Apple's getting remarkably close to the same place with its (on-hold) system for scanning for CSAM. It could be adapted for political censorship and "turned on remotely at any time."
Lithuania says throw away Chinese phones due to censorship concerns
151–160 of 427 posts
Re: Lithuania says throw away Chinese phones due to censorship concerns
#152From the shared PDF page 23...
"It has been established that during the initialisation of the system applications factory-installed on a Xiaomi Mi 10T device, these applications contact a server in Singapore at the address globalapi.ad.xiaomi.com (IP address 47.241.69.153) and download the JSON file MiAdBlacklistConfig, and save this file in the metadata catalogues of the applications. A list of applications for which the MiAdBlacklistConfig file was found in metadata catalogues is presented in Table 13."
... "Once the applications have downloaded the file, the download date is recorded in order to facilitate periodically updating the list. The scheme for downloading the MiAdBlacklistConfig file is shown in Figure 11."
"This file contains a list composed of the titles, names and other information of various religious and political groups and social movements (at the time of the analysis, the MiAdBlacklistConfig file contained 449 elements). A fragment of the MiAdBlacklistConfig file is shown in Table 14."
Extract from table 14....
===================================================
No.: Original - Approximate translation
1 "宗教虔信者阵线", “Front of religious believers”,
...
22 "西藏自由", “Free Tibet”,
...
60 "蒙古独立", “Independence of Mongolia”,
61 "89民运", “89 Democracy Movement”,
62 "基督灵恩布道团", “Christian charismatic mission”, ...
145 "伊斯兰联盟", “Islamic League”,
...
201 "民运", “Democratic Movement”,
202 "妇女委员会", “Women’s Committee”,
203 "伊斯兰马格里布基地组织", “Al-Qaida in the Islamic Maghreb”,
204 "人民报", “People’s daily newspaper”,
205 "巴勒斯坦解放组织", “The Organisation for the Liberation of Palestine”,
=======================================================
Re: Lithuania says throw away Chinese phones due to censorship concerns
#153I just helped someone remove the built-in Chinese malware from a US Government provided phone. It's insane. https://blog.malwarebytes.com/android/2020/07/we-found-yet-a...
Is that even enough though? Couldn't china put in shadow processors or other hardware-level surveillance similar to Intel's management engine? And it would be extremely difficult to detect, let alone disable or mitigate.
>Couldn't china put in shadow processors or other hardware-level surveillance similar to Intel's management engine?
Do we know for certain that IME is not already doing this kind of spying though?
Re: Lithuania says throw away Chinese phones due to censorship concerns
#154Earlier quoted context omitted.
You are more powerful than you may realize. Work on supporting open source hardware and software options. 1. If you are a developer, consider buying a Pinephone [1] and contributing to the codebase. 2. If not a developer, you can submit bug reports and test fixes. Same for Purism Librem phone as well [2]. 3. If you are neither, or have no time to spare but do have money, you can always purchase one for kicks or donat…
I hate to say this, but OSS anarchism is not going to work. Most people cannot really work or live with those devices. This is a problem that needs to be solved with legislation, lobbying, superPACs, and candidates who are not ethically flexible. The solution to bad government is not "no government" and the solution to bad company behavior is better rules.
We need both. First, Stallman was right. We simply cannot trust the magic incantations (code) of closed-source software and hardware to respect laws, in spirit or in letter. We must be able to audit all devices at every level. Second, the EFF is right, too. They fight at the legislative level. But they are fighting a defensive game. Consumers need to go on the offensive and lobby for legislatures to pass a digital Bill of Rights.
Re: Lithuania says throw away Chinese phones due to censorship concerns
#155Earlier quoted context omitted.
I was stupid enough to buy a Xiaomi phone without enough due diligence. Aside from all spying that is going on, the software is abysmal. The problem with replacing the OS is that I believe most banking apps I use will stop working. Might just need to write this phone off.
Banking has to be the dumbest "security" industry there is. Restrict apps, but can still log in via browser. I have one bank app that actually says to screenshot a payment screen for your records, while blocking screenshots via app policy.
