YOUR DUOLINGO IS TALKING TO BYTEDANCE: CRACKING THE PANGLE SDK'S ENCRYPTION

Summary from the TLDR InfoSec newsletter

ByteDance's Pangle ad SDK is embedded in more than 40 popular apps, including Duolingo, BeReal, Character.AI, and others, sending rich device fingerprints to ByteDance servers via HTTPS. The SDK uses a “cypher:3” scheme where each payload literally contains its own AES key and IV, plus a hardcoded AES key reused across versions, making the extra “encryption” simple obfuscation rather than real protection. Decrypted traffic reveals granular hardware, state, network, and identifiers, as well as regulatory-consent fields, while a stronger ECIES-based “cypher:4” is reserved for ad metrics, underscoring that user fingerprint data is only weakly protected despite its high tracking value.