Slashdot Mirror
Chinese Mobile Phone Cameras Are Not-So-Secretly Recording Users' Activities (globalvoices.org)
Oiwan Lam, reporting for Global Voices: It has been widely reported that software and web applications made in China are often built with a "backdoor" feature, allowing the manufacturer or the government to monitor and collect data from the user's device. But how exactly does the backdoor feature work? Recent discussion among mobile phone users in mainland China has shed some light on the question.
Last month, users of Vivo NEX, a Chinese Android phone, found that when they opened certain applications on the phone, including Chinese internet giant QQ browser and travel booking app Ctrip, the mobile device's camera would self-activate. [...] One Weibo user observed that the retractable camera self-activates whenever he opens a new chat on Telegram, a messaging application designed for secured and encrypted communication.
[...] After the news of the self-activated camera bug spread, users started testing the issue on other applications and found that Baidu's voice input application has access to both the camera and voice recording function, which can be launched without users' authorization. A Vivo NEX user found that once she had installed Baidu's voice input system, it would activate the phone's camera and sound recording function whenever the user opened any application -- including chat apps, browsers -- that allows the user to input text.
Last month, users of Vivo NEX, a Chinese Android phone, found that when they opened certain applications on the phone, including Chinese internet giant QQ browser and travel booking app Ctrip, the mobile device's camera would self-activate. [...] One Weibo user observed that the retractable camera self-activates whenever he opens a new chat on Telegram, a messaging application designed for secured and encrypted communication.
[...] After the news of the self-activated camera bug spread, users started testing the issue on other applications and found that Baidu's voice input application has access to both the camera and voice recording function, which can be launched without users' authorization. A Vivo NEX user found that once she had installed Baidu's voice input system, it would activate the phone's camera and sound recording function whenever the user opened any application -- including chat apps, browsers -- that allows the user to input text.
If China were the only one moving that way, it would possibly limit their economic growth. The problem is the entire WORLD seems to be moving that way, some at a faster rate than others. But it's not like I can honestly look at my United States and say we aren't doing the exact same thing, and whenever one of us plebes mention it in a public forum all that has to happen is somebody whines about how it's for our own protection and then it ceases to be an issue of importance.
Our phones spy on us. They send that data to everyone who is interested. It goes to google and apple, it goes to your carrier, it goes to whoever wrote any app at all that you installed on your phone, and it goes to the government. This is not paranoia. This has all been demonstrated.
And dumbphones aren't off the hook. Your location data is sent back to your carrier at all times, and the government can remotely and covertly activate your mic and camera at any time to spy on you (presumably, with a warrant, of course).
Your only way to prevent this is to remove the battery. So long as the phone has power, you must assume that it is spying on you.
...with practically any cheap Chinese crapdroid phone/tablet, as well as Android TV boxes, aimed at the western markets - pretty much all of them run customized (often half-assed) Android builds bundled with various sets of malware/spyware. This even goes for the somewhat larger brands that have an office presence on the European continent trying to profile themselves in the west with TV/magazine/sports advertisements, like f.e. Doogee and Oukitel.
Over the past 5-6 years I've purchased close to two dozen Chines phones/tablets (as development toys) in both the low and mid price tiers, and I've yet to find a single one that actually comes with a clean and honest Android build. Spending time on the various Android phone/tablet hacking forums on the Internet you'll find droves of new reports about this every month, and all popular Chinese brands are mentioned.
While the level of scrutiny and inspection procedures performed by Apple before publishing an iOS application is on a completely different level than that of Google and their Play Store, it's technically possible. But the case with these Chinese Android phones isn't really about this or that rogue app possibly showing up on the Play Store, but rather that they all come with a customized Android build prepared from start with a selection of malware/spyware. It's a complete ready-to-go, ready-to-spy package.
Baidu's voice input system... would activate... whenever the user opened any application... that allows the user to input text
So, looking at the technical underpinning, it functions like the native keyboard app, which loads on demand for applications which support its input.
I can't reach the article, so here is the real question: Is there evidence of nefarious activity, particularly the suspicious caching or transmission of data?
Because a camera/mic activating on its own isn't necessarily doing much of anything. It certainly merits investigation, but the headline is not justified by the content of the summary.
After all, if it's "not-so-secretly" doing bad things, there should be plentiful, clear evidence of bad things happening. If there are hours of audio/video being recorded or transmitted by some phone, why not mention that?
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
The only way to deal with cameras that do not have a hard-wired activation light.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
There are two reasons for the problem.
Purism products offer hardware kill-switches for camera, mic and multiple radios (bluetooth/wifi/...). They are vigilant in defending against shit like what is happening these days, likely not only in China.
From Wikipedia ( https://en.wikipedia.org/wiki/... ):
"Librem is a line of computers manufactured by Purism, SPC featuring free (libre) hardware and software.[1][2][3][4][5][6] The laptop line is designed to protect privacy and freedom by providing no non-free (proprietary) software in the operating system or kernel,[7][8][9][10] avoiding the Intel Active Management Technology,[11] and gradually freeing and securing firmware.[12][13] Librem laptops feature hardware kill switches[14][15][16] for the microphone, webcam, Bluetooth, & Wi-Fi, and can be purchased air gapped."
If you support these companies the security and privacy bar for all manufacturers will raise.
It is pitch black. You are likely to be eaten by a grue.
Google,
On it's Android platform is scanning every single url your phone is accessing and feeding those URLs into it's spider.
How do I know? I am developing an Android app which has NEVER been released, thus the website URLs used are supposed to be 100% private. Google's spider has been scanning every single one of my private website urls as accessed by my private Android app.
So, this crap is not limited to China.
Caution: Contents under pressure
It's not a backdoor, it's a frontdoor.