4 ms·

Official Beijing2022 apps silently collect audio

101 points by jicea 5y ago

WaxedChewbacca 5y ago
frumper 5y ago
Title has a typo. I read it as Boeing, not Beijing. Beijing makes much more sense.
- jicea 5y ago
  Fixed, thanks!
ketz1 5y ago
tjpnz 5y ago
Has the IOC made any official statement regarding this? I note that this isn't the first issue to have been discovered in apps bearing the Olympic trademark.
iakov 5y ago
Authorian state is going to do what authorian states always did, but better and bigger - thanks to the technology. And the western politicians along with olympic committee will shut their mouths and pretend that nothing is happening. Even the “progressive” EU politicians can’t be bothered to boycott the olympics. Really disappointing and pathetic behavior of our spineless leaders.
- ashwagary 5y ago
  Would Olympic athletes need Chinese (Mandarin, etc) words translated to their native language or vice versa? Because it seems the company involved makes translation software/devices, but do go on.
  - freedrock87 5y ago
    Looks we have a CCP shill in our midst. You don't even try to hide it.
    - xnyan 5y ago
      This kind of comment is not appropriate for hacker news, if you are really worried send an email as explained in the guidelines: >Please don't post insinuations about astroturfing, shilling, bots, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.
    - dang 5y ago
      You broke the site guidelines egregiously here. We ban accounts that do this, so please don't do it again. There are hundreds of past explanations at https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=true&page=0&query=by:dang%20astroturf https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme... for anyone who wants more. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting to HN, we'd appreciate it.
    - ashwagary 5y ago
      I was also called an "Iraq and Vietnam shill" by similar types before those wars.
- nix23 5y ago
  >Really disappointing and pathetic behavior of our spineless leaders. Yeah it's like 1936 and still no one has learned anything from the past. IOC and FIFA are some of the most corrupt organizations, and even worse...supported by most country's, because it's for sport and "world-freedom"
- 2OEH8eoCRo0 5y ago
  The US is diplomatically boycotting the Olympics over "genocide and crimes against humanity" in Xinjiang. https://www.nytimes.com/article/diplomatic-boycott-olympics.html https://www.nytimes.com/article/diplomatic-boycott-olympics.... https://www.npr.org/2022/01/27/1076047424/china-is-demanding-us-end-its-interference-in-beijing-olympics https://www.npr.org/2022/01/27/1076047424/china-is-demanding...
  - deleted 5y ago
    [deleted]
  - HWR_14 5y ago
    The US is sending Olympians, but not any diplomatic representation. NBC is broadcasting the games, but not sending any reporters. These are both protests, but I don't think either rises to term boycott.
    - 2OEH8eoCRo0 5y ago
      > China is demanding the U.S. end "interference" in the Beijing Winter Olympics, which begin next month, in an apparent reference to a diplomatic boycott imposed by Washington and its allies.
nickdurfe 5y ago
His twitter feed is interesting; seems folks have some doubts about his research, both this and past vulnerabilities he found.
DriftRegion 5y ago
If you give the app permissions or use its built-in translation feature, can this really be called "silently"? Check the CitizenLab report: https://citizenlab.ca/2022/01/cross-country-exposure-analysis-my2022-olympics-app/ https://citizenlab.ca/2022/01/cross-country-exposure-analysi...
iqanq 5y ago
How can they silently collect audio when they need to show a permission prompt to record audio?
berdario 5y ago
Those claims seem unsubstantiated https://twitter.com/dangoodin001/status/1486976676965715968 https://twitter.com/dangoodin001/status/1486976676965715968 ok, it's importing iFlytek. But without demonstrating what it's doing and when, even if it's listening (which is not clear if it's happening) it could just be listening for a wake word (just like Cortana, Google Assistant, etc. work) Moreover, this guy seems to have willfully mistranslated the EULA to pretend that it's doing something it isn't doing. https://twitter.com/rpotter_9/status/1486982536232587264 https://twitter.com/rpotter_9/status/1486982536232587264 Whoever implemented the app though, should've kept it simple. Adding more needless functionality is just going to drive sinophobes and conspiracy theorists in a frenzy
- sdflhasjd 5y ago
  I certainly wouldn't trust an app like this, the Android permission list is ludicrous, and the privacy statements in the EULA are equally so, but... Jonathan Scott has yet to publish anything that concretely backs up this statement at the top of his Twitter: "I can definitively say all Olympian audio is being collected, analyzed and saved on Chinese servers using tech from USA blacklisted AI firm " I'm not an expert reverse engineer, but he needs to show more than just some extracted symbol names, string resources and unidentified network traffic before making "definitive" claims.
  - tcmart14 5y ago
    Yea. Especially saying the Android permission list is ludicrous, that sums about a majority of apps in existence, even from 'good ole American' companies.
- sithadmin 5y ago
  Entanglement with iFlytek alone is potentially problematic for Apple and Google, who are distributing this on their respective platforms, because iFlytek is on the BIS Entity List. US persons and businesses are prohibited from business relations with these entities without prior approval and license from the US federal government, and this process is quite onerous and expensive in terms of the specialized legal talent required. As a casual observer on the fringes of trade and sanctions law, my gut tells me this case alone will probably not result in administrative action (and certainly not criminal) against Google or Apple by the US gov, but may contribute to opening a new can of worms with regard to app review, either self-imposed by the platforms or under pressure by the US government.
scoutt 5y ago
I really wanted to believe in this but the "evidence" is pretty poor: https://github.com/jonathandata1/2022_beijing https://github.com/jonathandata1/2022_beijing I read a lot of security reports and you don't include a screenshot of random Wireshark packets with red arrows saying "This shows data leaving the iPhone". And this is the first one of a series of non-sense screenshots. This means at least one thing: this was written in a way to be picked up and mentioned by larger media and non-tech people. So, to me it sounds more like if someone with a stake in all this said "Hi researcher. Here are 10K USD. Find me something controversial to shout about on Twitter and to point fingers. Just add some technical terms here and there and we'll be fine.".

