Slashdot Mirror
Baidu Browser Acts Like a Mildly Tempered Infostealer Virus
An anonymous reader writes: The Baidu Web browser for Windows and Android exhibits behavior that could easily be categorized by a security researcher as an infostealer virus because the browser collects information on its users, and then sends it to Baidu's home servers.
Both versions collected waaaaay to much information that has nothing to do with analytics, like hard drive models, CPU serials, and personal browsing history. The browser collected and sent this information on startup, when the user started typing content in his address bar, and on any page view. Some of this was sent via unencrypted connections. Additionally, the browser update did not use code signatures, meaning you could man-in-the-middle the connection and send anything you'd like to the browser, from Pokemon games to banking trojans, and have it installed locally.
Both versions collected waaaaay to much information that has nothing to do with analytics, like hard drive models, CPU serials, and personal browsing history. The browser collected and sent this information on startup, when the user started typing content in his address bar, and on any page view. Some of this was sent via unencrypted connections. Additionally, the browser update did not use code signatures, meaning you could man-in-the-middle the connection and send anything you'd like to the browser, from Pokemon games to banking trojans, and have it installed locally.
All 'telemetry' is SPYING.
The is the first time I have heard of the browser and the name 'Baidu' elicits the sense of something that you would not trust from some Asian origin.
love is just extroverted narcissism
What else would you expect?
I keep hearing this. Where are the packet dumps showing what info is collected?
Only the State obtains its revenue by coercion. - Murray Rothbard
http://www.urbandictionary.com/define.php?term=Way+Too
Both versions collected waaaaay to much information that has nothing to do with analytics...
This is a meaningless statement, mostly because "analytics" is always a just a weasel-word for "spying". The only acceptable amount is zero.
Speaking of spyware.... Slashdot doesn't seem to concerned about people's privacy either.
From my perspective, viruses are the most evilest thing since Dial Up Internet Service. I have dealt with them in the past and had bad results from them. Especially if it involves trojans... they might look nice on the outside, but on the inside... they're retarded and disgusting...
Have a rice day.
So the Baidu browser is a part of Windows 10?
It's different in that it's information are set to those horrible Chinese people, instead of those wonderful people at Google who have that sweet "Do no evil" motto.
HexaByte - he's a square and a half!
timothy, do your job ffs. and by that I don't mean shill for your benefactors, I mean EDIT.
Well I guess someone from China needs to pop in here and give their opinion. Fact is though Baidu is a blight on the internet. They are not a search engine or other internet related "company", they are a Chinese government collection tool. In typical Chinese fashion, they steal and cheat instead of innovate.
Get with the times. To better serve our customers, it's necessary that we know what kind of hardware our software is used on. Our software, got that? Everybody does it.
I hope you're trolling.
I've been asking for the same from the anti-Microsoft crowd about the Windows 10 packets, and all I've ever been given was a link to a hosts file with a section called "Windows 10 telemetry blocking."
WTF? How does a browser even get the serial number of the CPU?
Get over it. You don't like it don't use it or circumvent it!
The Baidu search spider is relentless...I see thousands of connections and scans from it every day on many of the sites I own and admin. The logs often contain literally tens of thousands of lines of Baidu requests, and the spider completely ignores the robots.txt file. For example, this usually does not work:
#Baiduspider / ...and neither do most of the other snippets and directives that are supposed to block the Baidu search spider, because it often misrepresents itself.
User-agent: Baiduspider
Disallow:
The only relief is to block the IPs that Baidu comes from, but it's a huge range, hundreds of IPs. It's almost easier just to block all of China.
Just cruising through this digital world at 33 1/3 rpm...
Have a lice day.
Thought they got rid of that motto?
i'm getting on chrome and chromium.
It is definitely different in the scope of what is being collected. It is important to make a distinction even if they are both intrusive to some degree.
Why bother?
This is spyware, not virus.
Waaaaay long ago
You can use Baidu to actually search for plans all over China that was stolen over the years. It's all out in the open. Proprietary stuff, code, designs, it makes me laugh.
