TCL / Alcatel / Flash Secretly Phoning Home to China Server - Security Discussion

There is an ongoing thread at the Official Flash Community about a possible "spyware" embedded in the firmware of TCL / Alcatel Flash Plus 2 and Flash 2 smartphones.
A local TV station might have also picked up on the story and is now following this as well.
You guys might want to check this out:
Code:
hxxp://community.flash3c.com/t/fp2-secretly-phoning-home-to-china-server/13708
Seriously though, is there still any Android smartphone manufacturer that we can still trust aside from Samsung?

Yes, Adups has already been found doing this before (see previous thread about Blu phone etc), they claim it's nothing to worry about but in my opinion it's is (especially for some people eg my sisters work duties has put her up against Chinese SOE's) due to the data sent & the identifying data & ability to make changes without user knowledge and possible the tentacles of the CCP government reaching into the company if it so chooses it could then monitor her & put her and her colleagues at risk given some of the dodgy countries she's had to go to.
Some of the guys are getting worked up about this on the crackberry forum as TCL is Blackberry's subby (though the thread quickly veered off to Blackberry hardware, so unrelated to the Adups issue).
http://forums.crackberry.com/genera...ding-customers-data-china-1095845/index4.html
FWIW, I agree with Sorinv & DaFoxGrey that it's possible (well to some degree) without Blackberry noticing as they would not test every phone for this sort of thing from every production run, and it may not trigger any connection unless under specific conditions. It could be done via a compromised employee flashing dodgy firmware or amended wafer negative when running a batch, though would be hard to pull off even by government agents. But that's all on a whole different level to the Adups issue, besides I don't think Blackberry phones have that app or Baidu apks etc so for them it should be a none issue, but for Chinese phones .......
As for trusting Samsung ..... they are part of a huge conglomerate with close links to an opaque government who are susceptible to influences of a few powerful families & others, so they would not be immune. Nor their employees being immune to blackmail to make changes. That said they are who I have put my faith in for the time being. At the end of the day we all have to trust someone, as I'm sure you are aware.

Trust is a matter of perspective. Most devices from China oem are expected to have e this as their government requires it to monitor its citizens. Which is completely legal there and why most devices from China are banned to be owned by US government employees. It's just the way it is.
If trust us a big thing then the last thing you should be buying is an oem device. Get a nexus and then you can see every bit of code you put into your device.

