Surprise! China's top Android phones collect way more info
(2023/02/07)
- Reference: 1675738811
- News link: https://www.theregister.co.uk/2023/02/07/chinese_android_phones_leak_pii/
- Source link:
Don't buy an Android phone in China, boffins have warned, as they come crammed with preinstalled apps transmitting privacy-sensitive data to third-party domains without consent or notice.
[1]The research , conducted by Haoyu Liu (University of Edinburgh), Douglas Leith (Trinity College Dublin), and Paul Patras (University of Edinburgh), suggests that private information leakage poses a serious tracking risk to mobile phone customers in China, even when they travel abroad in countries with stronger privacy laws.
In a paper titled "Android OS Privacy Under the Loupe – A Tale from the East," the trio of university boffins analyzed the Android system apps installed on the mobile handsets of three popular smartphone vendors in China: OnePlus, Xiaomi and Oppo Realme.
[2]
The researchers looked specifically at the information transmitted by the operating system and system apps, in order to exclude user-installed software. They assume users have opted out of analytics and personalization, do not use any cloud storage or optional third-party services, and have not created an account on any platform run by the developer of the Android distribution. A sensible policy, but it doesn't seem to help much.
[3]
[4]
The pre-installed set of apps consists of Android AOSP packages, vendor code and third-party software. There are more than 30 third-party packages in each of the Android handsets with Chinese firmware, the paper says.
These include Chinese input apps like Baidu Input, IflyTek Input and Sogou Input on the Xiaomi Redmi Note 11. On the OnePlus 9R and Realme Q3 Pro, there's Baidu Map as a foreground navigation app and the AMap package, which runs continuously in the background. And there are also various news, video streaming, and online shopping apps bundled into the Chinese firmware.
[5]Inflation to kill growth prospects for smartphone sales
[6]To cut off all nearby phones with these Chinese chips, this is the bug to exploit
[7]White House pushes for total ban on US exports to Huawei
[8]Should open source sniff the geopolitical wind and ban itself in China and Russia?
Within this limited scope, the researchers found that Android handsets from the three named vendors "send a worrying amount of Personally Identifiable Information (PII) not only to the device vendor but also to service providers like Baidu and to Chinese mobile network operators."
The tested phones did so even when these network operators were not providing service – no SIM card was present or the SIM card was associated with a different network operator.
[9]
"The data we observe being transmitted includes persistent device identifiers (IMEI, MAC address, etc.), location identifiers (GPS coordinates, mobile network cell ID, etc.), user profiles (phone number, app usage patterns, app telemetry), and social connections (call/SMS history/time, contact phone numbers, etc.)," the researchers state in their paper.
"Combined, this information poses serious risks of user deanonymization and extensive tracking, particularly since in China every phone number is registered under a citizen ID."
As an example, the researchers claim that the Redmi phone sends post requests to the URL "tracking.miui.com/track/v4" whenever the preinstalled Settings, Note, Recorder, Phone, Message and Camera apps are opened and used, Data is sent even if users opt out of "Send Usage and Diagnostic Data" during device startup. POST https://tracking.miui.com/track/v4
{ "imsis": "[b2d5c6783e3fa6eef38ff1fc7dedfb10,]",..,
{"pkg": "com.xiaomi.smarthome","action": "
first_launch", "fit": 1666816796000, ...},
{"pkg": "com.android.settings","ts": 1666818456958,"
duration": 1424, ...},
{"pkg": "com.miui.securityinputmethod","ts":
1666818463544,"duration": 4706, ... },
{"pkg": "com.miui.notes","ts": 1666818784908,"stat":
"app_start",...}...}
The data collection from these devices doesn't change when the devices exit China, the researchers say, even though jurisdictions beyond the Middle Kingdom enforce more robust data protection regimes. And the boffins argue that this means the cited phone vendors and some third-parties can track Chinese travelers and students abroad and learn something about their foreign contacts.
Another of the researchers' findings is that there are three to four times more pre-installed third-party apps on Chinese Android distributions than there are on basic Android from other nations. And these apps get eight to 10 times as many permissions for third-party apps compared to Android distributions from outside China.
[10]
"Overall, our findings paint a troubling picture of the state of user data privacy in the world’s largest Android market, and highlight the urgent need for tighter privacy controls to increase the ordinary people’s trust in technology companies, many of which are partially state-owned," the researchers conclude.
The Register asked OnePlus, Xiaomi and Oppo Realme to comment but we've not heard back. ®
Get our [11]Tech Resources
[1] https://arxiv.org/abs/2302.01890
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2022/09/01/inflation_smartphone_growth_idc/
[6] https://www.theregister.com/2022/06/03/uisoc-chip-flaw-check-point/
[7] https://www.theregister.com/2023/01/31/huawei_us_exports_ban/
[8] https://www.theregister.com/2023/01/01/foss_and_geopolitics/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
[1]The research , conducted by Haoyu Liu (University of Edinburgh), Douglas Leith (Trinity College Dublin), and Paul Patras (University of Edinburgh), suggests that private information leakage poses a serious tracking risk to mobile phone customers in China, even when they travel abroad in countries with stronger privacy laws.
In a paper titled "Android OS Privacy Under the Loupe – A Tale from the East," the trio of university boffins analyzed the Android system apps installed on the mobile handsets of three popular smartphone vendors in China: OnePlus, Xiaomi and Oppo Realme.
