3 ms·

So I have spent some initial time looking at this. com.evenwell.autoregistration.Caivs has some worrying looking stuff. There is a website here with the usern

So I have spent some initial time looking at this. com.evenwell.autoregistration.Caivs has some worrying looking stuff. There is a website here with the username and password in cleartext in the jars: https://www.c2dms.com https://www.c2dms.com Nothing visible/doable once logged in from what I could see. It also appears to be collecting fine-grained location data, e.g. this is the output from logcat (I have obfuscated my own GPS coords here, but they are 6 digits of accuracy) 2019-03-30 19:38:21.406 15139-15159/? D/[CAIVS] LocationFinder: LocationUpdated: 3.location:Location[gps 51.xxxxxx,-0.xxxxxx hAcc=39 et=+1d19h59m28s923ms alt=102.50201416015625 vel=3.09 bear=14.3 vAcc=24 sAcc=3 bAcc=10 {Bundle[mParcelledData.dataSize=96]}] 2019-03-30 19:38:21.406 15139-15159/? D/[CAIVS] LocationFinder: updateLocation: gps accuracy:38.592003 2019-03-30 19:38:21.406 15139-15159/? D/[CAIVS] LocationFinder: updateLocation: is in accuracy :1000 com.evenwell.autoregistration.Utils.RegisterManager seems to be doing some scheduled checks and doing something with this collected data in the first 24 hours, then phased at 15 and 90 days. It is not clear what is happening having only done an initial scan over this. It does look like they are doing some checking to see if the device is a Nokia device and selectively doing or not doing location-based stuff based on that, e.g. from com.evenwell.autoregistration.Utils.GetInfo 2019-03-30 20:09:25.108 16558-16577/? D/[CAIVS] GetInfo: getCellLocation: in black list Further investigation probably warranted. This looks a bit suspect and might only send data on specific days (and would explain why I did not notice anything outbound over my 4 day period of checking before).

yorwba 8y ago
Caivs seems to have been known since at least 2011 http://club.dx.com/forums/forums.dx/threadid.1035111?page=2 http://club.dx.com/forums/forums.dx/threadid.1035111?page=2
- mattlondon 8y ago
  I found this in English: https://web.archive.org/web/20081027134825/http://www.cseed.cn/chinese/news/portfolio2.htm https://web.archive.org/web/20081027134825/http://www.cseed.... Quote: "CAIVS notifies our system when the handset is purchased. Data includes the date, time, and location that a SIM card is first inserted into the handset, the inserted SIM card's telecom operator, the handset's operating system, the handset model and phone number, and even the time when it is first turned on. " WTF. It is not clear at the moment if there is a blacklist on the MCC code going on in com.evenwell.autoregistration.Util.XMLHelper that reads from /product/etc/AutoRegConfig.xml is this line: <NOKIA> <REJECTMCCLIST>232,206,284,219,280,230,238,248,244,208,262,202,216,274,510,272,222,247,295,228,246,270,278,204,242,260,268,226,231,293,655,214,240,228,234,235,520</REJECTMCCLIST> </NOKIA> These are - I think - the Mobile Country Codes (https://en.wikipedia.org/wiki/Mobile_country_code https://en.wikipedia.org/wiki/Mobile_country_code) it gets from the cellsite. This list is basically the EU + South Africa, Thailand and Indonesia. Don't know what things are like in SA, Thailand or Indonesia but in the EU this sort of thing would not be acceptable. Looks also like there is a hard-coded short-circuit in getLocation() in com.evenwell.autoregistration.Util.GetInfo to always return no location lat-longs which appears to trigger another shortcut in RegisterManager that shortcuts out to the "Caivs not in registration phase" log output which returns without triggering the sendToServer() calls on other code paths. I am not convinced that this will never send location back, but looks like it might have been updated with to prevent phoning home in those countries in the MCC list (and maybe by hard-coded shortcuts the actual code). This would meet with what was said with there recent phoning home response from Nokia - i.e. (https://translate.google.com/translate?u=https://nrkbeta.no/2019/03/21/norske-telefoner-sendte-personopplysninger-til-kina/ https://translate.google.com/translate?u=https://nrkbeta.no/...)
  - mattlondon 8y ago
    Here is a statement from Nokia regarding their 7 Plus incident: https://www.nokia.com/phones/en_int/privacy-info https://www.nokia.com/phones/en_int/privacy-info Interesting image they have that confirms that c2dms.com site is collecting device activation data. You can opt out of the "User Experience Program" (that does this upload) by going to Settings -> System -> About Phone -> User Experience Program and then untick the diagnostic report

yorwba 8y ago

Caivs seems to have been known since at least 2011 http://club.dx.com/forums/forums.dx/threadid.1035111?page=2 http://club.dx.com/forums/forums.dx/threadid.1035111?page=2

mattlondon 8y ago
I found this in English: https://web.archive.org/web/20081027134825/http://www.cseed.cn/chinese/news/portfolio2.htm https://web.archive.org/web/20081027134825/http://www.cseed.... Quote: "CAIVS notifies our system when the handset is purchased. Data includes the date, time, and location that a SIM card is first inserted into the handset, the inserted SIM card's telecom operator, the handset's operating system, the handset model and phone number, and even the time when it is first turned on. " WTF. It is not clear at the moment if there is a blacklist on the MCC code going on in com.evenwell.autoregistration.Util.XMLHelper that reads from /product/etc/AutoRegConfig.xml is this line: <NOKIA> <REJECTMCCLIST>232,206,284,219,280,230,238,248,244,208,262,202,216,274,510,272,222,247,295,228,246,270,278,204,242,260,268,226,231,293,655,214,240,228,234,235,520</REJECTMCCLIST> </NOKIA> These are - I think - the Mobile Country Codes (https://en.wikipedia.org/wiki/Mobile_country_code https://en.wikipedia.org/wiki/Mobile_country_code) it gets from the cellsite. This list is basically the EU + South Africa, Thailand and Indonesia. Don't know what things are like in SA, Thailand or Indonesia but in the EU this sort of thing would not be acceptable. Looks also like there is a hard-coded short-circuit in getLocation() in com.evenwell.autoregistration.Util.GetInfo to always return no location lat-longs which appears to trigger another shortcut in RegisterManager that shortcuts out to the "Caivs not in registration phase" log output which returns without triggering the sendToServer() calls on other code paths. I am not convinced that this will never send location back, but looks like it might have been updated with to prevent phoning home in those countries in the MCC list (and maybe by hard-coded shortcuts the actual code). This would meet with what was said with there recent phoning home response from Nokia - i.e. (https://translate.google.com/translate?u=https://nrkbeta.no/2019/03/21/norske-telefoner-sendte-personopplysninger-til-kina/ https://translate.google.com/translate?u=https://nrkbeta.no/...)
- mattlondon 8y ago
  Here is a statement from Nokia regarding their 7 Plus incident: https://www.nokia.com/phones/en_int/privacy-info https://www.nokia.com/phones/en_int/privacy-info Interesting image they have that confirms that c2dms.com site is collecting device activation data. You can opt out of the "User Experience Program" (that does this upload) by going to Settings -> System -> About Phone -> User Experience Program and then untick the diagnostic report