Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Privacy Security IT Your Rights Online

Baidu Browser Acts Like a Mildly Tempered Infostealer Virus 97

Posted by timothy from the ever-so-gentle dept.
An anonymous reader writes: The Baidu Web browser for Windows and Android exhibits behavior that could easily be categorized by a security researcher as an infostealer virus because the browser collects information on its users, and then sends it to Baidu's home servers.

Both versions collected waaaaay to much information that has nothing to do with analytics, like hard drive models, CPU serials, and personal browsing history. The browser collected and sent this information on startup, when the user started typing content in his address bar, and on any page view. Some of this was sent via unencrypted connections. Additionally, the browser update did not use code signatures, meaning you could man-in-the-middle the connection and send anything you'd like to the browser, from Pokemon games to banking trojans, and have it installed locally.
This discussion has been archived. No new comments can be posted.

Baidu Browser Acts Like a Mildly Tempered Infostealer Virus More

Baidu Browser Acts Like a Mildly Tempered Infostealer Virus

Comments Filter:

  • All 'telemetry' is SPYING. (Score:4, Insightful)

    by Anonymous Coward on Wednesday February 24, 2016 @11:26AM (#51575163)

    All 'telemetry' is SPYING.

  • The is the first time I have heard of the browser and the name 'Baidu' elicits the sense of something that you would not trust from some Asian origin.
    • I could be mistaking it for another Chinese company, but I believe this is not the first time Baidu has come under fire for phoning home excessively and with unrelated data.

    • Re: (Score:1)

      by Anonymous Coward

      Baidu is the equivalent of Google (which is blocked in China but wasn't that popular to begin with) for 1.3 billion Chinese. It's the first place they go to search. Like Google, there are alternatives. When my phone broke in China and I had to buy a new Android phone, it came (like most phones in the Chinese market) with Baidu everything -- Baidu app store, Baidu browser default, etc. Remember that Google (including Google play) is blocked, so these are the default Android apps. In other words, it has

  • China. (Score:4, Insightful)

    by Anonymous Coward on Wednesday February 24, 2016 @11:27AM (#51575175)

    What else would you expect?

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      microsoft, google, and facebook are u.s. companies... datamining users for fun and profit and for government goodwill is not country-specific.

      • Re: (Score:2)

        by mjwx ( 966435 )

        microsoft, google, and facebook are u.s. companies... datamining users for fun and profit and for government goodwill is not country-specific.

        Yes, but Facebook, Google, Apple and Microsoft are all Companies, therefore any action they take is doubleplus(R) good(TM). Baidu is partially state owned by the Chinese, therefore that is Baaaaad.

        It seems like you're starting to de-capitalise comrade, report to the neared Rand centre for re-education citizen.

    • With the number of hacks coming from China, I'd at least expect them to understand the value of signing their code.

  • waaaaay too pregnant (Score:4, Insightful)

    by Pseudonymous Powers ( 4097097 ) on Wednesday February 24, 2016 @11:30AM (#51575197)

    Both versions collected waaaaay to much information that has nothing to do with analytics...

    This is a meaningless statement, mostly because "analytics" is always a just a weasel-word for "spying". The only acceptable amount is zero.

    • Re: (Score:2)

      by vux984 ( 928602 )

      Not really.

      If you run a grocery store and you put X on the left in one store, and on the right in another, and you record that it sells better when on the left, and then change all your stores, that's analytics too. Its not "spying", its not a weasel word for spying.

      There are all kinds of ways one can do analytics without "spying". Hell, serving have your web visitors one ad, and half the other and seeing which has a better sales coversion rate, that's analytics too.

      • Yes, okay, fine, I misspoke: The word "analytics" can mean things other than spying. Just not in the context of web browsers that phone home. There is no God damn thing about my browsing habits I want the maker of my browser knowing. Not what, not where, not when, not how long, not how much, not what type. I guess I'm not too worried about them knowing I downloaded it, but then again, if I could conceal even that datum from them, I would.

  • waaaaay to much leniency (Score:2, Interesting)

    by Anonymous Coward

    timothy, do your job ffs. and by that I don't mean shill for your benefactors, I mean EDIT.

