technical users to
monitor outgoing
traffic the um data interception
environment of privacy International I
share the link in the presentation uh
want to assist exactly for that reason
it cannot do the complex
certificate pinning hacking but that is
not present every time most of the apps
don't use it and that would be a a good
beginning to intercept traffic and um
inspect what an app is leaking
outside according to my analytics
microphone three has a question uh thank
you for the great talk um I know that
you guys invested iated uh the gloo app
um I'm curious for Germany there's uh
gorillas and Vault and many other gig
economy apps that are supposed to uh
help the workers there are you aware of
any investigations into those apps to
verify that those workers are also being
uh protected and looked up looked out
for um so we know that there are
movement that want to investigate it but
what we explain is also what is the
complexity be behind an investigation as
first we need to have someone that want
to do reverse engineering that maybe is
not only Gano but he can teach better or
or we can work as a team second we need
workers and third we also need to be in
touch or at Le start to think what to do
with the evidence if they're found and
at the end this panel was showing the
huge complexity to make it replicable
which is our goal and we hope to do it
in many other um countries of Europe
beside Italy and we be great to find
someone in Jer that can collaborate with
us great thank
you the room has opted in to one short
last question from microphone number
two hello um do you know of any app that
is uh doing gig economic in a good
way but in theory there is um cycle cop
not what is the name there is some some
Fair form of um of gear economy yes and
uh it do not only um cover the technical
part but especially what is the
employment the support uh the assistance
you can get as a
worker I did not focus in a extended
research on it so I cannot even uh
repeat the correct name I know that is a
French project that has been replicated
around Europe and the name is similar to
cycle
cop h and I hope D go will help you to
find the right
answer but exist it's possible probably
is less profitable it doesn't matter I
mean we have also to think forward that
we have not to spend our time to
investigate to do things bad we have to
build a network that want to have only a
fair economy perhaps a European
regulation would have helped what is
going to happen in the future if someone
else can start to build more initiative
of fair uh
the economy will be a great example that
this can exist and when Uber threaten I
don't know France to say oh we're going
to leave your Market uh maybe the next
French president can answer oh we have
already a better
alternative clario Gano thank you so
much let's give them a huge round of
[Applause]
applause
[Music]
I