They just got rid of the "no".
This whole idea of robots.txt is dumb. Its based on the honor system. Imagine if the rest of internet security worked like that. Plenty of awesome sites have gone away and not been archived because of robots.txt.
Only the State obtains its revenue by coercion. - Murray Rothbard
And how does anyone follow the "waaaaay" there?
In a related question, does timothy own a dictionary?
There is no such thing as Frist Psot or Nice Day. They are merely social constructs.
Don't you guys know the difference between a Trojan and a virus?
He's not.
Every single company does this to an extent. Some aren't upfront about it like Google and Microsoft.
Of the user and the user machine and the user software.
So aren't the users mostly in China?
Or are some upstarts trying out the Baidu thingie in the rest of the world?
BTW - how easy is it to totally block China? ( and MS, Apple, FB, Google, Yahoo.....)
So the web browser is a virus/spyware....
Found this on reddit:
've seen theres a lot of speculation on whether the observed network connections from Windows 10 with privacy options on are actually spying or not, and figured some actual evidence would be in order.
Anyone can recreate this for themselves:
Fresh install of Windows 10.
Set all privacy options to off, disable cortana, disable web search
Ensure all updates are done. Close all programs.
Install Fiddler, and enable HTTPS sniffing. (If you use wireshark, you wont be able to view the HTTPS)
Press stream in fiddler.
Click the windows search bar, type any letter, watch the HTTPS session to bing.com appear.
Im still trying to figure out exactly what it is that it is transmitting, but its for sure sending a user-agent string that identifies itself as Cortana.
Some observed behaviors:
Clicking on a link from an application (in this case, a download link from within Fiddler) submits the URL you are visiting to urs.microsoft.com.
Opening applications-- even with SmartScreen disabled-- opens sessions to apprep.smartscreen.microsoft.com and, among other things, submits the hash of the application. EDIT: Apparently you must also disable smartscreen in edge. Even so, it will initiate a connection to w.apprep.smartscreen.microsoft.com
Typing anything into the search bar will, regardless of settings, initiate an HTTPS session to www.bing.com. It will transmit a cookie, though so far I have not seen anything in there that looks like keystroke monitoring, as the only thing that appears to change between attempts is an HV section of the cookie. It appears to be downloading javascript, and submitting identifying data (screen resolution, install date, SID). The URL it uses is https://www.bing.com/manifest/...
Opening the settings app and going into account options sometimes opens a session to public-family.api.account.microsoft.com:443. I suppose this would be expected.
", as requested by the Chinese government." --- There, I fixed it for you, since you accidentally stopped your last sentence too soon.
Found this on reddit:
've seen theres a lot of speculation on whether the observed network connections from Windows 10 with privacy options on are actually spying or not, and figured some actual evidence would be in order.
Anyone can recreate this for themselves:
Fresh install of Windows 10.
Set all privacy options to off, disable cortana, disable web search
Ensure all updates are done. Close all programs.
Install Fiddler, and enable HTTPS sniffing. (If you use wireshark, you wont be able to view the HTTPS)
Press stream in fiddler.
Click the windows search bar, type any letter, watch the HTTPS session to bing.com appear.
Im still trying to figure out exactly what it is that it is transmitting, but its for sure sending a user-agent string that identifies itself as Cortana.
Some observed behaviors:
Clicking on a link from an application (in this case, a download link from within Fiddler) submits the URL you are visiting to urs.microsoft.com.
Opening applications-- even with SmartScreen disabled-- opens sessions to apprep.smartscreen.microsoft.com and, among other things, submits the hash of the application. EDIT: Apparently you must also disable smartscreen in edge. Even so, it will initiate a connection to w.apprep.smartscreen.microsoft.com
Typing anything into the search bar will, regardless of settings, initiate an HTTPS session to www.bing.com. It will transmit a cookie, though so far I have not seen anything in there that looks like keystroke monitoring, as the only thing that appears to change between attempts is an HV section of the cookie. It appears to be downloading javascript, and submitting identifying data (screen resolution, install date, SID). The URL it uses is https://www.bing.com/manifest/...
