Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
China Privacy The Internet Technology

Chinese Mobile Phone Cameras Are Not-So-Secretly Recording Users' Activities (globalvoices.org) 91

Posted by msmash from the closer-look dept.
Oiwan Lam, reporting for Global Voices: It has been widely reported that software and web applications made in China are often built with a "backdoor" feature, allowing the manufacturer or the government to monitor and collect data from the user's device. But how exactly does the backdoor feature work? Recent discussion among mobile phone users in mainland China has shed some light on the question.

Last month, users of Vivo NEX, a Chinese Android phone, found that when they opened certain applications on the phone, including Chinese internet giant QQ browser and travel booking app Ctrip, the mobile device's camera would self-activate. [...] One Weibo user observed that the retractable camera self-activates whenever he opens a new chat on Telegram, a messaging application designed for secured and encrypted communication.

[...] After the news of the self-activated camera bug spread, users started testing the issue on other applications and found that Baidu's voice input application has access to both the camera and voice recording function, which can be launched without users' authorization. A Vivo NEX user found that once she had installed Baidu's voice input system, it would activate the phone's camera and sound recording function whenever the user opened any application -- including chat apps, browsers -- that allows the user to input text.
This discussion has been archived. No new comments can be posted.

Chinese Mobile Phone Cameras Are Not-So-Secretly Recording Users' Activities More

Chinese Mobile Phone Cameras Are Not-So-Secretly Recording Users' Activities

Comments Filter:

  • North Korea proved that an entire county can be subjugated in a 1984 fashion for long periods of time. China keeps moving that way instead of toward more openness and freedom. I would expect that to limit their economic growth at some point, but who knows. Freedom is not a given in the future of any country.

    • Re: (Score:3, Insightful)

      by Anonymous Coward

      If China were the only one moving that way, it would possibly limit their economic growth. The problem is the entire WORLD seems to be moving that way, some at a faster rate than others. But it's not like I can honestly look at my United States and say we aren't doing the exact same thing, and whenever one of us plebes mention it in a public forum all that has to happen is somebody whines about how it's for our own protection and then it ceases to be an issue of importance.

      • North Korea, China, UK, USA.

        Who's next?

        • Re: (Score:2)

          by tsa ( 15680 )

          In the Netherlands we also know how to keep an eye on our citizens. But we sem to be working to go in the opposite direction, luckily.

    • And that includes America. (Score:2, Insightful)

      by Anonymous Coward

      Our phones spy on us. They send that data to everyone who is interested. It goes to google and apple, it goes to your carrier, it goes to whoever wrote any app at all that you installed on your phone, and it goes to the government. This is not paranoia. This has all been demonstrated.

      And dumbphones aren't off the hook. Your location data is sent back to your carrier at all times, and the government can remotely and covertly activate your mic and camera at any time to spy on you (presumably, with a warr

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        What Orwell failed to predict is that we'd buy the cameras ourselves, and that our biggest fear would be that nobody was watching. -- Keith Lowell Jensen [twitter.com]

      • Re: (Score:2)

        by schnell ( 163007 )

        Our phones spy on us. They send that data to everyone who is interested. It goes to google and apple, it goes to your carrier, it goes to whoever wrote any app at all that you installed on your phone, and it goes to the government. This is not paranoia. This has all been demonstrated.

        It's really not that simple or that nefarious. Your data does not go to "everyone who is interested." At least in the US, it goes to potentially five groups of people depending on circumstances:

        • Your cellphone carrier: Otherwise your phone would not work. The cell network can locate you based on which tower(s) you can "see" and which sectors, within a resolution of several hundred meters. Additionally, Android (but not iOS) will let your carrier ask the phone for its GPS location. This was originally done

    • Re: (Score:2)

      by PPH ( 736903 )

      Beware of leaders with funny hairstyles. Things have been going downhill here since Eisenhower.

    • I would expect that to limit their economic growth at some point

      I don't know why it would. I mean, "don't do your job well and the police will beat you for 30 minutes" is a pretty excellent motivator for their workers... or even the bosses.

  • Would the same level of abuse be possible with Apple iOS, or is this intrinsic flaw in open-sourced Android where it is possible to modify OS functionality without it becoming obvious?

    • Would the same level of abuse be possible with Apple iOS, or is this intrinsic flaw in open-sourced Android where it is possible to modify OS functionality without it becoming obvious?

      The examples in the summary are apps.

      It's just that a voice input app will kick in whenever a keyboard is needed - oops.

      • Re: (Score:2)

        by tlhIngan ( 30335 )

        Blockquote>

        Would the same level of abuse be possible with Apple iOS, or is this intrinsic flaw in open-sourced Android where it is possible to modify OS functionality without it becoming obvious?

        The examples in the summary are apps.

        It's just that a voice input app will kick in whenever a keyboard is needed - oops.