101 points by jicea 5y ago

WaxedChewbacca 5y ago

frumper 5y ago

Title has a typo. I read it as Boeing, not Beijing. Beijing makes much more sense.

jicea 5y ago
Fixed, thanks!

ketz1 5y ago

tjpnz 5y ago

Has the IOC made any official statement regarding this? I note that this isn't the first issue to have been discovered in apps bearing the Olympic trademark.

iakov 5y ago

Authorian state is going to do what authorian states always did, but better and bigger - thanks to the technology. And the western politicians along with olympic committee will shut their mouths and pretend that nothing is happening. Even the “progressive” EU politicians can’t be bothered to boycott the olympics. Really disappointing and pathetic behavior of our spineless leaders.

ashwagary 5y ago
Would Olympic athletes need Chinese (Mandarin, etc) words translated to their native language or vice versa? Because it seems the company involved makes translation software/devices, but do go on.
- freedrock87 5y ago
  Looks we have a CCP shill in our midst. You don't even try to hide it.
  - xnyan 5y ago
    This kind of comment is not appropriate for hacker news, if you are really worried send an email as explained in the guidelines: >Please don't post insinuations about astroturfing, shilling, bots, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.
  - dang 5y ago
    You broke the site guidelines egregiously here. We ban accounts that do this, so please don't do it again. There are hundreds of past explanations at https://hn.algolia.com/?sort=byDate&dateRange=all&type=comment&storyText=false&prefix=true&page=0&query=by:dang%20astroturf https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme... for anyone who wants more. If you'd please review https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting to HN, we'd appreciate it.
  - ashwagary 5y ago
    I was also called an "Iraq and Vietnam shill" by similar types before those wars.
nix23 5y ago
>Really disappointing and pathetic behavior of our spineless leaders. Yeah it's like 1936 and still no one has learned anything from the past. IOC and FIFA are some of the most corrupt organizations, and even worse...supported by most country's, because it's for sport and "world-freedom"
2OEH8eoCRo0 5y ago
The US is diplomatically boycotting the Olympics over "genocide and crimes against humanity" in Xinjiang. https://www.nytimes.com/article/diplomatic-boycott-olympics.html https://www.nytimes.com/article/diplomatic-boycott-olympics.... https://www.npr.org/2022/01/27/1076047424/china-is-demanding-us-end-its-interference-in-beijing-olympics https://www.npr.org/2022/01/27/1076047424/china-is-demanding...
- deleted 5y ago
  [deleted]
- HWR_14 5y ago
  The US is sending Olympians, but not any diplomatic representation. NBC is broadcasting the games, but not sending any reporters. These are both protests, but I don't think either rises to term boycott.
  - 2OEH8eoCRo0 5y ago
    > China is demanding the U.S. end "interference" in the Beijing Winter Olympics, which begin next month, in an apparent reference to a diplomatic boycott imposed by Washington and its allies.

