Slashdot Mirror
Baidu Browser Acts Like a Mildly Tempered Infostealer Virus
An anonymous reader writes: The Baidu Web browser for Windows and Android exhibits behavior that could easily be categorized by a security researcher as an infostealer virus because the browser collects information on its users, and then sends it to Baidu's home servers.
Both versions collected waaaaay to much information that has nothing to do with analytics, like hard drive models, CPU serials, and personal browsing history. The browser collected and sent this information on startup, when the user started typing content in his address bar, and on any page view. Some of this was sent via unencrypted connections. Additionally, the browser update did not use code signatures, meaning you could man-in-the-middle the connection and send anything you'd like to the browser, from Pokemon games to banking trojans, and have it installed locally.
Both versions collected waaaaay to much information that has nothing to do with analytics, like hard drive models, CPU serials, and personal browsing history. The browser collected and sent this information on startup, when the user started typing content in his address bar, and on any page view. Some of this was sent via unencrypted connections. Additionally, the browser update did not use code signatures, meaning you could man-in-the-middle the connection and send anything you'd like to the browser, from Pokemon games to banking trojans, and have it installed locally.
All 'telemetry' is SPYING.
What else would you expect?
I keep hearing this. Where are the packet dumps showing what info is collected?
Only the State obtains its revenue by coercion. - Murray Rothbard
Both versions collected waaaaay to much information that has nothing to do with analytics...
This is a meaningless statement, mostly because "analytics" is always a just a weasel-word for "spying". The only acceptable amount is zero.
Have a rice day.
It's different in that it's information are set to those horrible Chinese people, instead of those wonderful people at Google who have that sweet "Do no evil" motto.
HexaByte - he's a square and a half!
timothy, do your job ffs. and by that I don't mean shill for your benefactors, I mean EDIT.
The Baidu search spider is relentless...I see thousands of connections and scans from it every day on many of the sites I own and admin. The logs often contain literally tens of thousands of lines of Baidu requests, and the spider completely ignores the robots.txt file. For example, this usually does not work:
#Baiduspider / ...and neither do most of the other snippets and directives that are supposed to block the Baidu search spider, because it often misrepresents itself.
User-agent: Baiduspider
Disallow:
The only relief is to block the IPs that Baidu comes from, but it's a huge range, hundreds of IPs. It's almost easier just to block all of China.
Just cruising through this digital world at 33 1/3 rpm...
Have a lice day.
Thought they got rid of that motto?
It is definitely different in the scope of what is being collected. It is important to make a distinction even if they are both intrusive to some degree.
The same way any other locally-executing program gets it? We're talking about the browser executable itself here, remember, not some web page executing in the Javascript sandbox.
"[Regarding the 'cloud,'] ownership was what made America different than Russia." -- Woz
Yes. You should not instantly mistrust it because it sounds Asian. That would be wrong.
You should mistrust it because this is Baidu you're talking about here.
Baidu is the Chinese "Google", the biggest Chinese search engine provider. According to Alexa, it's one of the five most visited web sites in the world. Would you like fries with your ignorance?
As a Chinese "Google," it also 100% caves into any and all government requests for censorship, page removal, data, whatever. You know there's a reason why there is no google.cn, right? And why half the time Google and all its services are blocked (not sure of the current state--it tends to go back and forth) in China.
You can use Baidu to actually search for plans all over China that was stolen over the years. It's all out in the open. Proprietary stuff, code, designs, it makes me laugh.
I actually think they meant the ProcessorId, not the serial number.
In a Windows command prompt, type:
wmic cpu get ProcessorId
You can get it for RAM
wmic memorychip get serialnumber
This information and others are exposed in APIs and is available to whoever wants to use it.
There are similar capabilities in most OSes. They're actually useful informational commands to have, but certainly you don't want to just start throwing them around the Internet.
They just got rid of the "no".
This whole idea of robots.txt is dumb. Its based on the honor system. Imagine if the rest of internet security worked like that. Plenty of awesome sites have gone away and not been archived because of robots.txt.
Only the State obtains its revenue by coercion. - Murray Rothbard
No, Redmond knows much more about your computer already. The Chinese are just trying to catch up!
HexaByte - he's a square and a half!
I could be mistaking it for another Chinese company, but I believe this is not the first time Baidu has come under fire for phoning home excessively and with unrelated data.
Baidu is the Chinese "Google", the biggest Chinese search engine provider. According to Alexa, it's one of the five most visited web sites in the world. Would you like fries with your ignorance?
Who cares about the Alexa rank of site? Yahoo.com is also one of the five most visited websites in the world and people here keep saying it's not relevant anymore.
Linux is for people who don't mind RTFM.
Found this on reddit:
've seen theres a lot of speculation on whether the observed network connections from Windows 10 with privacy options on are actually spying or not, and figured some actual evidence would be in order.
