Slashdot Mirror
Viral Chinese Selfie App Meitu, Valued at Over $5 Billion, Phones Home With Personal Data (theregister.co.uk)
The Meitu selfie horrorshow app going viral through Western audiences is a privacy nightmare, researchers say. The app, which has been featured on several popular outlets including the NYTimes, USA Today, and NYMag, harvests information about the devices on which it runs, includes invasive advertising tracking features and is just badly coded. From a report: But worst of all, the free app appears to be phoning some to share personal data with its makers. Meitu, a Chinese production, includes in its code up to three checks to determine if an iPhone handset is jailbroken, according to respected forensics man Jonathan Zdziarski, a function to grab mobile provider information, and various analytics capabilities. Zdziarski says the app also appears to build a unique device profile based in part on a handset's MAC address. "Meitu is a throw-together of multiple analytics and marketing/ad tracking packages, with something cute to get people to use it," Zdziarski says. Unique phone IMEI numbers are shipped to dozens of Chinese servers, malware researcher FourOctets found. The app, which was valued at over $5 billion last year due its popularity, seeks access to device and app history; accurate location; phone status; USB, photos, and files storage read and write; camera; Wifi connections; device ID & call information; full network access, run at startup, and prevent device from sleeping on Android phones.
Selfie app valued at $5 billion? *head asplodes*
It's almost as if this story doesn't want to admit the NSA is also doing the same thing?
Microsoft does this with Windows 10, so what's wrong with selfie apps doing it?
Outside of Spotlight suggestions, which can verifiably be disabled, how does macOS phone home exactly?
"...includes in its code up to three checks to determine if an iPhone handset is jailbroken..."
When the code looks to sniff out less-than-legitimate activity, it tends to make you wonder who paid them to write it.
"Meitu is a throw-together of multiple analytics and marketing/ad tracking packages, with something cute to get people to use it.
At least we're finally being honest about what it takes to grab the attention span of the average idiot consumer.
As ignorant as people are about privacy and security, I'm starting to believe we deserve what we get when it comes to solutions.
Typically Chinese, they can't come up with anything themselves, all they can is copy our successful products!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
As has historically been shown companies will not behave in a reasonable manner unless forced to via regulation. We need to reset the bar in terms of the data that companies can collect and retain.
It's worth pointing out that iOS doesn't allow apps to access the MAC, IMEI or any other persistent unique ID field (for just this reason). There is a unique ID field designed for apps to use for device identification but it is generated by the device on a per application basis, so it cannot be correlated with other apps. It also changes if you reinstall the app. Both of these facts make it fairly useless for nefarious purposes.
---- Den ene knappen er powerknapp, den andre er Bender voice knapp "Bite My Shiny Metal Ass"
xPrivacy used to do exactly that, but it (and the XPosed framework) seems not to have been updated in years.
I'm not a millennial so I'm behind the times when it comes to apps. I've never heard of this Chinese Communist selfie app but it doesn't take an app to do a selfie. You've got an Android or iPhone builtin app to do it for you. It even lets you easily share it to Facebook. Who the hell really needs an add-on selfie app?
Get Little Snitch and watch as ** every ** app sends data to anywhere and everywhere. Adobe and Autodesk manage to try to talk to more than a dozen servers each. Some are needed for authorization (it is 2017 after all, can't just sell the software) and some are needed for who-the-hell-knows.
Even good ol Apple itself wants to talk to your little un-PC.
How is Apple responsible for what Adobe, AutoDesk, et al, do?
And I notice that you are, of course, quite vague with regard to Apple's activities in this area, as you cannot actually cite verifiable examples, instead just disparaging them with a ridiculous, snarky little comment at the end.
Should anyone be surprised about something like this?
Certainly the PRC has realized that the various spook+corps around the globe pay for dirt
Why not firewalling that out? One could install a local firewall app (root likely required) to block all that traffic!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
When I lived on China I occasionally looked at installing Chinese apps, via Play Store, when mandatory for things such as banking. They typically demand app permissions for everything, including stuff that had no relevance to the purported application. I know from working with my team of developers in China they don't dig into options, if a solution works they move on to the next thing. If ticking 'All permissions' make the app work my team would chose that unless I told them to spend more time and work out what is really needed. Therefore when presented with a Chinese app that wants all permissions I was never sure if it was a lazy app developer or overreach of the company developing the app. I refused to install these apps unless it was absolutely critical to my needs, such as getting paid.
... why they are valued $5 billion?
Phucking chinese .... from small cheese app developers to big corporations like Lenovo... they all steal personal data... yet they don't get banned from the US.