eTM6 (arrival card)

[chris26be]

Anyone used the eTM6 app (arrival/departure card) yet?

I filled out my birthday (5 September), and on the printed document it had become 6 September …

 

[ubonjoe]

I assume you used the app the we just learned about.

[ThomasThBKK]

They have another app that is called Immigration eServices from the same author, for 90 day reports and co....

 

Is this stuff even real or malware? i heard nothing about it anywhere and can't find anything on google about it at all?!

 

 

[yokat]

I would restrain from using anything that has not been officially announced since you are at risk of identity theft if this app is not official.

[jackdd]

I can't guarantee for anything because this whole app is obfuscated and could contain whatever, but i had a look at it.

 

Within the APK i found an API endpoint https://pmobile.immigration.go.th/eTm6Service

With different apis:

public interface Etm6Api {
    @POST("api/chkInitApp")
    Call<C1653b<C2688b>> chkInitApp(@Body C1652a<Map<String, String>> c1652a);

    @POST("api/etm6CreatorService")
    Call<C1653b<C2694h>> etm6CreatorService(@Body C1652a<C2693g> c1652a);

    @POST("api/etm6Service")
    Call<C1653b<C2693g>> etm6Service(@Body C1652a<C2693g> c1652a);

    @GET("api/getNewsById")
    Call<C1653b<C2697l>> getNewsById(@Query("newsSeqno") String str);

    @GET("api/getNewsList")
    Call<C1653b<C2697l>> getNewsList();

    @GET("api/getLovAccommodation")
    Call<C1653b<C2687a>> lovAccommodation();

    @GET("api/getLovCity")
    Call<C1653b<C2689c>> lovCity(@Query("id") String str);

    @GET("api/getLovConveyance")
    Call<C1653b<C2690d>> lovConveyance();

    @GET("api/getLovCountry")
    Call<C1653b<C2691e>> lovCountry();

    @GET("api/getLovDistrict")
    Call<C1653b<C2692f>> lovDistrict(@Query("id") String str);

    @GET("api/getLovGender")
    Call<C1653b<C2695i>> lovGender();

    @GET("api/getLovNation")
    Call<C1653b<C2696k>> lovNation(@Query("abbcount") String str);

    @GET("api/getLovProvince")
    Call<C1653b<C2698m>> lovProvince();

    @GET("api/getLovPurposeOfVisit")
    Call<C1653b<C2699n>> lovPurposeOfVisit();
}

Some of these are actually returning data, for example:

https://pmobile.immigration.go.th/eTm6Service/api/getLovNation

https://pmobile.immigration.go.th/eTm6Service/api/getLovGender

But some of them are just throwing a timeout.

 

So most likely this app is comming from Thai immigration and does not steal your data (no guarantee!) but it's not working yet because it's just not finished, and should probably not be public.

To sum it up: There is no reason to install it right now. Wait until it's finished and we have an official announcement for it.

[Maestro]

I noticed that one of the permissions asked for is location.

 

Login is necessary, but I found no way of logging out. Does this mean that I can be tracked even after I close the app?

[ThomasThBKK]

11 hours ago, Maestro said:

I noticed that one of the permissions asked for is location.

 

Login is necessary, but I found no way of logging out. Does this mean that I can be tracked even after I close the app?

No if it's not a malicious app per say the tracking stops when u close the app.

 

I will just use that on a burner phone, some old android phone/tablet is cheap anyway, no need to run immigration apps on your real phone imo - but i do welcome that this makes everything easier, so thats a good change.