Slashdot Mirror
BLU Claims Innocence, Gets Phones Reinstated On Amazon (slashgear.com)
Earlier this week, Amazon suspended budget phone maker BLU from selling its phones on the site, citing a "potential security issue." A few days have passed and BLU has made its defense. SlashGear reports: AdUps, the Chinese company that provides affordable firmware update software to countless budget Android phones, is not spyware and not even Kryptowire, the security firm that broke the news last year, called it that, insists BLU. To be fair, Kryptowire really didn't. In its 2016 report, it simply described AdUps' OTA software as "FIRMWARE THAT TRANSMITTED PERSONALLY IDENTIFIABLE INFORMATION (PII) WITHOUT USER CONSENT OR DISCLOSURE." Curiously, that is more or less how the FTC defines spyware (PDF). In its 2017 follow-up, it did drop the second part of that phrase and simply reported on "mobile devices for Personally Identifiable Information (PII) collection and transmission to third parties." While BLU, and a few other OEMs, was caught unaware by the first report, it's insisting on its innocence in this second instance. Its defense stems from the argument that it is doing nothing that violates its Privacy Policy and, therefore, doesn't constitute any wrongdoing. Yes, that privacy policy that barely anyone reads, which can't legally be blamed on manufacturers anyway.
In other words, when you agreed to use BLU's devices, you basically agreed that such PII could possibly be transmitted to a third party outside the US. In this particular case, that does apply to the situation with AdUps. Interestingly, the policy's copyright dates back to 2016, when the AdUps issue first came up. The Internet Archives doesn't seem to have any version of that page before April this year. And so we come to BLU's second arguments: everybody's doing it. The data that AdUps collects is the same or even just a fraction of what other OEMs are collecting. Google is hardly the bastion of privacy and other OEMs are also collecting such data and sending it to servers in China, as is the case with Huawei and ZTE. Finally, BLU says that Kryptowire's new report really only identifies the Cubot X16S, from a Chinese OEM, as the only smartphone really spying on its users. UPDATE: BLU has confirmed that its devices "are now back up for sale on Amazon."
In other words, when you agreed to use BLU's devices, you basically agreed that such PII could possibly be transmitted to a third party outside the US. In this particular case, that does apply to the situation with AdUps. Interestingly, the policy's copyright dates back to 2016, when the AdUps issue first came up. The Internet Archives doesn't seem to have any version of that page before April this year. And so we come to BLU's second arguments: everybody's doing it. The data that AdUps collects is the same or even just a fraction of what other OEMs are collecting. Google is hardly the bastion of privacy and other OEMs are also collecting such data and sending it to servers in China, as is the case with Huawei and ZTE. Finally, BLU says that Kryptowire's new report really only identifies the Cubot X16S, from a Chinese OEM, as the only smartphone really spying on its users. UPDATE: BLU has confirmed that its devices "are now back up for sale on Amazon."
I was more concerned with my bluetooth not connecting unless I reset the radio (airplane mode on/off).
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
But Left Undeterred
Keep in mind that adb/fastboot unlock works on them without authorization codes or other bullshit like on other Android phones. Just keep in mind like all google devices with root/user reflash capabilities it wipes the device for security purposes before handing it over to you, so make sure you do it on a fresh phone without any personal info.
That said, BLU is probably one of the friendliest low end phone suppliers available, supporting dozens of usually 'chinese-only' phone designs that otherwise might not make it to the states.
They sound like a teenager:
"I didn't do it! Not really. Well, technically I guess. But it doesn't matter anyway. Everyone else is doing it!"
This whole time I thought only Microsoft could get away with "oops my bad" when they were caught blatantly spying on their users.
I generally treat any smartphone as a very insecure device. They transmit gods knows what to god knows whom, on a regular basis. Pretty much every App is phoning home regularly. Obviously it's transmitting "Personally Identifiable Information", it kinda needs to so it can tell you from a stranger sitting next to you.
With that in mind, use it accordingly. You really can't expect privacy out of these things, should anyone really want to dig about what you do. Like Law Enforcement. Smartphones are a treasure-trove of evidence for LE.