> Restrict apps, but can still log in via browser.
This isn't paradoxical. You treat the browser as a less trusted security domain than a phone, which usually has a secure boot chain, strong sandboxing, encrypted disk, reliable hardware cryptography etc, and therefore provide a different/better service on the phone. If a phone is missing one of these expected components then you're not the target market for the app, I guess. (Of course, your phone OS might be perfectly good, and the stock one might be crap, but the app developers don't care.)
Re: Lithuania says throw away Chinese phones due to censorship concerns
#156Earlier quoted context omitted.
Thet are very common in Lithuania, to the point where I’d say around 20% of new phones being sold are from Xiaomi. They expanded heavily into other industries, like home automation, with prices that are a fraction of what other manufacturers would ask for their hardware.
I am not sure how accurate this information is but quick google search says Xiaomi have 24% phone market share in EU, not just Lithuania.
My prediction is that their market share is going to substantially grow. Xiaomi phones are much cheaper in terms of the hardware they offer. A Xiaomi Poco F3 costs €350. A comparable device from others is probably in the €>450 range. An iPhone's probably in the €>800 range.
Re: Lithuania says throw away Chinese phones due to censorship concerns
#157Earlier quoted context omitted.
I was stupid enough to buy a Xiaomi phone without enough due diligence. Aside from all spying that is going on, the software is abysmal. The problem with replacing the OS is that I believe most banking apps I use will stop working. Might just need to write this phone off.
Banking has to be the dumbest "security" industry there is. Restrict apps, but can still log in via browser. I have one bank app that actually says to screenshot a payment screen for your records, while blocking screenshots via app policy.
That's what happens when you have external security requirements along with audits and incompetent/greedy management. Designing and implementing a security policy based on the standard is a waste of money when you can do the bare minimum by checking off boxes.
Re: Lithuania says throw away Chinese phones due to censorship concerns
#158Earlier quoted context omitted.
This is what kinda terrifies me about today's digital landscape. Now it's so cheap to hide surveillance capabilities (spyware, hidden microphones or cameras) that bad actors can just embed surveillance into every cheap device, hoping just by sheer numbers to get one into a sensitive area (e.g. Pentagon, Langley), and then remotely activate surveillance. With the computational capabilities of today's data centers, the…
It’s underrated but DJI drones sold by millions is a great way to spy on what could not be gathered through satellite imagery. If not now then during war time, CCP has a million remote cameras in form of DJI drones and can turn it on in a snap. It would require nationwide firewall to stop. Of course, DJI drones require DJI flight app to even take off. Why isn’t US Gov putting together legislation for this sort of a t…
In your scenario, is China leveraging it's own DJI drones? Or DJI drones already owned by hobbyists?
Re: Lithuania says throw away Chinese phones due to censorship concerns
#159Earlier quoted context omitted.
For now, until hardware backed attestation becomes properly enforced... Isn't security great
It probably will never be. It just takes one OEM to fuck it up and everyone can use their device ID. That's why hardware backed attestation doesn't work, OnePlus fucked it up and now Magisk can pretend to be that phone and get exempted.
If a Chinese oem loses their keys why not just revoke them?
Re: Lithuania says throw away Chinese phones due to censorship concerns
#160Earlier quoted context omitted.
> I wonder why is anybody still surprised. This is the kind of claim that's deep in conspiracy theory territory until the smoking gun is uncovered, and once that's out (and only then) it becomes obvious and unsurprising.
No, it is not and has not been surprising for decades. In China there are no private companies. There are only companies that Chinese government lets you run as long as you cooperate with the government.
> No, it is not and has not been surprising for decades.
I still recall the Supermicro backdoor chip story, and how once the Bloomberg news broke it was immediately so obvious and so clear that backdoor spy chips were undoubtedly being injected.
But a few years have blown by and the story is now a renowned hoax.
https://www.theregister.com/2021/02/12/supermicro_bloomberg_...
So tell me, is this sort of story also unsurprising for decades?