This isn’t particularly surprising. It’s becoming more and more common hearing about these stories, the last one I remember being Nokia HMD and Xiaomi both sending packets to Chinese servers.
I have a Xaiomi Android One phone and it only pings google servers, most activity is from Google Play Serives which many Android apps require to function, have never seen a Chinese server in the logs. It's probably a different story with the MIUI OS.
Sinkholing all requests the most concerning one Ive found is Google analytics running as root continually trying to dial out every few minutes. It doesn't give up and keeps retrying even after hours of failed requests. This is without any phone/internet usage.
Sending to Chinese government servers or Huawei servers? Not a convincing article.
I feel uncomfortable with what seems to me to be a campaign against Huawei at the same time our government is worried about being competitive in 5G tech. I could be wrong through, I didn’t believe that Russia would dare to meddle in our election until there was hard evidence.
I thought it was common knowledge that the USSR and Russia have a long and continuous history of engaging in disinformation campaigns and covert actions of all kinds. But based on the way the Russian election meddling story has been reported over the last 2+ years apparently I was wrong. Lots of people seem to have been surprised by these activities.
The most disturbing aspect of this ignorance is that apparently our own intelligence agencies were among the ignorant.
What is the source for this? My understanding is the only one claiming the Intelligence agencies were unaware of Russian hacking and disinformation campaigns is the President, since he fears the legitimacy of his election is undermined by recognizing that Russian hackers/propagandists were leaking stolen emails to Wikileaks and posting memes on Facebook.
The intelligence agency assessments themselves, as publicly reported, have consistently said there were Russian efforts to interfere with the election campaign.
> the country intervening in most foreign elections is the United States with 81 interventions, followed by Russia (including the former Soviet Union) with 36 interventions from 1946 to 2000
Or one could read a book on the subject of spying (preferably one written and published before 9/11). I recommend "Inside the Aquarium" by Viktor Suvoruv.
Wait, when did we find out that the intelligence community was ignorant? When they launched a formal investigation several months before the election? When, exactly, did the tens of thousands, if not hundreds of thousands, of full time employees in the IC collectively forget about Eastern bloc disinformation campaigns?
Maybe "ignorant" was the wrong word choice. To the extent that they were aware why didn't they intervene? Shouldn't have all the campaigns been briefed/warned about Russian actions? Why was a special prosecutor required
to investigate what they already knew?
"The list of DNS addresses includes beian.gov.cn, which was registered by Alibaba Cloud and managed by China's Ministry of Public Security, according to Whois.com. Another frequently listed request was sent to china.com.cn, which was registered by EJEE Group and operated by China's state-run mouthpiece the China Internet Information Center"
The funny thing is that Huawei isn't even a very compelling brand. Like, even before the big freak out, no one was waiting in line around the block for the latest Huawei doodad.
If kids got a Huawei thingamajig for Christmas, they'd probably be a little pissed off, and toss it in the corner to be forgotten. Here and there, you'd see a random person with something they picked up as a stop gap device because they smashed the screen on their good phone. Maybe.
So now, every other week, noise, noise, noise? Huawei is the devil? Who gives a fuck?
Also cursory search of ExploitWareLabs highlights lack of publish rigor from previous expose last year. Juice:
>Our research team studied the video and we have several reasons to doubt its authenticity. We’ve conducted a thorough audit over the last 48 hours based the few details that are in the video and didn’t find anything. We reached out the researcher and instead of replying he removed the video*. We’ll communicate if indeed there is a risk.
In the last couple of hours the author rolled back some of their comments.
They way I'm reading this, they were seeing DNS requests to beian.gov.cn which was worrisome. Now they say those are the result of manually visiting baidu.com which makes more sense.
It's hard to read on account of the dodgy use of English, but this smells of "amateur security researcher". Of course it feeds the narrative of Huawei paranoia so it makes it to the HN front page. (I'm not saying Huawei is innocent but this article surely is no smoking gun).
I'm of the opinion that only something radical like a new platform and/or device shift (i.e. away from smartphones to some other form factor, or a new, open, network-local-by-default mobile operating system) is likely to save us from this.
All contemporary smartphones leak a ton via DNS and various background sync processes. Perhaps scrappy developers from emerging markets are more egregious in violating expected norms, but these outcomes are pervasive at the moment across the whole ecosystem.