Opening the settings app and going into account options sometimes opens a session to public-family.api.account.microsoft.com:443. I suppose this would be expected.
Looks like I have some more firewall rules to add.
Trolling? What exactly do you find objectionable about that comment?
Telemetry, not analytics? This kind of functionality is indeed called telemetry when it is embedded in applications and not in web sites.
Get with the times? This ties in with both the "telemetry, not analytics" point and the "everybody does it" aspect. Things have changed. The outrage about an application collecting data, even though I completely understand it, is indeed anachronistic.
To better serve our customers? That is the same kind of bullshit that literally everybody else uses to justify why their software phones home (another anachronism). See Valve's hardware stats for one example, but don't kid yourself. It is everywhere. Note that I left open who "our customers" are.
Our software? Just for kicks, read a couple of EULAs. You don't own commercial software. You are merely granted temporary usage rights.
Everybody does it? Yes, that's offensive, but it's also true. None of the big ones, not even well known open source projects, can throw the first stone at Baidu. They might point out that Baidu takes too much, but in principle they're all doing it.
They are in good company.
Windows 10 is tracking you. (Link)
Google Chrome is tracking you (Link), well actually recording you, but still...
Facebook tracks the hell out of you (Link), logged in or not (Link)
"Both versions collected waaaaay to much information that has nothing to do with analytics..."
Maybe someone could use Baidu to search for the difference between "to" and "too?"
It's different in that it's information are set to those horrible Chinese people, instead of those wonderful people at Google who have that sweet "Do no evil" motto.
Chromium is open source, so you know exactly what's being transmitted, and you can audit it yourself if you like. Baidu is a black box and you have no idea what's coming or going.
That's the OS' business!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
your browser surfs YOU
I think the most correct action to take is to not install Windows 10.
Religion: The greatest weapon of mass destruction of all time
While I'd be the LAST one to exonerate the misdeeds of my own United States...for all those decrying the "US controls the internet" and all the painting of the US as some sort of malignant capitalist force in the world generally: understand that your actual choice ISN'T the US vs whatever utopia you have cooked up in your head where governments aren't power-hungry monsters and commerce is run by the pleasant hippy guy down at your local co-op who gives you free snacks and coffee "for whatever you feel is fair, dude".
No, the ACTUAL choices in the world we live in are: ...as your superpowers.
- the US
- China
- maybe Russia
As much as the US is deeply flawed in many ways, it's still orders of magnitude more benign than the alternatives.
-Styopa
It's different in that it's information are set to those horrible Chinese people, instead of those wonderful people at Google who have that sweet "Do no evil" motto.
Don't Be Evil. FTFY.
It's different in that it's information are set to those horrible Chinese people, instead of those wonderful people at Google who have that sweet "Do no evil" motto.
It's different in that I'm not mandated by my government to use Chrome, and they aren't going to come throw me in jail for using a different browser or interfering with the data collection. Assuming the data collection is even remotely on par, which it isn't.
> Found this on reddit:
not sure why you didn't link the original.
https://www.reddit.com/r/Windo...
No. They got rid of it and replaced it with "Do as we say, not as we do."
but since it's Chinese, let's blow it all out of proportion.
So what's the big deal? Windows 10 collects telemetry too and privacy is a thing of the past. If you are OK with Windows 10, then you cannot complain about this.
How is this different from Microsoft? In what way is being spied by a corporation better/worse than being spied by another?
Getting hardware details? I thought that was the idea behind that Genuine authentication... I really don't see any difference.
Mozilla Firefox will be inspired by this browser and roll up yet another forced donotwant update with similar features because people keep unchecking that damn Send Crash Report box!!!!
Lol. Avoiding MiTM doesn't require code signing, it requires encrypted connections (typically with certificate checks, but not always).
Microsoft encrypts everything that it steals from you, not to protect you, but the prevent you from knowing what they are stealing.
*too
This comment is my opinion and does not represent an official position of Donald Trump or others I do not work for