        Except iOS keyboard apps are restricted by default into only doing a few things, and must be functional in restricted mode. If a user wants, they may remove the restriction, allowing they keybo

    • Re:Would the same be possible with Apple iOS? (Score:4, Informative)

      by carlhaagen ( 1021273 ) on Wednesday July 11, 2018 @01:52PM (#56930654)
      While the level of scrutiny and inspection procedures performed by Apple before publishing an iOS application is on a completely different level than that of Google and their Play Store, it's technically possible. But the case with these Chinese Android phones isn't really about this or that rogue app possibly showing up on the Play Store, but rather that they all come with a customized Android build prepared from start with a selection of malware/spyware. It's a complete ready-to-go, ready-to-spy package.

    • Re:Would the same be possible with Apple iOS? (Score:5, Informative)

      by Solandri ( 704621 ) on Wednesday July 11, 2018 @02:34PM (#56930870)
      Both iOS and Android already give the device owner control over what functions an app is able to access. For example, Android notified me that an update to one of the games on my tablet was asking for access to the microphone and camera. I of course denied those permissions (the game seems to run just fine without them). Since my tablet is rooted, I also get control over which apps are allowed to use the network. So even with the few programs which need such access (like a photo-to-PDF converter), I'm confident it isn't transmitting info about me back to the app maker.

      There are two reasons for the problem.
      • Certain apps need such permissions. The voice input app mentioned in the summary requires access to the microphone to function. The maker of the app can then abuse that permission to use the microphone to record conversations and transmit them back to the mothership. This is even more insidious with voice recognition apps, which have to record conversations and transmit them back for the recognition stage anyway. At that point the difference between legitimate and illegitimate use becomes whether the company keeps the recordings on file, or deletes them after the recognition is completed (which is why I've long advocated that voice recognition be moved to the device itself now that processors are getting to the point where that's feasible). It's impossible for OS-level restrictions to prevent this type of abuse.
      • China has encouraged forking Android and developing its own version for use in the Chinese market. Ostensibly this is to reduce the amount of control foreign companies (namely Google) have over products used within China. Most people however suspect that it's done so the Chinese government can insert its own monitoring software directly within the OS itself. The kind of stuff the NSA only dreams it could do. The maker of an open-source OS has no control over what happens to forks.

  • This is the default situation... (Score:5, Interesting)

    by carlhaagen ( 1021273 ) on Wednesday July 11, 2018 @01:47PM (#56930628)
    ...with practically any cheap Chinese crapdroid phone/tablet, as well as Android TV boxes, aimed at the western markets - pretty much all of them run customized (often half-assed) Android builds bundled with various sets of malware/spyware. This even goes for the somewhat larger brands that have an office presence on the European continent trying to profile themselves in the west with TV/magazine/sports advertisements, like f.e. Doogee and Oukitel.

    Over the past 5-6 years I've purchased close to two dozen Chines phones/tablets (as development toys) in both the low and mid price tiers, and I've yet to find a single one that actually comes with a clean and honest Android build. Spending time on the various Android phone/tablet hacking forums on the Internet you'll find droves of new reports about this every month, and all popular Chinese brands are mentioned.

    • Re: (Score:2)

      by OYAHHH ( 322809 )

      Android, the OS itself, it one huge piece of spyware. Don't limit it to just Chinese produced items.

  • Wasn't this expected? (Score:5, Interesting)

    by EndlessNameless ( 673105 ) on Wednesday July 11, 2018 @01:53PM (#56930666)

    Baidu's voice input system... would activate... whenever the user opened any application... that allows the user to input text

    So, looking at the technical underpinning, it functions like the native keyboard app, which loads on demand for applications which support its input.

    I can't reach the article, so here is the real question: Is there evidence of nefarious activity, particularly the suspicious caching or transmission of data?

    Because a camera/mic activating on its own isn't necessarily doing much of anything. It certainly merits investigation, but the headline is not justified by the content of the summary.

    After all, if it's "not-so-secretly" doing bad things, there should be plentiful, clear evidence of bad things happening. If there are hours of audio/video being recorded or transmitted by some phone, why not mention that?

    • Well, that's better worded than what I was probably going to say, so thank you.

      It does seem like it's just the voice input kicking in when you're likely to want it, not a nefarious plot. Besides, the Party probably has better bits of spyware on there already.

  • black mirror, whoa-ah-oh.

  • Black PVC tape (Score:3)

    by gweihir ( 88907 ) on Wednesday July 11, 2018 @02:29PM (#56930846)

    The only way to deal with cameras that do not have a hard-wired activation light.

    • I do this on my current phone, but am always still worried about the microphone. You can't easily muffle a microphone from all sound.

      • Re: (Score:2)

        by gweihir ( 88907 )

        Ah, yes. And you cannot rip it out either (as I did with my Amazon tablet as their voice assistant cannot be removed), because then it does not work as a phone anymore. I think there is no good solution for microphones at the moment. Hopefully somebody will find one soon.