I would even considering going as far as to treat these devices as 'foreign' on network infrastructure, walling it off from internal resources that may be less than secure because they're on an intranet, and inaccessible from the outside.
Amazon now has this no-questions return policy thing about which people are complaining. We could all order one of these phones, then leave horrible reviews (which, as people who bought them, would be considered more real), and then get refunds. If they popped up under a different account or product name, lather/rinse/repeat. Ah well, guess that's more of a job for reddit these days ;)
"Google processes personal information on our servers in many countries around the world. We may process your personal information on a server located outside the country where you live."
https://www.google.com/policies/privacy/
"All the information you provide may be transferred or accessed by entities around the world as described in this Privacy Policy. "
https://www.apple.com/au/legal/privacy/en-ww/
"By using or participating in any Service and/or providing us with your information, you consent to the collection, disclosure, transfer, storage and processing of your information outside of Australia, consistent with this Privacy Policy. You acknowledge that the overseas recipients of your personal information may, depending on the particular Service that you have requested, be located outside Australia including in South Korea, the Philippines, Singapore, Malaysia, the United States of America, Germany, China, the Netherlands, Vietnam or Denmark. "
http://www.samsung.com/au/info/privacy/
"In addition, we share personal data among Microsoft-controlled affiliates and subsidiaries. We also share personal data with vendors or agents working on our behalf for the purposes described in this statement. For example, companies we've hired to provide customer service support or assist in protecting and securing our systems and services may need access to personal data in order to provide those functions. In such cases, these companies must abide by our data privacy and security requirements and are not allowed to use personal data they receive from us for any other purpose. We may also disclose personal data as part of a corporate transaction such as a merger or sale of assets."
https://privacy.microsoft.com/en-us/privacystatement
(It doesn't specify outside US but it seems likely)
Can't they be reflashed with Lineage or another custom rom, to resolve/remove the spying?
I won't consider their phones, or let anyone relies on me do so. They might as well not bother.
"Oh my God. This is terrible. This is the end of my Presidency. I'm fucked."; ~ Donald J. Trump
I didn't hear anything about them suspending the sale of RED phones, and BLU and RED are always up to the same shit. It's almost like Spy Vs. Spy or something.
How is the Riemann zeta function like Trump rallies? Both have an endless number of trivial zeros.
The real problem here is, yeah, you can remove ADUPS if you root the Phone. I did this. I also removed MTK Logger. If you root the Device however, and then try and update, the Phone will soft brick due to the way ADUPS updates the device in an inconsistent Manner. So getting a new Stock Rom means a complete Re-Flash and Re-Root, and eradication of the User Partition EVERY update to prevent Soft Bricking.
Lineage OS needs to go to war with Blu on this and make a Lineage OS Rom for every Android device Blu Makes.
This is not BLU's doing, but it is. The firmware maker is causing all these issues, but they choose to collaborate with that company in the first place.
You can root them with NO third party apps and then remove anything you do not care for, easy peasy. If you have an Alcatel or plan to buy one here is how you root it in under 2 minutes..
Alcatel has its own "system updates" app. If you tap the three dots in the right hand corner and then hit "Help", then hit the "Auto -Check Intervals" button a bunch, it will unlock "Advanced Mode." Go back and tap the three dots again and it will be under "help." When you go into this advanced mode, it will ask you for a "tester password". The pass is fotaapp*#1221#.
As far as BLU goes? They are a company that just rebrands Chinese smartphones and sells them in the US, I seriously doubt they have even a handful of devs so it really doesn't surprise me they are using third parties for updates as they are just middlemen.
ACs don't waste your time replying, your posts are never seen by me.
What about RED?
Adups is owned by Mediatek.
Adups *IS* Mediatek.
The argument that "everyone's doing it", is that supposed to exonerate Blu, or indict the industry? Personally, I favor the latter. Of course, I also favor chain gang sentences for privacy violators. Vote Draconian in 2018.
Google, the OEMs, and the telecomm companies are all going to be screwed when everybody's moved to a cheap Chinese smartphone (they'll probably let you root your phone and they won't be nearly as boot on neck with all the malicious bloatware). All it'll take is Apple slipping just a little bit.