  • Baidu is relentless (Score:5, Interesting)

    by JustAnotherOldGuy ( 4145623 ) on Wednesday February 24, 2016 @11:47AM (#51575319) Journal

    The Baidu search spider is relentless...I see thousands of connections and scans from it every day on many of the sites I own and admin. The logs often contain literally tens of thousands of lines of Baidu requests, and the spider completely ignores the robots.txt file. For example, this usually does not work:

    #Baiduspider
    User-agent: Baiduspider
    Disallow: /     ...and neither do most of the other snippets and directives that are supposed to block the Baidu search spider, because it often misrepresents itself.

    The only relief is to block the IPs that Baidu comes from, but it's a huge range, hundreds of IPs. It's almost easier just to block all of China.

    • Re: (Score:1)

      by Anonymous Coward

      It's almost easier just to block all of China.

      I was going to make a joke about what a devilishly clever scheme this is - to make the rest of the world implement a great firewall of China, rather than having to do it themselves... but now I'm not completely positive anymore that it would not contain a grain of truth...

    • This whole idea of robots.txt is dumb. Its based on the honor system. Imagine if the rest of internet security worked like that. Plenty of awesome sites have gone away and not been archived because of robots.txt.

      • Re: (Score:1)

        by Gr8Apes ( 679165 )
        it would be better to have the robots.txt file delivered and then act upon it yourself for those known to be bad actors, like a proxy. Think of the wonderful results you could have search engines display if they ignored your robots.txt. Sometimes the best defense is a good offense.

    • ...The only relief is to block the IPs that Baidu comes from, but it's a huge range, hundreds of IPs....

      I also have been assaulted by the baiduBot relentless search patterns.

      .
      It is one of the very, very few search bots that do not follow robots.txt directives. (bing and yandex being the other two that I've seen)

    • Re: (Score:1)

      by sehlat ( 180760 )

      So who wrote the spider? Baidu or 3PLA? [wsj.com]

  • ", as requested by the Chinese government." --- There, I fixed it for you, since you accidentally stopped your last sentence too soon.

  • That's the OS' business!

  • Remember this, people (Score:3)

    by argStyopa ( 232550 ) on Wednesday February 24, 2016 @01:50PM (#51576171) Journal

    While I'd be the LAST one to exonerate the misdeeds of my own United States...for all those decrying the "US controls the internet" and all the painting of the US as some sort of malignant capitalist force in the world generally: understand that your actual choice ISN'T the US vs whatever utopia you have cooked up in your head where governments aren't power-hungry monsters and commerce is run by the pleasant hippy guy down at your local co-op who gives you free snacks and coffee "for whatever you feel is fair, dude".

    No, the ACTUAL choices in the world we live in are:
    - the US
    - China
    - maybe Russia ...as your superpowers.

    As much as the US is deeply flawed in many ways, it's still orders of magnitude more benign than the alternatives.

    • Re: (Score:2)

      by mjwx ( 966435 )

      While I'd be the LAST one to exonerate the misdeeds of my own United States...for all those decrying the "US controls the internet" and all the painting of the US as some sort of malignant capitalist force in the world generally: understand that your actual choice ISN'T the US vs whatever utopia you have cooked up in your head where governments aren't power-hungry monsters and commerce is run by the pleasant hippy guy down at your local co-op who gives you free snacks and coffee "for whatever you feel is fair, dude".

      No, the ACTUAL choices in the world we live in are:
      - the US
      - China
      - maybe Russia ...as your superpowers.

      As much as the US is deeply flawed in many ways, it's still orders of magnitude more benign than the alternatives.

      Swap Russia for the EU.

      Whilst they're slow to act, they are a force to reckon with once roused. They are the single largest economic bloc and are definitely a super power militarily.

      Russia has lost superpower status and has fallen in to the BRIC group of minor powers (Brazil, Russia, India, China).

      • The EU a "super power" militarily? Bwahaha.

        First, you need to have a military: They couldn't even bomb some Libyan bandits without running out of bombs and needing US air control and mid-air refueling. 5 of the 28 members of NATO even bother to meet their treaty-obligated minimum defense budgets, much less anything more. Most EU country militaries are barely more than ill-concealed jobs programs, and are populated a few patriots but mostly by the hopeless dregs that for some reason can't simply do nothin

  • Both versions collected waaaaay to much information that has nothing to do with analytics, like hard drive models,

    *too

Slashdot Top Deals

"The vast majority of successful major crimes against property are perpetrated by individuals abusing positions of trust." -- Lawrence Dalzell

Close