    • Maybe that's how they found out: the phone mentioned in TFA has an all-screen front, with the front facing camera sliding out of the top of the phone when needed. The thing popped up when people opened Telegram, for instance.

    • Re: (Score:2)

      by antdude ( 79039 )

      What about microphones?

  • Support Purism products (Score:3)

    by TheDarkener ( 198348 ) on Wednesday July 11, 2018 @02:39PM (#56930900) Homepage

    Purism products offer hardware kill-switches for camera, mic and multiple radios (bluetooth/wifi/...). They are vigilant in defending against shit like what is happening these days, likely not only in China.

    From Wikipedia ( https://en.wikipedia.org/wiki/... [wikipedia.org] ):

    "Librem is a line of computers manufactured by Purism, SPC featuring free (libre) hardware and software.[1][2][3][4][5][6] The laptop line is designed to protect privacy and freedom by providing no non-free (proprietary) software in the operating system or kernel,[7][8][9][10] avoiding the Intel Active Management Technology,[11] and gradually freeing and securing firmware.[12][13] Librem laptops feature hardware kill switches[14][15][16] for the microphone, webcam, Bluetooth, & Wi-Fi, and can be purchased air gapped."

    If you support these companies the security and privacy bar for all manufacturers will raise.

  • Not limited to China (Score:5, Interesting)

    by OYAHHH ( 322809 ) on Wednesday July 11, 2018 @02:57PM (#56930986)

    Google,

    On it's Android platform is scanning every single url your phone is accessing and feeding those URLs into it's spider.

    How do I know? I am developing an Android app which has NEVER been released, thus the website URLs used are supposed to be 100% private. Google's spider has been scanning every single one of my private website urls as accessed by my private Android app.

    So, this crap is not limited to China.

    • Interesting. The only arguably legitimate reason that I can think of would be if the Android web client API has some kind of anti-malicious-website functionality built-in, for which Google automatically checks for hostile or compromised websites. In any case, I have a couple of other tests that could prove illuminating, if you are interested in doing them:

      1. If you access a new URL in your website from the same Internet connection but another device, does Google's spider scan it? If not, that would help to

  • Until there is a version of wireshark that works on the phone bands (wireless-shark) - more or less a stingray that can be had by consumers, this is going to:
    A: happen and only get worse.
    B: be denied and essentially not proveable.
    This all depends on what amounts to a technical arms race the consumer has lost.

    • Until there is a version of wireshark that works on the phone bands (wireless-shark) - more or less a stingray that can be had by consumers,

      Not more or less, it literally has to be that way... because the radio module code is closed-source by law to prevent tampering, and you can never trust that part of your phone.

      • Well, whip or chop does seem the right thing for a device that can talk to the internet without you having a way of knowing who it's talking to about what. Of course, some is lazy lusers - a lot of phone-home controversy could have been trivially settled one way or the other with plain old wireshark for machines that were wire or wifi only (if you had access to the wired side of wifi which most of us at home do).
        //
        One wonders why even the companies so accused didn't provide set up info to look at their ou
  • So the Chinese Govt and Intelligence has gone Full Big-Brother in creating a surveillance state, what's missing is an official statement that if you use electronic devices in China then you will be tracked. In contrast, US Intelligence has taken half measures by creating/finding backdoors of their own. Which of these approaches is worse?

    • So the Chinese Govt and Intelligence has gone Full Big-Brother in creating a surveillance state, what's missing is an official statement that if you use electronic devices in China then you will be tracked. In contrast, US Intelligence has taken half measures by creating/finding backdoors of their own. Which of these approaches is worse?

      If an organization hides their power, they often do so because they know someone could take it away from them, particularly when that activity is legally questionable.

      When an organization is arrogant enough to essentially broadcast their power and rub it in your fucking face, they do so because they know there's not a damn thing you or anyone else can do about it.

      Both approaches are bad, but China has gone from bad to worse.

  • It's a snooping bug, not a software bug. The system is working exactly as designed to let apps be voyeurs.

  • But, hey, it's not just China.

  • This is China (Score:4, Insightful)

    by nospam007 ( 722110 ) * on Wednesday July 11, 2018 @04:14PM (#56931338)

    It's not a backdoor, it's a frontdoor.

  • Suddenly motorized pop-up cameras on phones doesn't sound so stupid at all.

    Next I propose we give some app-developers the SAW-treatment with the phone and a gun mounted on a helmet, and the camera pushing the trigger if comes up.

  • Jesus the hysterical crazies are out in force today.

    . A Vivo NEX user found that once she had installed Baidu's voice input system, it would activate the phone's camera and sound recording function whenever the user opened any application -- including chat apps, browsers -- that allows the user to input text.

    How the fuck did she think voice input would work if it didn't use the microphone?

  • In soviet China the phone watches you!

Slashdot Top Deals

Whoever dies with the most toys wins.

Close