Related

Droid X actually self-destructs if you try to mod it

Well, I might have recommended a Droid X for big-phone-lovin’ fandroids out there… but now that I’ve read about Motorola’s insane eFuse tampering-countermeasure system, I’m going to have to give this one a big fat DON’T BUY on principle. I won’t restate all my reasons for supporting the modding, hacking, jailbreaking, and so on of your legally-owned products here — if you’re interested in a user’s manifesto, read this — but suffice it to say that deliberately bricking a phone if the user fiddles with it does not fall under the “reasonable” category of precautions taken by manufacturers.
Click to expand...
Click to collapse
Read more
.............
Not trying to stop the hate train here but read this:
(This was the response they gave to Engadget.)
"Motorola's primary focus is the security of our end users and protection of their data, while also meeting carrier, partner and legal requirements. The Droid X and a majority of Android consumer devices on the market today have a secured bootloader. In reference specifically to eFuse, the technology is not loaded with the purpose of preventing a consumer device from functioning, but rather ensuring for the user that the device only runs on updated and tested versions of software. If a device attempts to boot with unapproved software, it will go into recovery mode, and can re-boot once approved software is re-installed. Checking for a valid software configuration is a common practice within the industry to protect the user against potential malicious software threats. Motorola has been a long time advocate of open platforms and provides a number of resources to developers to foster the ecosystem including tools and access to devices via MOTODEV "
Click to expand...
Click to collapse
It will still be hard to crack, but the phone will not be rendered useless by those evil people at Motorola
I think a much better question is: SHOULD it be cracked? Should our community spend money on a phone specifically designed to screw with us? By Motorola's own words, they suggest going with another manufacturer if you want to do modding, flashing, etc. So now I should spend my money and time engaging in the very fight we laugh at iPhone users over?
No. I love my MotoDroid, but given the B.S. coming out of Motorola's camp, my original Droid will be my last Motorola phone.
Screw you Moto, fall back into the irrelevance that *WE* saved you from.
And they say its to stop users running the wrong code? So? Surley any that are sent back should be diagnosable to Motorola that they have been hit with unofficial code and just sent back to the user as "broken by user".
I don't understand the argument they give .....
I also am going to be boycotting Motorola for this flagrant act of defiance towards its customer base. This does not just fall on Motorolas shoulders. We all know this has a hidden stench of Verizon behind it. No, we can not prove it. But old dogs play old tricks. So, to any company that thinks they can control its consumer base with this crap you will not win this.
This is the kind of stuff that the government likes to see. It gives them a study point on how many people will actually lie down and die on such a small matter. Because, if you can't fight aginst the small stuff. Then the government will know that it will most likely get away with the bigger things. This may seem like a streach to some. But if you look at the correlation between government and business entities. That also government also is. They try to play the same tricks. Fact of the matter is. The government works for us. We vote for them and then pay them to do that job and we let them know we want something and if they do not deliver we vote them out. Well, corporations are a little like this. We vote with our wallets and the forums. And this whole thing that the Droid X sold out the first day. Well that is actually speculation. They may have sold out of the 45 phones sent to each Verizon store. Yet some still have them. This is nothing more than a ploy to discourage those of us who fight. Again it may be me making a streach on this. And maybe not. But look at it as a moral builder to the Modding and hacking community. It was built it was programed. It all can and will be reversed. We purchase food. A restaurant has no right to tell us how to eat it. It belongs to us. Same with consumer electronics. And Open source software. Actually even with closed source software also. If we want to mode it then we may do so. We give money for it. If these company's actually made something that worked to its full potential then we would have nothing to complain about. If they want to short us then we have the right to extend the ussage of our stuff. As long as it does not harm another human being. Have at it people.
Shamma Lamma Do From My Moto DROID To You.
goldenu said:
I think a much better question is: SHOULD it be cracked? Should our community spend money on a phone specifically designed to screw with us?
Click to expand...
Click to collapse
Yes it should, out of mere principle at this point.
Breakthecycle2 said:
Yes it should, out of mere principle at this point.
Click to expand...
Click to collapse
You'll just encourage them. Just boycot. Job done.
lol - sorry just noticed, you own one so of course, you want it cracked heheheh
No i-moto droid for me, Oh well makes my toss up between Galaxy S and Desire all the easier.

Life, Liberty, and the Pursuit...of ROOT!!

