6 ms·

Cure53 Audit of Chinese ‘Police App’

115 points by ericdanielski 7y ago

hnarn 7y ago
Direct link to the report (PDF): https://cure53.de/analysis-report_bxaq.pdf https://cure53.de/analysis-report_bxaq.pdf
wiz21c 7y ago
I'm going to be downvoted but... Android has access to all my files and is installed on my phone even before I reach the USA. Since the US government seems to have close ties (1) with Google, this makes me a bit nervous as well. So I'm not sure the chinese are more evil than our occidental countries... Moreover, it seems that chinese authorities force people to install their software on the phones. But, last time I checked, I was forced to accept the EULA on my phone as soon as I turned it on (Nokia One for the record). I'm sure that I'm just as "forced" to install Android on my phone as I'm forced to install the chinese software : basically I can refuse, but it means that I have to throw the phone away... Obviously I make a kind of caricature here, but my point is : whatever the way it is installed, the software on your phone is controlled by a powerful entity, controlled maybe by a powerful government which has, like most of them, some blood on its hands. There's nothing wrong with that, that's history; but we don't need to look to far away to see problems with privacy... [1] https://wikileaks.org/google-is-not-what-it-seems/ https://wikileaks.org/google-is-not-what-it-seems/
- t0astbread 7y ago
  The phone situation is very unfortunate since there is basically no widespread phone operating system that isn't developed by a big corporation with possible ties to the US government. I for one use an Android fork (LinageOS) and I trust the maintainers to remove any malicious features from stock Android but I can also never say for sure.
- tcbawo 7y ago
  Except, Google is accountable to shareholders and US legal code. The US government has accountability through elections and the judicial system. What accountability does the Chinese government have?
  - wiz21c 7y ago
    There's the question of culture. I'd be really happy to have an opinion about my country from a China inhabitant... I should travel there once, just to see it for myself...
  - Zenst 7y ago
    Hard to say from an outside perspective. https://en.wikipedia.org/wiki/Elections_in_China https://en.wikipedia.org/wiki/Elections_in_China Certainly worth a read and would be very interesting to compare what we class as democracy and accountability country by country from a neutral perspective. Though I'm not aware of any such articles of comparison.
  - DoofusOfDeath 7y ago
    > What accountability does the Chinese government have? Presumably, they need to answer to their president.
    - leesalminen 7y ago
      And their president answers to whom? Doesn’t Xi have a lifetime appointment?
  - duxup 7y ago
    Very importantly an independent and strong judicial system.
  - logicchains 7y ago
    A lot of good that accountability did Kim Dotcom, or the brown-skinned people being blown up by drones, or the hundred thousand civilians killed in Iraq after America brought about regime change. Over the past century America has interfered far more in other countries' affairs than China ever has. A cynical way of putting it: China's government oppresses its own people, America's government oppresses everybody but its own people. As someone neither American nor Chinese I feel China's far less likely to come along and bother me when I'm minding my own business than America is.
- Iv 7y ago
  And? In my book, both the USA/corporate style of surveillance and the Chinese way are bad and need to be defeated. Don't buy the rhetoric that you have to choose a side in a fight between these two bullies. We can argue on the one that uses its surveillance for the worst, we can argue on the rights that users have to disassemble and protect their devices on either side. The point is that we need tool to protect our freedoms, because they are attacked by powerful actors, like China. And indeed, being China's competitor does not automatically makes USA a champion of privacy and user rights.
  - wiz21c 7y ago
    >> And ? There's no "and". According to what you wrote, we're thinking the same thing :-)
- hnarn 7y ago
  > I'm going to be downvoted but... From the Hacker News Guidelines: > Please don't comment about the voting on comments. It never does any good, and it makes boring reading. Please try to avoid sensationalist or dishonest language when commenting.
  - gibba999 7y ago
