Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

gist.github.com

Post reply on HN
Print view View original

71–80 of 151 posts

Re: MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

#71

Post by raincole »

nandomrumber wrote: post #57
michaellee8 wrote: post #2

I only run software from Chinese companies inside a sandbox, either on my Android/iOS phone or inside a VM for desktop apps and only enable necessary permissions. Unfortunately Mainland tech giants have no sense of user privacy and would like to maximize their profit by collecting every single bit of your data because they don't profit on selling you the software, they profit on selling your data.

I recently downloaded the Soundcloud app for the first time on this iOS device and it said something along the lines of: By continuing you agree to us sharing your data with our 954 partners…

Yeah and that means the data that you share with Soundcloud.

It's very different from:

> ps aux # Every running process with full arguments

If you think these two cases are even remotely comparable, I don't know what to tell you.

Re: MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

#72

Post by raincole »

supersing wrote: post #31

It still surprises me that such behavior is still allowed on modern macOS, which is supposed to be privacy focused. What’s the point of having an app sandbox when it is opt-in?

I've never heard people describe macOS as 'privacy focused.' Perhaps copywriting from Apple itself?

iOS maybe. macOS no.

Re: MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

#73

Post by _a9 »

8cvor6j844qw_d6 wrote: post #27
brendyn wrote: post #26

Earlier quoted context omitted.

Separate grapheneos accounts for everything does that I believe

I went with a separate non-critical phone when I had to communicate on WeChat.

This is what I do too. If i need to use or test something i don't trust then I use an old phone. All of the phones use crDroid(1) and I have scripts to quickly wipe and reinstall the OS whenever I need a full nuke.

(1) https://crdroid.net/

Re: MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

#74

Post by stodor89 »

chromehearts wrote: post #50
debazel wrote: post #30

Earlier quoted context omitted.

There's a massive difference between having a country spying on it's own citizen versus having an adversarial country doing it. The three-letter agencies would likely not be trying to sabotage or destroy their own country's economy and global standing for one.

As someone from the EU, could I not use the argument to argue that for me it's both an adversarial country?

As someone from the EU, please do!

Re: MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

#75

Post by gkbrk »

jesterson wrote: post #24
inventor7777 wrote: post #18

Earlier quoted context omitted.

I hear this theory being claimed so much, but I don't see any real evidence for it; we have routers that you can monitor traffic on, we have microphone use indicators on mobile, and I would imagine it would be pretty clear if an app was uploading audio with even very basic monitoring tools. Correct me if I'm wrong, however. I'm not denying that a lot of data is likely surreptitiously collected, but I'm talking microp…

I recall there were quite a few experiments where people use certain keywords heavily just to get closely related ads later on. I can totally relate my experience with it as well. Of course it is inconclusive - but if there is an incentive, management of big companies will venture into it. And chinese management is no different from western ones to that matter.

They don't pick the keywords uniformly randomly from a list of all keywords though. They think they randomly picked something that popped up in their mind, but those keywords are either

- stuff they saw online recently — ads or otherwise, which put the keywords in their mind

- or stuff they were already interested in recently

Not hard to imagine targeting algorithms picking up on either of these

Re: MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

#76

Post by uni_baconcat »

nerderloo wrote: post #39
jimmydoe wrote: post #25

This is ugly and bad. Meanwhile they do tell you they collect everything https://www.mumuplayer.com/privacy-policy.html Not to defend them, but just feel sad about the world.

Where does in that webpage say they're collecting output of `ps aux`?

I think it's this part:

(3) In order to ensure account security, identify and prevent malicious programs, and create a fair, healthy and safe environment, we will collect your device identifier information, product identification information, hardware and operating system information, installed application list, application process and product crash record information during your use of the service, including during the background operation of the application, so as to combat acts that damage the product environment or interfere with the normal operation of the product service.(Used to detect piracy, scan cheating programs or software, prevent cheating).

Re: MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

#78

Post by Paradigma11 »

nurettin wrote: post #58
notenlish wrote: post #45

Earlier quoted context omitted.

Taiwan's official name is "Republic of China".

A bit ambitious, isn't it?

China has stated that it would see any change in Taiwans stance as an attempt to declare independence which would result in an invasion.

Re: MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

#80

Post by TheDong »

inventor7777 wrote: post #21
blahgeek wrote: post #14

I would always refer to Hanlon's razor on things like this: Never attribute to malice that which is adequately explained by stupidity. I'm not trying to finding excuses for them, just saying that most likely there's no deep conspiracy theory involving government level surveillance here, they are just stupid. On average, Chinese software engineers are less educated and have no sense about privacy or how to implement p…

While logging serial number and some of the basic analytics stats might be attributed to stupidity, I tend to think that using a pretty advanced set of system commands and logging output consistently to log files is very sketchy.

One possible stupid-but-not-malicious explanation is that some anti-cheat company made a sketchy anti-cheat that includes server-side "is CheatEngine.exe running" code, and they're doing that via ps aux... and then this game player app was bullied by some game company into including this anti-cheat library to allow their game to run.
Post reply on HN