Perhaps upon reading that, you call to mind Thomas Jefferson pulling out his Android to thwart impeding forces. I actually like that idea, but I know that the time in which John Locke wrote the contributing phrase was much different than today. It was a time of change and also a time when people realized their full potential to make a difference. In the spirit of our Founding Fathers, and in an exercise of my own Personal Liberties, I have started a petition to require cell phone carriers to allow bootloader unlock on any Android device that is not under contract or subsidy. Many of you will know immediately what this means, and the exponential benefits of such a law. Many of you will flip to the next activity complacently believing this does not affect you. If you do not understand, I wish to enlighten you as to how this affects each and every Android user in the world. Signing the petition takes only a few moments of your time and adds to the greater good of our technology and innovation as a Nation.
So what exactly does this “Bootloader Unlock” thing mean?
Well, that is a great question. Most simply put, according to Motorla’s website, “bootloader is a little bit of code that tells your device's operating system how to boot up”. That does not mean much to the average user, I am sure. What it means in my own words is it is a piece of code that dictates what I can and cannot do, in terms of software modification, to my own personal Android device. On my wireless provider whom I will call Big Red, their requirement is that OEMs (Original Equipment Manufacturers, or simply phone makers) lock this bit of code to prevent modification by the end-user or customer. I am certain, to those that do not wish to modify their devices, this sounds like a good fail-safe to avoid breaking their devices. I am also certain that to those like myself, those who have the experience and knowledge to do things like flash custom firmware or software and modify our devices to suit our own personal taste and needs, this is a huge roadblock and an impediment on what we can do with our own personal property and how it can be improved. In order to modify system files as the user sees fit, a thing called Root is required. Root is, most simply privileged access to a phones file system. A locked bootloader means that in order to gain “Root” access, a security exploit must be found and exploited in order to modify system files. These exploits are literally holes that must be (and typically are) patched in software updates sent out by the service providers or manufacturers to protect the end-user. While the efforts of the security experts are always going to be required to keep us safe and updated, I personally do not want to rely on someone to hack the software so it can be modified. This should be an inherent ability of any user who does not have a subsidy or contract obligation. I also feel that any device that can be updated by the user allows the people who develop for Android to Innovate and push our technology farther forward. When manufacturers are required to lock down a device, ultimately, the user is the one who loses. My first Android device, the Droid 1 or A855 ran an under-volted overclocked kernel (simply another piece of code that tells a device how to boot and how to run its processor among other things) that ran 1.7ghz on it’s ~600mhz processor. I used that phone at least twice as long as I would have if it hadn’t been bootloader unlocked. Also, on the note of the OG Droid, I can say that this was the phone that helped Verizon to compete with the Iphone, bolstering the customer base and creating mass knowledge of the Andoid platform. This was done with a bootloader-unlocked device. It seems that once the market was realized, bootloader locking became the normative. The Droid line has been bootloader-locked ever since. There are several examples of the same hardware being sold, under different names, with the bootloader-unlockable right out of the box. The most recent example of this is the Motorola xt1250, or Moto Maxx (US CDMA). The international version of the same phone, the xt1225 is also bootloader-unlockable. All three are known as the Quark. They are identical in hardware aside from exteriors. Big Red required their version to have the bootloader locked. There is no way to have it unlocked for now.
So Why Would I Want to Sign This Petition?
Honestly, you may not care about Android at all. You could conceivably have never been interested, and care less. However, the technology available to you today is available because of innovations and advancements that have been made across a wide technological array of development. Android is no different. Love that Halo or Heads Up inspired feature ____ manufacturer just put on your new phone? People who develop are to be thanked. The possibilities are endless for what can be done and applied across many platforms. The future of mobile technology can be greatly advanced by creating open access for all who are inclined.
Catharsis
Okay, I admit it. It is really, really unlikely our politicians actually act upon this petition, even if 100,000 signatures are reached. As much as I like to think our law should “fix” things that are wrong, I can agree with one of my favorite developers from back in the day, @adrenalyne, when he said [government typically does not, and should not interfere with private business.] I can agree with that on the same grounds by which I feel we should be granted bootloader unlock on…if and only, if, no one’s rights are infringed upon. I feel it is all of our right to do what we please with our own personal property. There was a great analogy given on XDA Developers forum in the bounty thread where this all started by @Wynnded In essence, it said the carrier provides the highway, the OEM provides the device, but it is the carrier’s highway, so if the carrier requires the OEM to lock it down so be it. Personally, I feel that if the carrier has a highway, it is a toll-road, as I pay for my service. I purchase my vehicle outright, so if I want to modify it, and I pay for my vehicle, making no obligation to said toll operator, it is not within their range of rights to tell me I cannot modify my vehicle in the way I see fit. Thank you for your time. –kitcostantino @ medicbeard on twitter #unlockthedroids
https://petitions.whitehouse.gov/pe...e-not-subsized-or-attatched-contract/QfTmsspy
Original thread:
http://forum.xda-developers.com/dro...unlock-bootloader-root-turbo-t2927958/page115
Sources:
https://motorola-global-portal.custhelp.com/app/standalone/bootloader/unlock-your-device-a
http://en.wikipedia.org/wiki/Rooting_(Android_OS)
I ask for no donations, nor anything else. Simply share this if you feel so compelled. Really, it hurts nothing even if you don’t.
#unlockthedroids

