Slashdot Mirror
Chinese Mobile Phone Cameras Are Not-So-Secretly Recording Users' Activities (globalvoices.org)
Oiwan Lam, reporting for Global Voices: It has been widely reported that software and web applications made in China are often built with a "backdoor" feature, allowing the manufacturer or the government to monitor and collect data from the user's device. But how exactly does the backdoor feature work? Recent discussion among mobile phone users in mainland China has shed some light on the question.
Last month, users of Vivo NEX, a Chinese Android phone, found that when they opened certain applications on the phone, including Chinese internet giant QQ browser and travel booking app Ctrip, the mobile device's camera would self-activate. [...] One Weibo user observed that the retractable camera self-activates whenever he opens a new chat on Telegram, a messaging application designed for secured and encrypted communication.
[...] After the news of the self-activated camera bug spread, users started testing the issue on other applications and found that Baidu's voice input application has access to both the camera and voice recording function, which can be launched without users' authorization. A Vivo NEX user found that once she had installed Baidu's voice input system, it would activate the phone's camera and sound recording function whenever the user opened any application -- including chat apps, browsers -- that allows the user to input text.
Last month, users of Vivo NEX, a Chinese Android phone, found that when they opened certain applications on the phone, including Chinese internet giant QQ browser and travel booking app Ctrip, the mobile device's camera would self-activate. [...] One Weibo user observed that the retractable camera self-activates whenever he opens a new chat on Telegram, a messaging application designed for secured and encrypted communication.
[...] After the news of the self-activated camera bug spread, users started testing the issue on other applications and found that Baidu's voice input application has access to both the camera and voice recording function, which can be launched without users' authorization. A Vivo NEX user found that once she had installed Baidu's voice input system, it would activate the phone's camera and sound recording function whenever the user opened any application -- including chat apps, browsers -- that allows the user to input text.
LETS GO LADS
china!
Don't worry, the US and the rest of the first world will be like China in the not so distant future.
China shows the way!
North Korea proved that an entire county can be subjugated in a 1984 fashion for long periods of time. China keeps moving that way instead of toward more openness and freedom. I would expect that to limit their economic growth at some point, but who knows. Freedom is not a given in the future of any country.
Would the same level of abuse be possible with Apple iOS, or is this intrinsic flaw in open-sourced Android where it is possible to modify OS functionality without it becoming obvious?
who's really surprised?
Have they inspected packets? No.
Whats more likely.. a grand conspiracy, or a web-dev copy-pasting from a sample that enables everything, when all they wanted to enable is the onscreen keyboard.
This is China we're talking about. This is normal and expected activity. Move along, nothing to see (or hear) here. (Captcha word = obvious)
Wolf: The better to see you my dear.
Ban any company caught doing so from doing business in the USA.
The bastards wont learn until the cost of such activities is not prohibitive.
BookDetective.net - book search engine and ranker I donate my skills to.
Send the party full body nudes to show your nationalistic patriotism
Our phones spy on us. They send that data to everyone who is interested. It goes to google and apple, it goes to your carrier, it goes to whoever wrote any app at all that you installed on your phone, and it goes to the government. This is not paranoia. This has all been demonstrated.
And dumbphones aren't off the hook. Your location data is sent back to your carrier at all times, and the government can remotely and covertly activate your mic and camera at any time to spy on you (presumably, with a warrant, of course).
Your only way to prevent this is to remove the battery. So long as the phone has power, you must assume that it is spying on you.
In the US or any free country the people would be outraged by this sort of behavior. But people in communist or dictatorship countries seem to just expect that this is the normal and its to be expected. Not that anyone likes it, but we all know any resistance will be dealt with swiftly by said government. But even if free countries you have governments installing public cameras, many probably mic'd and even some shady connections with companies who have a data base full of user information. As US companies like Google encroach more and more on people's information. You see countries like China growing more resistant to those companies.
...with practically any cheap Chinese crapdroid phone/tablet, as well as Android TV boxes, aimed at the western markets - pretty much all of them run customized (often half-assed) Android builds bundled with various sets of malware/spyware. This even goes for the somewhat larger brands that have an office presence on the European continent trying to profile themselves in the west with TV/magazine/sports advertisements, like f.e. Doogee and Oukitel.
Over the past 5-6 years I've purchased close to two dozen Chines phones/tablets (as development toys) in both the low and mid price tiers, and I've yet to find a single one that actually comes with a clean and honest Android build. Spending time on the various Android phone/tablet hacking forums on the Internet you'll find droves of new reports about this every month, and all popular Chinese brands are mentioned.
Baidu's voice input system... would activate... whenever the user opened any application... that allows the user to input text
So, looking at the technical underpinning, it functions like the native keyboard app, which loads on demand for applications which support its input.
I can't reach the article, so here is the real question: Is there evidence of nefarious activity, particularly the suspicious caching or transmission of data?
Because a camera/mic activating on its own isn't necessarily doing much of anything. It certainly merits investigation, but the headline is not justified by the content of the summary.
