Slashdot Mirror
Viral Chinese Selfie App Meitu, Valued at Over $5 Billion, Phones Home With Personal Data (theregister.co.uk)
The Meitu selfie horrorshow app going viral through Western audiences is a privacy nightmare, researchers say. The app, which has been featured on several popular outlets including the NYTimes, USA Today, and NYMag, harvests information about the devices on which it runs, includes invasive advertising tracking features and is just badly coded. From a report: But worst of all, the free app appears to be phoning some to share personal data with its makers. Meitu, a Chinese production, includes in its code up to three checks to determine if an iPhone handset is jailbroken, according to respected forensics man Jonathan Zdziarski, a function to grab mobile provider information, and various analytics capabilities. Zdziarski says the app also appears to build a unique device profile based in part on a handset's MAC address. "Meitu is a throw-together of multiple analytics and marketing/ad tracking packages, with something cute to get people to use it," Zdziarski says. Unique phone IMEI numbers are shipped to dozens of Chinese servers, malware researcher FourOctets found. The app, which was valued at over $5 billion last year due its popularity, seeks access to device and app history; accurate location; phone status; USB, photos, and files storage read and write; camera; Wifi connections; device ID & call information; full network access, run at startup, and prevent device from sleeping on Android phones.
Selfie app valued at $5 billion? *head asplodes*
It's almost as if this story doesn't want to admit the NSA is also doing the same thing?
China makes jewish app now.
Microsoft does this with Windows 10, so what's wrong with selfie apps doing it?
Windows, macOS, iOS, Android, most of your million-users-plus apps, whatever. Everything you use today phones home and collects user info. Stop trying to make it into yet another "you can't trust the Chinese" thing. The Slashdot mill needs to stop churning out dishonest bullshit like this, and get back to what it used to be.
I own no smartphone -- yet.
But I assure you: one buy criterion will be that the OS be capable to lie to the apps when providing info (location, date & time, hardware, IMEI, other apps, versions, you name it).
The default will be "random data".
"...includes in its code up to three checks to determine if an iPhone handset is jailbroken..."
When the code looks to sniff out less-than-legitimate activity, it tends to make you wonder who paid them to write it.
"Meitu is a throw-together of multiple analytics and marketing/ad tracking packages, with something cute to get people to use it.
At least we're finally being honest about what it takes to grab the attention span of the average idiot consumer.
As ignorant as people are about privacy and security, I'm starting to believe we deserve what we get when it comes to solutions.
So Facebook does the same and nobody bats an eye.
Typically Chinese, they can't come up with anything themselves, all they can is copy our successful products!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Anything made in china phones home.
As has historically been shown companies will not behave in a reasonable manner unless forced to via regulation. We need to reset the bar in terms of the data that companies can collect and retain.
Just got redirected from slashdot to https://feimewheatbellyblog.or... for a "critical chrome update download now!"
I looked at the privacy policy and the permissions on Google Play and this app doesn't do ANYTHING that a million other apps do as well. People need to calm the fuck down.
Pay no attention to the orange man behind the curtain.
It's worth pointing out that iOS doesn't allow apps to access the MAC, IMEI or any other persistent unique ID field (for just this reason). There is a unique ID field designed for apps to use for device identification but it is generated by the device on a per application basis, so it cannot be correlated with other apps. It also changes if you reinstall the app. Both of these facts make it fairly useless for nefarious purposes.
---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"
Double whammy.
I'm not a millennial so I'm behind the times when it comes to apps. I've never heard of this Chinese Communist selfie app but it doesn't take an app to do a selfie. You've got an Android or iPhone builtin app to do it for you. It even lets you easily share it to Facebook. Who the hell really needs an add-on selfie app?
"Harvests information", "Invasive advertising tracking features", "Privacy nightmare", "Poorly coded". Yup, that's a google app.
"Meitu is a throw-together of multiple analytics and marketing/ad tracking packages, with something cute to get people to use it."
This seems to be a pretty accurate description of every cellphone made anywhere.
Just check what goes to mail servers in User-Agent as ActiveSync ID. Spoiler - it is your phone's serial number and IMEI.
I mean seriously, why is this even news?
Should anyone be surprised about something like this?
Certainly the PRC has realized that the various spook+corps around the globe pay for dirt
Why not firewalling that out? One could install a local firewall app (root likely required) to block all that traffic!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Considering the trend over the past few years it's almost like Chinese software/hardware should be vetted by foreign agencies before allowing them to go to their market places no?
When I lived on China I occasionally looked at installing Chinese apps, via Play Store, when mandatory for things such as banking. They typically demand app permissions for everything, including stuff that had no relevance to the purported application. I know from working with my team of developers in China they don't dig into options, if a solution works they move on to the next thing. If ticking 'All permissions' make the app work my team would chose that unless I told them to spend more time and work out what is really needed. Therefore when presented with a Chinese app that wants all permissions I was never sure if it was a lazy app developer or overreach of the company developing the app. I refused to install these apps unless it was absolutely critical to my needs, such as getting paid.
... why they are valued $5 billion?
Phucking chinese .... from small cheese app developers to big corporations like Lenovo... they all steal personal data... yet they don't get banned from the US.