nickdurfe 5y ago

His twitter feed is interesting; seems folks have some doubts about his research, both this and past vulnerabilities he found.

DriftRegion 5y ago

If you give the app permissions or use its built-in translation feature, can this really be called "silently"? Check the CitizenLab report: https://citizenlab.ca/2022/01/cross-country-exposure-analysis-my2022-olympics-app/ https://citizenlab.ca/2022/01/cross-country-exposure-analysi...

iqanq 5y ago

How can they silently collect audio when they need to show a permission prompt to record audio?

berdario 5y ago

Those claims seem unsubstantiated https://twitter.com/dangoodin001/status/1486976676965715968 https://twitter.com/dangoodin001/status/1486976676965715968 ok, it's importing iFlytek. But without demonstrating what it's doing and when, even if it's listening (which is not clear if it's happening) it could just be listening for a wake word (just like Cortana, Google Assistant, etc. work) Moreover, this guy seems to have willfully mistranslated the EULA to pretend that it's doing something it isn't doing. https://twitter.com/rpotter_9/status/1486982536232587264 https://twitter.com/rpotter_9/status/1486982536232587264 Whoever implemented the app though, should've kept it simple. Adding more needless functionality is just going to drive sinophobes and conspiracy theorists in a frenzy

sdflhasjd 5y ago
I certainly wouldn't trust an app like this, the Android permission list is ludicrous, and the privacy statements in the EULA are equally so, but... Jonathan Scott has yet to publish anything that concretely backs up this statement at the top of his Twitter: "I can definitively say all Olympian audio is being collected, analyzed and saved on Chinese servers using tech from USA blacklisted AI firm " I'm not an expert reverse engineer, but he needs to show more than just some extracted symbol names, string resources and unidentified network traffic before making "definitive" claims.
- tcmart14 5y ago
  Yea. Especially saying the Android permission list is ludicrous, that sums about a majority of apps in existence, even from 'good ole American' companies.
sithadmin 5y ago
Entanglement with iFlytek alone is potentially problematic for Apple and Google, who are distributing this on their respective platforms, because iFlytek is on the BIS Entity List. US persons and businesses are prohibited from business relations with these entities without prior approval and license from the US federal government, and this process is quite onerous and expensive in terms of the specialized legal talent required. As a casual observer on the fringes of trade and sanctions law, my gut tells me this case alone will probably not result in administrative action (and certainly not criminal) against Google or Apple by the US gov, but may contribute to opening a new can of worms with regard to app review, either self-imposed by the platforms or under pressure by the US government.

scoutt 5y ago

I really wanted to believe in this but the "evidence" is pretty poor: https://github.com/jonathandata1/2022_beijing https://github.com/jonathandata1/2022_beijing I read a lot of security reports and you don't include a screenshot of random Wireshark packets with red arrows saying "This shows data leaving the iPhone". And this is the first one of a series of non-sense screenshots. This means at least one thing: this was written in a way to be picked up and mentioned by larger media and non-tech people. So, to me it sounds more like if someone with a stake in all this said "Hi researcher. Here are 10K USD. Find me something controversial to shout about on Twitter and to point fingers. Just add some technical terms here and there and we'll be fine.".