Anyone can recreate this for themselves:
Fresh install of Windows 10.
Set all privacy options to off, disable cortana, disable web search
Ensure all updates are done. Close all programs.
Install Fiddler, and enable HTTPS sniffing. (If you use wireshark, you wont be able to view the HTTPS)
Press stream in fiddler.
Click the windows search bar, type any letter, watch the HTTPS session to bing.com appear.
Im still trying to figure out exactly what it is that it is transmitting, but its for sure sending a user-agent string that identifies itself as Cortana.
Some observed behaviors:
Clicking on a link from an application (in this case, a download link from within Fiddler) submits the URL you are visiting to urs.microsoft.com.
Opening applications-- even with SmartScreen disabled-- opens sessions to apprep.smartscreen.microsoft.com and, among other things, submits the hash of the application. EDIT: Apparently you must also disable smartscreen in edge. Even so, it will initiate a connection to w.apprep.smartscreen.microsoft.com
Typing anything into the search bar will, regardless of settings, initiate an HTTPS session to www.bing.com. It will transmit a cookie, though so far I have not seen anything in there that looks like keystroke monitoring, as the only thing that appears to change between attempts is an HV section of the cookie. It appears to be downloading javascript, and submitting identifying data (screen resolution, install date, SID). The URL it uses is https://www.bing.com/manifest/...
Opening the settings app and going into account options sometimes opens a session to public-family.api.account.microsoft.com:443. I suppose this would be expected.
", as requested by the Chinese government." --- There, I fixed it for you, since you accidentally stopped your last sentence too soon.
Baidu is the equivalent of Google (which is blocked in China but wasn't that popular to begin with) for 1.3 billion Chinese. It's the first place they go to search. Like Google, there are alternatives. When my phone broke in China and I had to buy a new Android phone, it came (like most phones in the Chinese market) with Baidu everything -- Baidu app store, Baidu browser default, etc. Remember that Google (including Google play) is blocked, so these are the default Android apps. In other words, it has a pretty whopping huge installed base. I guess by default I just assumed that the Chinese government could easily acquire any information on that phone, so I just didn't store all that much. Not that it's really that different from being spied on by Google/NSA, but one gets the feeling that they sometimes act more directly on the information they collect.
It's different in that it's information are set to those horrible Chinese people, instead of those wonderful people at Google who have that sweet "Do no evil" motto.
Chromium is open source, so you know exactly what's being transmitted, and you can audit it yourself if you like. Baidu is a black box and you have no idea what's coming or going.
Specifically within wmic and the statement: 'you don't want to just start throwing them around the internet" there are a few specific scenarios and these are just some of the issues.
* accepting wmic from the internet (be it through an open port/MiTM/code injection/whatever) can allow the installing/removing/disabling of the windows firewall, patches, services, etc. - That qualifies as both bad and harmful.
* passing the output of wmic commands on the internet can allow specific targeting of your machine based on the data given and by specific I mean, knowing exactly which payload will bypass that version of EMET or ASLR. Granted, this is a bit 'general' but if I know the specific lock you are using and its serial number, I can start working out which of the possible available keys are required.
Just some things off the top of my head.
That's the OS' business!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I think the most correct action to take is to not install Windows 10.
Religion: The greatest weapon of mass destruction of all time
By the way Google got forced out of China, that company is 101% in cahoots with the government.
Go away!
While I'd be the LAST one to exonerate the misdeeds of my own United States...for all those decrying the "US controls the internet" and all the painting of the US as some sort of malignant capitalist force in the world generally: understand that your actual choice ISN'T the US vs whatever utopia you have cooked up in your head where governments aren't power-hungry monsters and commerce is run by the pleasant hippy guy down at your local co-op who gives you free snacks and coffee "for whatever you feel is fair, dude".
No, the ACTUAL choices in the world we live in are: ...as your superpowers.
- the US
- China
- maybe Russia
As much as the US is deeply flawed in many ways, it's still orders of magnitude more benign than the alternatives.
-Styopa
According to Alexa, it's one of the five most visited web sites in the world. Would you like fries with your ignorance?
There are 1.3 billion people in China, where google is banned and blocked, so I'm not sure why you're surprised that their government's replacement is one of the most heavily visited on the planet. Or why you'd be surprised that it's heavily monitored, or why you'd be surprised that the App for it does everything it can to suck as much data as it can on anyone who uses it.
No. They got rid of it and replaced it with "Do as we say, not as we do."
yahooooooooooooooooooooooooooooooo toolbarrrrrr
*too
This comment is my opinion and does not represent an official position of Donald Trump or others I do not work for
It's just wrong, yahoo is still the favourite search engine for many, even when they start by typing yahoo in their google searchtoolbar.