[2]
The researchers looked specifically at the information transmitted by the operating system and system apps, in order to exclude user-installed software. They assume users have opted out of analytics and personalization, do not use any cloud storage or optional third-party services, and have not created an account on any platform run by the developer of the Android distribution. A sensible policy, but it doesn't seem to help much.
[3]
[4]
The pre-installed set of apps consists of Android AOSP packages, vendor code and third-party software. There are more than 30 third-party packages in each of the Android handsets with Chinese firmware, the paper says.
These include Chinese input apps like Baidu Input, IflyTek Input and Sogou Input on the Xiaomi Redmi Note 11. On the OnePlus 9R and Realme Q3 Pro, there's Baidu Map as a foreground navigation app and the AMap package, which runs continuously in the background. And there are also various news, video streaming, and online shopping apps bundled into the Chinese firmware.
[5]Inflation to kill growth prospects for smartphone sales
[6]To cut off all nearby phones with these Chinese chips, this is the bug to exploit
[7]White House pushes for total ban on US exports to Huawei
[8]Should open source sniff the geopolitical wind and ban itself in China and Russia?
Within this limited scope, the researchers found that Android handsets from the three named vendors "send a worrying amount of Personally Identifiable Information (PII) not only to the device vendor but also to service providers like Baidu and to Chinese mobile network operators."
The tested phones did so even when these network operators were not providing service – no SIM card was present or the SIM card was associated with a different network operator.
[9]
"The data we observe being transmitted includes persistent device identifiers (IMEI, MAC address, etc.), location identifiers (GPS coordinates, mobile network cell ID, etc.), user profiles (phone number, app usage patterns, app telemetry), and social connections (call/SMS history/time, contact phone numbers, etc.)," the researchers state in their paper.
"Combined, this information poses serious risks of user deanonymization and extensive tracking, particularly since in China every phone number is registered under a citizen ID."
As an example, the researchers claim that the Redmi phone sends post requests to the URL "tracking.miui.com/track/v4" whenever the preinstalled Settings, Note, Recorder, Phone, Message and Camera apps are opened and used, Data is sent even if users opt out of "Send Usage and Diagnostic Data" during device startup. POST https://tracking.miui.com/track/v4
{ "imsis": "[b2d5c6783e3fa6eef38ff1fc7dedfb10,]",..,
{"pkg": "com.xiaomi.smarthome","action": "
first_launch", "fit": 1666816796000, ...},
{"pkg": "com.android.settings","ts": 1666818456958,"
duration": 1424, ...},
{"pkg": "com.miui.securityinputmethod","ts":
1666818463544,"duration": 4706, ... },
{"pkg": "com.miui.notes","ts": 1666818784908,"stat":
"app_start",...}...}
The data collection from these devices doesn't change when the devices exit China, the researchers say, even though jurisdictions beyond the Middle Kingdom enforce more robust data protection regimes. And the boffins argue that this means the cited phone vendors and some third-parties can track Chinese travelers and students abroad and learn something about their foreign contacts.
Another of the researchers' findings is that there are three to four times more pre-installed third-party apps on Chinese Android distributions than there are on basic Android from other nations. And these apps get eight to 10 times as many permissions for third-party apps compared to Android distributions from outside China.
[10]
"Overall, our findings paint a troubling picture of the state of user data privacy in the world’s largest Android market, and highlight the urgent need for tighter privacy controls to increase the ordinary people’s trust in technology companies, many of which are partially state-owned," the researchers conclude.
The Register asked OnePlus, Xiaomi and Oppo Realme to comment but we've not heard back. ®
Get our [11]Tech Resources
[1] https://arxiv.org/abs/2302.01890
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2022/09/01/inflation_smartphone_growth_idc/
[6] https://www.theregister.com/2022/06/03/uisoc-chip-flaw-check-point/
[7] https://www.theregister.com/2023/01/31/huawei_us_exports_ban/
[8] https://www.theregister.com/2023/01/01/foss_and_geopolitics/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y@Ha@uvL9baAxKW@RlzVDwAAABI&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
Re: As an owner of a Xiaomi
jgarbo
Does it really matter? My Redmi Note 10 might be telling Chinese Intelligence where I had noodles in Bangkok last night. So what? Is anyone so important as to bother the Chinese with a few phone calls. More Western delusions of grandeur...
Seems to be the modern thing to do
martinusher
I watched a video recently which contrasted the domains accessed by a brand new Windows 11 laptop and a fresh Windows XP install just ater restart. The video is titled "Has Windows Become Spyware?" and is at https://youtu.be/IT4vDfA_4NI .
The answer is a resounding 'yes'. WinXP just contacts Microsoft's update site. Win11 goes off on a lengthy conversation with too many tracking sites to conveniently list.
I'm not excusing Chinese phones. They're all at it and its time we collectively put our foot down and told them to knock it off. Companies might feel they need the revenue but I think their entire brokered information / advertising model is broken but nobody dare say so because it would cause a huge part of the 'technology' industry to implode. I also object to this sort of invasiveness because its written so crudely that its all just busy/wait loops waiting on sockets -- the very worst type of code imaginable -- which has fed the need for multi-core processors, a Death Spiral of lousy programming practice consuming ever more computing (and network) resources that we've somehow convinced ourselves is leading edge software.
As an owner of a Xiaomi
Any way to stop this (without the purchase of another handset, I'm really enjoying the 1" sensor camera and leica software)?
Admittedly I probably send as much data to google with all their apps, but, would at least like to be able to curtail the worst here if nothing but to improve the system performance and cut down battery drain.