After all, if it's "not-so-secretly" doing bad things, there should be plentiful, clear evidence of bad things happening. If there are hours of audio/video being recorded or transmitted by some phone, why not mention that?
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
black mirror, whoa-ah-oh.
Telegram is open source, you could see which line of code is triggering the camera and patch it. Why complain about it?
The only way to deal with cameras that do not have a hard-wired activation light.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
They have learned it from Cisco, RSA and Microsoft decades ago. Never mind the Europeans for which *everything* is backdoored. They call that "lawful interception".
Purism products offer hardware kill-switches for camera, mic and multiple radios (bluetooth/wifi/...). They are vigilant in defending against shit like what is happening these days, likely not only in China.
From Wikipedia ( https://en.wikipedia.org/wiki/... ):
"Librem is a line of computers manufactured by Purism, SPC featuring free (libre) hardware and software.[1][2][3][4][5][6] The laptop line is designed to protect privacy and freedom by providing no non-free (proprietary) software in the operating system or kernel,[7][8][9][10] avoiding the Intel Active Management Technology,[11] and gradually freeing and securing firmware.[12][13] Librem laptops feature hardware kill switches[14][15][16] for the microphone, webcam, Bluetooth, & Wi-Fi, and can be purchased air gapped."
If you support these companies the security and privacy bar for all manufacturers will raise.
It is pitch black. You are likely to be eaten by a grue.
Google,
On it's Android platform is scanning every single url your phone is accessing and feeding those URLs into it's spider.
How do I know? I am developing an Android app which has NEVER been released, thus the website URLs used are supposed to be 100% private. Google's spider has been scanning every single one of my private website urls as accessed by my private Android app.
So, this crap is not limited to China.
Caution: Contents under pressure
Until there is a version of wireshark that works on the phone bands (wireless-shark) - more or less a stingray that can be had by consumers, this is going to:
A: happen and only get worse.
B: be denied and essentially not proveable.
This all depends on what amounts to a technical arms race the consumer has lost.
Why guess when you can know? Measure!
So the Chinese Govt and Intelligence has gone Full Big-Brother in creating a surveillance state, what's missing is an official statement that if you use electronic devices in China then you will be tracked. In contrast, US Intelligence has taken half measures by creating/finding backdoors of their own. Which of these approaches is worse?
Easy solution: Find out who sold you the phone, and shove it tightly up their ass with the camera extended.
Even Apple have been doing this on at least their MacBooks and Safari. There was an "accidental bug" in Safari that could be exploited to call a hidden API in the drivers, which would allow the collection of camera pictures without turning on the LED, right onto a server-side application. No notifications, no warnings, no pop-ups, no admin access required.
From camera hardware to drivers to browser, Apple intentionally made it work this way. Think about that before you talk about how safe your Apple things are.
It's a snooping bug, not a software bug. The system is working exactly as designed to let apps be voyeurs.
Let's focus on China's transgressions while we ignore the fact that the US gov't monitors every electronic financial transaction we make and records every phone call we make (but they say they're only actively using the more-important "metadata" and supposedly only listen to the calls when they get a rubberstamp from a secret court).
Because after all, we know US/western telecomms would never do such a thing as the Chinese are doing...
But, hey, it's not just China.
-- Tigger warning: This post may contain tiggers! --
It's not a backdoor, it's a frontdoor.
Let's see: You buy a phone from a totalitarian one-party-rule Marxist state - and you're shocked to discover it is spying on you?
[facepalm]
I swear, the generation of people who grew up after the Reagan/Thatcher era the stupidest, most gullible, most foolish people who ever walked upright.
It's always been a core element of Marxism that "everything is political", which is why the old Soviet Union had "political officers" everywhere, the East Germans had the Stasi spying on nearly every citizen, etc. and why the term "politically correct" originated in the Soviet Union and was unheard of in Western Civilization before we were making fun of the concept in the 1980s.
It's also a universal truth that one-party-rule states are evil and paranoid and spy on their citizens to keep any alternate political thoughts and parties from arising.
As a result, you'd have to be the planet's single most-clueless moron to be surprised that a phone made in China, which checks both boxes, is anything but a disguised spying device, with some extra features like telephony... and yes that includes the iPhone which is made in China. It's entirely possible that there are spy functions built into the iPhone by the Chinese builders that Tim Cook, who puts greed above all else including the security of his company and customers, knows nothing about. The global stakes are simply too high for China to fail to install spy support into the iPhone's semiconductors, embedded code, or both.
Suddenly motorized pop-up cameras on phones doesn't sound so stupid at all.
Next I propose we give some app-developers the SAW-treatment with the phone and a gun mounted on a helmet, and the camera pushing the trigger if comes up.
. A Vivo NEX user found that once she had installed Baidu's voice input system, it would activate the phone's camera and sound recording function whenever the user opened any application -- including chat apps, browsers -- that allows the user to input text.
How the fuck did she think voice input would work if it didn't use the microphone?
ALL Mobile Phone Cameras Are Not-So-Secretly Recording Users' Activities
FTFY
In soviet China the phone watches you!