    It's sometimes helpful, actually. Virtually any comment critical of Google gets downvote aggressively. I suspect that's a lot of Googlers reading Hacker News (who drank the coolaid) rather than an intentional astroturf campaign, but in either case, I've noticed a comment like that tends to help. It prevents the kneejerk "You criticised my employer/community/ego, so I'll downvote you" reaction, and sometimes leads to a bit more critical thought.
14 7y ago
Well didn’t I read somewhere that if I cross the US border I could be forced to allow a search of my electronics? Actually think I only need to be within 100miles of the border and they are allowed to do that in the name of security. My point is who cares that the Chinese are doing this when I can look to my neighbors to the south doing the exact same thing. Well I care but I am not about to look down on the Chinese because they do it too. So much “do as I say not as I do” with the US it’s rediculous.
dfcmt 7y ago
>All extracted information is bundled as a ZIP file, without applying any protection like a password. The ZIP file is then sent via an HTTP POST request to http://192.168.43.1:8080/ http://192.168.43.1:8080/. This shows that not only no transport security (e.g. https:// https://) is in place, but also that an internal IP address is used. Unless they're expecting a MITM from the police network (or wherever they use this app) why is no https a problem? >BXAQ uses the default icon for Android apps, which means there is no attempt at being covert or discreet about it. ...or maybe they didn't put an icon because it's optional and unnecessary for what essentially is an internal app. I mean really they are not trying to be unbiased or anything about the analysis.
- cal5k 7y ago
  MITM? You don't need to MITM something that isn't even encrypted... anyone with a modicum of technical ability can use WireShark to grab these files if they're transmitted over public Wi-Fi. And probably cellular connections, too.
  - sheep-a 7y ago
    Exactly, sit outside the police station/wherever just nearby spin up wireshark in monitor mode and you have a stream of personal info on the owners of those scanned phones
  - dfcmt 7y ago
    But they aren't transmitted over public wifi. They are transmitted inside of some kind of private network, given that they are transmitted to a server in the 192.168/24 range
    - yorwba 7y ago
      You can have servers with an IP in that range available on public WiFi, no problem at all. If the network is not public, whoever installs the app still needs to connect to it, so you can intercept any credentials they enter, or even run Wireshark on the device.
- 7y ago
yorwba 7y ago
This is the same app as discussed in https://news.ycombinator.com/item?id=20335816 https://news.ycombinator.com/item?id=20335816 That Motherboard article also links to a repository with the APK: https://github.com/motherboardgithub/bxaq https://github.com/motherboardgithub/bxaq
- jaxbot 7y ago
  If that's the case, it's worth noting (since it's often lost here, on reddit and in the news) that is app is only required at border checkpoints in Xinjiang. Putting Xinjiang on your itinerary would likely result in your visa being refused anyway. If you are traveling to China for business or pleasure, you won't need to worry about this. Source: Was in Shenzhen within the past month. Normal customs/border control practices. Nobody asked for personal devices. Only surveillance that was obvious was biometric checkpoint at customs, and some sort of face scan (?) at the subway queue.
  - shubb 7y ago
    A friend was in China on business recently and the local corporate It department told him they were installing government required monitoring software so that he could vpn back to the US office. This might have been a misunderstanding as that guy isn't very technical, have you heard of this?
    - jaxbot 7y ago
      I'm not sure and I don't want to misspeak. I know that my company does not do such a thing, and my phone when roaming (Project Fi) bypasses the GFW. However, I do know there are specific different IT infra requirements when connecting from China but none that are gov-monitoring related. It may be a misunderstanding, or it may be a procedure that your friends' IT was following that we aren't. That being said, foreigners accessing the normal WWW is really not a major concern if you think about it.
  - gruez 7y ago
