17 ms·
I found this in English: https://web.archive.org/web/20081027134825/http://www.cseed.cn/chinese/news/portfolio2.htm https://web.archive.org/web/20081027134825/h
by mattlondon 8y ago
I found this in English: https://web.archive.org/web/20081027134825/http://www.cseed.cn/chinese/news/portfolio2.htm https://web.archive.org/web/20081027134825/http://www.cseed....
Quote: "CAIVS notifies our system when the handset is purchased. Data includes the date, time, and location that a SIM card is first inserted into the handset, the inserted SIM card's telecom operator, the handset's operating system, the handset model and phone number, and even the time when it is first turned on. "
WTF.
It is not clear at the moment if there is a blacklist on the MCC code going on in com.evenwell.autoregistration.Util.XMLHelper that reads from /product/etc/AutoRegConfig.xml is this line:
<NOKIA>
<REJECTMCCLIST>232,206,284,219,280,230,238,248,244,208,262,202,216,274,510,272,222,247,295,228,246,270,278,204,242,260,268,226,231,293,655,214,240,228,234,235,520</REJECTMCCLIST>
</NOKIA>
These are - I think - the Mobile Country Codes (https://en.wikipedia.org/wiki/Mobile_country_code https://en.wikipedia.org/wiki/Mobile_country_code) it gets from the cellsite. This list is basically the EU + South Africa, Thailand and Indonesia. Don't know what things are like in SA, Thailand or Indonesia but in the EU this sort of thing would not be acceptable. Looks also like there is a hard-coded short-circuit in getLocation() in com.evenwell.autoregistration.Util.GetInfo to always return no location lat-longs which appears to trigger another shortcut in RegisterManager that shortcuts out to the "Caivs not in registration phase" log output which returns without triggering the sendToServer() calls on other code paths.
I am not convinced that this will never send location back, but looks like it might have been updated with to prevent phoning home in those countries in the MCC list (and maybe by hard-coded shortcuts the actual code). This would meet with what was said with there recent phoning home response from Nokia - i.e. (https://translate.google.com/translate?u=https://nrkbeta.no/2019/03/21/norske-telefoner-sendte-personopplysninger-til-kina/ https://translate.google.com/translate?u=https://nrkbeta.no/...)
- mattlondon 8y agoHere is a statement from Nokia regarding their 7 Plus incident: https://www.nokia.com/phones/en_int/privacy-info https://www.nokia.com/phones/en_int/privacy-info Interesting image they have that confirms that c2dms.com site is collecting device activation data. You can opt out of the "User Experience Program" (that does this upload) by going to Settings -> System -> About Phone -> User Experience Program and then untick the diagnostic report