The usual suspects and what they collect
| SDK | Primary data collected | Risk profile |
|---|---|---|
| Firebase / App Measurement | Usage events, session lengths, crash data, device metadata | Medium — analytics backbone |
| Meta / Facebook SDK | App-open events, in-app actions, cross-app identity graph | High — profiling backbone |
| AppsFlyer | Hardware fingerprint, install attribution, ad-click linkage | High — attribution fingerprinting |
| Adjust | Device state, campaign attribution | Medium |
| TikTok / Pangle | Ad-auction signals, behavioral events | High — ad-network telemetry |
| Yandex AppMetrica | Location-tagged analytics, crash feeds | Medium |
None of these are malware in the criminal sense — they are business as usual in the mobile ad economy. That is exactly why they go unnoticed: permission dialogs never mention them, and they run under the app's own network identity.
How to find out which SDKs your apps embed
Static analysis (unzipping APKs) tells you what is bundled; network observation tells you what actually runs. The practical method is the second one: run a monitoring firewall for two days and read the interception log. NULLOG classifies each blocked call by vendor, shows per-SDK background ping counts, and flags the high-risk ones — no packet knowledge required.
A typical audit of a device with 100+ apps surfaces the same pattern: Firebase present in 60–70% of apps, at least one attribution SDK in most free games, and a Meta SDK in social and shopping apps.
Neutralization: block the destination, keep the app
You do not need to uninstall anything. SDKs require their remote endpoints to deliver data — so the defense is to make delivery impossible:
- Run a local filtering firewall (NULLOG) with its curated domain blocklist — it includes the telemetry domains for the SDK families above.
- Let the Radix-Trie engine refuse or sinkhole each call to
0.0.0.0in under 0.4 ms, before packets leave the radio. - Review the Radar weekly — the Sunday briefing summarizes every interception, so you can spot a new SDK the moment an app update adds one.
Why antivirus apps miss all of this
Antivirus scans binaries for known malicious code. These SDKs are not malicious code — they are legitimate libraries doing their documented job. No signature matches, so scanners stay silent. Behavioral network filtering judges traffic by destination and pattern, which is why it catches what signature scanning cannot.
Put it into practice with NULLOG
NULLOG runs every technique in this guide locally on your Android — ads, trackers and telemetry filtered in device memory. No root. No cloud. No logs.
Download NULLOG APK (v1.0.2)