    >Putting Xinjiang on your itinerary would likely result in your visa being refused anyway 1. get a multiple entry visa 2. say you're going to shanghai or whatever on the application 3. go to Xinjiang on your second visit
cltsang 7y ago
Uncovered CCP internal document said they oppose "universal values" as a concept established by western civilizations [0][1]. So human rights violations is not a thing in China. Under the current Chinese government's rule, the people do not have rights, unless, of course, when the "rights" are beneficial to the longevity of the CCP. [0]: https://en.wikipedia.org/wiki/Document_Number_Nine https://en.wikipedia.org/wiki/Document_Number_Nine [1]: https://cn.nytimes.com/china/20130820/c20document/dual/ https://cn.nytimes.com/china/20130820/c20document/dual/
- cljs-js-eval 7y ago
  This is kind of an interesting cultural difference between Europe/America and China. While we talk about universal rights, they talk about universal duties, and this only sometimes converges on the same values. For example: Both the West and China believe that old people deserve care in their old age. The West would justify this by saying that the elderly have fundamental human rights, which would be neglected without care. Chinese would justify this by saying that the young have a duty of care to the old. Both the West and China (at least superficially) believe that rulers should treat their subjects with respect. In the West, this is because each subject has human rights. In China, this is because the ruler has a duty to treat their subjects respectfully. So I would not make the mistake of thinking that the Chinese are somehow amoral because they do not subscribe to the doctrine of human rights. It must honestly seem to them like a Western concept that clashes with their view of morality (or at least it would if I were in their shoes). But the Chinese government must have a set of duties to their people. I would love to read a document where they outline those, I'm sure it must exist somewhere.
  - logicchains 7y ago
    https://en.wikipedia.org/wiki/Mandate_of_Heaven https://en.wikipedia.org/wiki/Mandate_of_Heaven. The idea hasn't changed much in two thousand years: the ruler that rules well is the ruler that deserves to govern. If the ruler rules badly enough, they'll be overthrown.
    - 7y ago
gibba999 7y ago
I don't quite see much difference between Chinese government surveillance and US corporate surveillance at this stage. The power structures are different, but the result is the same. Google knows everywhere I am and reads all my email.
- devoply 7y ago
  Google does not operate re-education camps which kill people now and then. Correct me if I am wrong. If I am, let's go liberate the people it's holding with the help of the US military.
  - gibba999 7y ago
    You mean the one which (still) runs Gitmo? Or perhaps we should get our law enforcement to help out. But then who would we have to do the very important work of putting kids in cages on the border? I think you're making the mistake of viewing Google and the US military as autonomous entities. We have 7 billion people in the world. Organizational structures, whether governmental, corporate, or otherwise are abstractions generally designed to keep people happy, healthy, organized, and productive. Systems define how those abstractions interact. Most bad systemic behaviors come from those interactions. It makes sense to understand good and bad behavior on an individual level (e.g. an person who spends 3 years at Google and then moves on to Facebook for 6 months, finds it doesn't work out, and gets a job at Apple). It makes sense to understand how organizational structures interact to cause healthy behavior or oppressive behavior at an overall level. It usually makes very little sense to look at individual organizations without looking at the overall systems they operate in. At this point, Google seems to do a lot of bad in the world. That's not a criticism of Google the organization. It legally can't do otherwise. The CEO of Google has a fiduciary duty to maximize shareholder value, while the regulatory regime makes the behavior it's engaging in do exactly that. The trick is to fix the ecosystem around Google so it can do good. That's actually a place where Googlers and similar could do a lot of good, if they can get past the ego issues which lead to defensiveness like from the post like yours.
- learc83 7y ago
  The difference is that Google can't throw you into a camp without trial for what they discover.

