11 ms·
Uhmm I read through the README but most of the screenshots don't say anything to me, and I did my fair bit of reverse-engineering. I see a screenshot of normal
by artdigital 5y ago
Uhmm I read through the README but most of the screenshots don't say anything to me, and I did my fair bit of reverse-engineering.
I see a screenshot of normal app startup, some random wireshark requests, some traces of what looks like a login/account system and some localization strings. The de-minified Javascript in the screenshot that author claims he could "clearly see the data was being exfiltrated" looks to me like a random Icon with some attrs. How is this relevant to exfiltration?
(Side-note his claim that he "performed a MITM attack to capture this iOS specific data" sounds more sensational than it actually is. He just put a transparent proxy in the middle, and didn't really attack anything)
The iFlytek stuff could be relevant and is interesting but there is so much noise, big headlines and "read my full report", that it feels to me the author tried very hard to find anything to post
Not saying the app is innocent. It's important to look more into what it's phoning home, but this is just the impression I got from reading through it. Maybe the full report will have some more solid findings in it. Still very cool that the entire decompiled source has been uploaded, that will get more curious eyes on it
- mads 5y agoWell, the permissions requested on Android seem kind of excessive for an app like this. Found some privacy policies: https://raw.githubusercontent.com/jonathandata1/2022_beijing/6bcb2cc48501dc863fd526bff7ec79640e0aec66/ios/com.systoon.dongaotoon_1548453616_v2.0.5_657/Payload/payload_unpacked/TSetting_secretAgreement_en.html https://raw.githubusercontent.com/jonathandata1/2022_beijing... https://my2022.beijing2022.cn/app-config-extra/protocal.html?toonType=137&configKey=USER_AGREEMENT_ADDRESS_EN#/ https://my2022.beijing2022.cn/app-config-extra/protocal.html...
- chippiewill 5y agoJust like every other Android app then?
- itsthecourier 5y ago
- eternauta3k 5y agoDid not RTFA, but it could be more complicated than a transparent proxy if the app uses SSL and pinned certificates.
- c0wb0yc0d3r 5y agoHere is the breakdown from the Citizen Lab. https://citizenlab.ca/2022/01/cross-country-exposure-analysis-my2022-olympics-app/ https://citizenlab.ca/2022/01/cross-country-exposure-analysi... To me the scariest is the exfiltration of so much personal data to parts unknown. Often unencrypted even.
- fock 5y agoThis is an interesting take on the summary I read that this is just another shitty, useless app including some CCP-censorship. Tell me: do you know to whom the myriad of ad-networks and apps you use send their data? I don't. And even if you look at the privacy policy, you don't, because according to meta, for Whatsapp they store your phone number, a list of blocked contacts aaaand nothing else? (which I honestly do not believe...)