I'm trying to figure out what exactly this is getting at?
Is the worry that these requests to random Chinese servers are nefarious or is this some random piece of software pinging a server for some tiny piece of information?
“ICP Beian” stands for the process of obtaining the Business ICP registration number that allows you to host your website on a Mainland Chinese server. [0]
So these communications could be literally anything on the phone and all we know is that it's communicating with a server in mainland China?
“some random piece of software pinging a server for some tiny piece of information”
that would be called ‘phoning home’ and has the potential for significant information disclosure (IP, location, phone status, likely other information).
> It is unknown whether there are any differences in firmware for different countries/regions.
It is perfectly known that Huawei sells Chinese and Global editions of their phones. It's a pity there's so much vagueness when reporting that you can't even know which edition or firmware were they testing.
I think we'll be doing a service to ourselves by ignoring vague reporting about IT security and decide based on documented and repeatable reports.
37 comments
[ 2.8 ms ] story [ 113 ms ] threadSinkholing all requests the most concerning one Ive found is Google analytics running as root continually trying to dial out every few minutes. It doesn't give up and keeps retrying even after hours of failed requests. This is without any phone/internet usage.
I feel uncomfortable with what seems to me to be a campaign against Huawei at the same time our government is worried about being competitive in 5G tech. I could be wrong through, I didn’t believe that Russia would dare to meddle in our election until there was hard evidence.
The most disturbing aspect of this ignorance is that apparently our own intelligence agencies were among the ignorant.
The intelligence agency assessments themselves, as publicly reported, have consistently said there were Russian efforts to interfere with the election campaign.
Wikipedia has an extensive article citing numerous academic studies on the matter:
https://en.wikipedia.org/wiki/Foreign_electoral_intervention
> the country intervening in most foreign elections is the United States with 81 interventions, followed by Russia (including the former Soviet Union) with 36 interventions from 1946 to 2000
Of course the USA frequently interferes in foreign elections. We spy on other countries too.
It’s normal for a country to spy and interfere in others, but not to like when others spy and interfere with them. Such is international politics.
If kids got a Huawei thingamajig for Christmas, they'd probably be a little pissed off, and toss it in the corner to be forgotten. Here and there, you'd see a random person with something they picked up as a stop gap device because they smashed the screen on their good phone. Maybe.
So now, every other week, noise, noise, noise? Huawei is the devil? Who gives a fuck?
https://github.com/pe3zx/huawei-block-list/blob/master/maste...
Looks like a troll.
https://github.com/pe3zx/huawei-block-list/blob/master/analy...
>Our research team studied the video and we have several reasons to doubt its authenticity. We’ve conducted a thorough audit over the last 48 hours based the few details that are in the video and didn’t find anything. We reached out the researcher and instead of replying he removed the video*. We’ll communicate if indeed there is a risk.
https://avleonov.com/tag/exploitwarelabs/
Tl;DR an amateur with no presence outside of facebook did not actually find what state level security experts tried to find for 10 years.
He even know what's my favorite porn site, I don't believe china will know that better :)
They way I'm reading this, they were seeing DNS requests to beian.gov.cn which was worrisome. Now they say those are the result of manually visiting baidu.com which makes more sense.
See https://github.com/pe3zx/huawei-block-list/blob/master/analy...
All contemporary smartphones leak a ton via DNS and various background sync processes. Perhaps scrappy developers from emerging markets are more egregious in violating expected norms, but these outcomes are pervasive at the moment across the whole ecosystem.
“ICP Beian” stands for the process of obtaining the Business ICP registration number that allows you to host your website on a Mainland Chinese server. [0]
So these communications could be literally anything on the phone and all we know is that it's communicating with a server in mainland China?
[0] https://www.tmogroup.asia/entering-china-ecommerce-icp-beian...
Because it was developed by an American company and runs software written by an American company.
If I don't trust them I might as well throw the device away now.
Is this really not obvious?
that would be called ‘phoning home’ and has the potential for significant information disclosure (IP, location, phone status, likely other information).
It is perfectly known that Huawei sells Chinese and Global editions of their phones. It's a pity there's so much vagueness when reporting that you can't even know which edition or firmware were they testing.
I think we'll be doing a service to ourselves by ignoring vague reporting about IT security and decide based on documented and repeatable reports.