115 points by ericdanielski 7y ago

Direct link to the report (PDF): https://cure53.de/analysis-report_bxaq.pdf https://cure53.de/analysis-report_bxaq.pdf

I'm going to be downvoted but... Android has access to all my files and is installed on my phone even before I reach the USA. Since the US government seems to have close ties (1) with Google, this makes me a bit nervous as well. So I'm not sure the chinese are more evil than our occidental countries... Moreover, it seems that chinese authorities force people to install their software on the phones. But, last time I checked, I was forced to accept the EULA on my phone as soon as I turned it on (Nokia One for the record). I'm sure that I'm just as "forced" to install Android on my phone as I'm forced to install the chinese software : basically I can refuse, but it means that I have to throw the phone away... Obviously I make a kind of caricature here, but my point is : whatever the way it is installed, the software on your phone is controlled by a powerful entity, controlled maybe by a powerful government which has, like most of them, some blood on its hands. There's nothing wrong with that, that's history; but we don't need to look to far away to see problems with privacy... [1] https://wikileaks.org/google-is-not-what-it-seems/ https://wikileaks.org/google-is-not-what-it-seems/

t0astbread 7y ago
The phone situation is very unfortunate since there is basically no widespread phone operating system that isn't developed by a big corporation with possible ties to the US government. I for one use an Android fork (LinageOS) and I trust the maintainers to remove any malicious features from stock Android but I can also never say for sure.
tcbawo 7y ago
Except, Google is accountable to shareholders and US legal code. The US government has accountability through elections and the judicial system. What accountability does the Chinese government have?
- wiz21c 7y ago
  There's the question of culture. I'd be really happy to have an opinion about my country from a China inhabitant... I should travel there once, just to see it for myself...
- Zenst 7y ago
  Hard to say from an outside perspective. https://en.wikipedia.org/wiki/Elections_in_China https://en.wikipedia.org/wiki/Elections_in_China Certainly worth a read and would be very interesting to compare what we class as democracy and accountability country by country from a neutral perspective. Though I'm not aware of any such articles of comparison.
- DoofusOfDeath 7y ago
  > What accountability does the Chinese government have? Presumably, they need to answer to their president.
  - leesalminen 7y ago
    And their president answers to whom? Doesn’t Xi have a lifetime appointment?
- duxup 7y ago
  Very importantly an independent and strong judicial system.
- logicchains 7y ago
  A lot of good that accountability did Kim Dotcom, or the brown-skinned people being blown up by drones, or the hundred thousand civilians killed in Iraq after America brought about regime change. Over the past century America has interfered far more in other countries' affairs than China ever has. A cynical way of putting it: China's government oppresses its own people, America's government oppresses everybody but its own people. As someone neither American nor Chinese I feel China's far less likely to come along and bother me when I'm minding my own business than America is.
Iv 7y ago
And? In my book, both the USA/corporate style of surveillance and the Chinese way are bad and need to be defeated. Don't buy the rhetoric that you have to choose a side in a fight between these two bullies. We can argue on the one that uses its surveillance for the worst, we can argue on the rights that users have to disassemble and protect their devices on either side. The point is that we need tool to protect our freedoms, because they are attacked by powerful actors, like China. And indeed, being China's competitor does not automatically makes USA a champion of privacy and user rights.
- wiz21c 7y ago
  >> And ? There's no "and". According to what you wrote, we're thinking the same thing :-)
hnarn 7y ago
> I'm going to be downvoted but... From the Hacker News Guidelines: > Please don't comment about the voting on comments. It never does any good, and it makes boring reading. Please try to avoid sensationalist or dishonest language when commenting.
- gibba999 7y ago
  It's sometimes helpful, actually. Virtually any comment critical of Google gets downvote aggressively. I suspect that's a lot of Googlers reading Hacker News (who drank the coolaid) rather than an intentional astroturf campaign, but in either case, I've noticed a comment like that tends to help. It prevents the kneejerk "You criticised my employer/community/ego, so I'll downvote you" reaction, and sometimes leads to a bit more critical thought.

14 7y ago

Well didn’t I read somewhere that if I cross the US border I could be forced to allow a search of my electronics? Actually think I only need to be within 100miles of the border and they are allowed to do that in the name of security. My point is who cares that the Chinese are doing this when I can look to my neighbors to the south doing the exact same thing. Well I care but I am not about to look down on the Chinese because they do it too. So much “do as I say not as I do” with the US it’s rediculous.

dfcmt 7y ago

>All extracted information is bundled as a ZIP file, without applying any protection like a password. The ZIP file is then sent via an HTTP POST request to http://192.168.43.1:8080/ http://192.168.43.1:8080/. This shows that not only no transport security (e.g. https:// https://) is in place, but also that an internal IP address is used. Unless they're expecting a MITM from the police network (or wherever they use this app) why is no https a problem? >BXAQ uses the default icon for Android apps, which means there is no attempt at being covert or discreet about it. ...or maybe they didn't put an icon because it's optional and unnecessary for what essentially is an internal app. I mean really they are not trying to be unbiased or anything about the analysis.

cal5k 7y ago
MITM? You don't need to MITM something that isn't even encrypted... anyone with a modicum of technical ability can use WireShark to grab these files if they're transmitted over public Wi-Fi. And probably cellular connections, too.
- sheep-a 7y ago
  Exactly, sit outside the police station/wherever just nearby spin up wireshark in monitor mode and you have a stream of personal info on the owners of those scanned phones
- dfcmt 7y ago
  But they aren't transmitted over public wifi. They are transmitted inside of some kind of private network, given that they are transmitted to a server in the 192.168/24 range
  - yorwba 7y ago
    You can have servers with an IP in that range available on public WiFi, no problem at all. If the network is not public, whoever installs the app still needs to connect to it, so you can intercept any credentials they enter, or even run Wireshark on the device.
7y ago

yorwba 7y ago

This is the same app as discussed in https://news.ycombinator.com/item?id=20335816 https://news.ycombinator.com/item?id=20335816 That Motherboard article also links to a repository with the APK: https://github.com/motherboardgithub/bxaq https://github.com/motherboardgithub/bxaq

jaxbot 7y ago
If that's the case, it's worth noting (since it's often lost here, on reddit and in the news) that is app is only required at border checkpoints in Xinjiang. Putting Xinjiang on your itinerary would likely result in your visa being refused anyway. If you are traveling to China for business or pleasure, you won't need to worry about this. Source: Was in Shenzhen within the past month. Normal customs/border control practices. Nobody asked for personal devices. Only surveillance that was obvious was biometric checkpoint at customs, and some sort of face scan (?) at the subway queue.
- shubb 7y ago
  A friend was in China on business recently and the local corporate It department told him they were installing government required monitoring software so that he could vpn back to the US office. This might have been a misunderstanding as that guy isn't very technical, have you heard of this?
  - jaxbot 7y ago
    I'm not sure and I don't want to misspeak. I know that my company does not do such a thing, and my phone when roaming (Project Fi) bypasses the GFW. However, I do know there are specific different IT infra requirements when connecting from China but none that are gov-monitoring related. It may be a misunderstanding, or it may be a procedure that your friends' IT was following that we aren't. That being said, foreigners accessing the normal WWW is really not a major concern if you think about it.
- gruez 7y ago
  >Putting Xinjiang on your itinerary would likely result in your visa being refused anyway 1. get a multiple entry visa 2. say you're going to shanghai or whatever on the application 3. go to Xinjiang on your second visit

cltsang 7y ago

Uncovered CCP internal document said they oppose "universal values" as a concept established by western civilizations [0][1]. So human rights violations is not a thing in China. Under the current Chinese government's rule, the people do not have rights, unless, of course, when the "rights" are beneficial to the longevity of the CCP. [0]: https://en.wikipedia.org/wiki/Document_Number_Nine https://en.wikipedia.org/wiki/Document_Number_Nine [1]: https://cn.nytimes.com/china/20130820/c20document/dual/ https://cn.nytimes.com/china/20130820/c20document/dual/

cljs-js-eval 7y ago
This is kind of an interesting cultural difference between Europe/America and China. While we talk about universal rights, they talk about universal duties, and this only sometimes converges on the same values. For example: Both the West and China believe that old people deserve care in their old age. The West would justify this by saying that the elderly have fundamental human rights, which would be neglected without care. Chinese would justify this by saying that the young have a duty of care to the old. Both the West and China (at least superficially) believe that rulers should treat their subjects with respect. In the West, this is because each subject has human rights. In China, this is because the ruler has a duty to treat their subjects respectfully. So I would not make the mistake of thinking that the Chinese are somehow amoral because they do not subscribe to the doctrine of human rights. It must honestly seem to them like a Western concept that clashes with their view of morality (or at least it would if I were in their shoes). But the Chinese government must have a set of duties to their people. I would love to read a document where they outline those, I'm sure it must exist somewhere.
- logicchains 7y ago
  https://en.wikipedia.org/wiki/Mandate_of_Heaven https://en.wikipedia.org/wiki/Mandate_of_Heaven. The idea hasn't changed much in two thousand years: the ruler that rules well is the ruler that deserves to govern. If the ruler rules badly enough, they'll be overthrown.
  - 7y ago

gibba999 7y ago

I don't quite see much difference between Chinese government surveillance and US corporate surveillance at this stage. The power structures are different, but the result is the same. Google knows everywhere I am and reads all my email.

devoply 7y ago
Google does not operate re-education camps which kill people now and then. Correct me if I am wrong. If I am, let's go liberate the people it's holding with the help of the US military.
- gibba999 7y ago
  You mean the one which (still) runs Gitmo? Or perhaps we should get our law enforcement to help out. But then who would we have to do the very important work of putting kids in cages on the border? I think you're making the mistake of viewing Google and the US military as autonomous entities. We have 7 billion people in the world. Organizational structures, whether governmental, corporate, or otherwise are abstractions generally designed to keep people happy, healthy, organized, and productive. Systems define how those abstractions interact. Most bad systemic behaviors come from those interactions. It makes sense to understand good and bad behavior on an individual level (e.g. an person who spends 3 years at Google and then moves on to Facebook for 6 months, finds it doesn't work out, and gets a job at Apple). It makes sense to understand how organizational structures interact to cause healthy behavior or oppressive behavior at an overall level. It usually makes very little sense to look at individual organizations without looking at the overall systems they operate in. At this point, Google seems to do a lot of bad in the world. That's not a criticism of Google the organization. It legally can't do otherwise. The CEO of Google has a fiduciary duty to maximize shareholder value, while the regulatory regime makes the behavior it's engaging in do exactly that. The trick is to fix the ecosystem around Google so it can do good. That's actually a place where Googlers and similar could do a lot of good, if they can get past the ego issues which lead to defensiveness like from the post like yours.
learc83 7y ago
The difference is that Google can't throw you into a camp without trial for what they discover.