Government finds spyware and censorship in Xiaomi Phone

Lithuanian government warns about secret censorship features in Xiaomi phones
The Lithuanian Defense Ministry published a security audit on Wednesday for three popular 5G smartphone models manufactured in China, recommending that citizens avoid or stop using at least two of the three devices, citing privacy infringements and secret censorship capabilities.
therecord.media
https://www.nksc.lt/doc/en/analysis/2021-08-23_5G-CN-analysis_env3.pdf
PDF analysis attached.
Yeah I saw that. No big surprise...
You can get a used Note 10+ now for $400-800.
Just ordereded up a new one for $800.
Either way a better deal and it's a flagship phone with great performance... and no CCP junk.
Cleary not for European / Global International users apparently. Answer from Xiaomi :
Following the publication of our article, Xiaomi asserted its right of reply. Here is the manufacturer's full statement: “Xiaomi devices do not censor communications to or from its users. Xiaomi has never restricted or blocked the personal behaviors of users of its smartphones, such as searching, calling, browsing the Internet or using third-party communication software, and never will. We respect and are committed to fully protecting the legal rights of our community. Xiaomi fully complies with the General Data Protection Regulation (GDPR) of the European Union ”.
Click to expand...
Click to collapse
And in the pdf it's explain it's only with Mi Browser (no one use this ****)
With phone like Xiaomi (using M11 right now) I actually feel much safer rooting the phone, then use AdAway and AFWall+ plus to block suspicious system activities. This in addition to the usual debloating to get rid of as many Xiaomi related stuff as I can.
After implementation I did a quick check on pihole, no secret packets sent to Xiaomi it seems. Not comprehensive I know, but it gives me peace of mind.
Using the command line "iptables -nvL OUTPUT" I can see AFWall+ blocking all these system related traffic. My phone isn't impacted at all as everything remains operational. For the fun of it I also have this line executed whenever my phone boots:
iptables -I OUTPUT -m owner --gid system -j REJECT
"system" seems to be everything MIUI related. I can see this extra instruction blocking additional traffic, and nothing on my phone stops working with this. So it is there just for extra peace of mind.
seemebreakthis said:
With phone like Xiaomi (using M11 right now) I actually feel much safer rooting the phone, then use AdAway and AFWall+ plus to block suspicious system activities. This in addition to the usual debloating to get rid of as many Xiaomi related stuff as I can.
After implementation I did a quick check on pihole, no secret packets sent to Xiaomi it seems. Not comprehensive I know, but it gives me peace of mind.
Using the command line "iptables -nvL OUTPUT" I can see AFWall+ blocking all these system related traffic. My phone isn't impacted at all as everything remains operational. For the fun of it I also have this line executed whenever my phone boots:
iptables -I OUTPUT -m owner --gid system -j REJECT
"system" seems to be everything MIUI related. I can see this extra instruction blocking additional traffic, and nothing on my phone stops working with this. So it is there just for extra peace of mind.
Click to expand...
Click to collapse
One problem being the CCP's insidious goal of burrowing into all civilian devices and platforms.
The possibility of unknown hardware backdoors is real and virtually undetectable.
The CCP serves only it's own goals and interests.
One of their primary goals is to gather as much user data as possible by any means at their disposal. Still feel safe?
blackhawk said:
One problem being the CCP's insidious goal of burrowing into all civilian devices and platforms.
The possibility of unknown hardware backdoors is real and virtually undetectable.
The CCP serves only it's own goals and interests.
One of their primary goals is to gather as much user data as possible by any means at their disposal. Still feel safe?
Click to expand...
Click to collapse
Let's be realistic. And don't get me wrong. I strongly believe that CCP is as mean as it could be. But then, they have economic interests too. China is a country that significantly leans on export, and they don't want to be hurt more than they are (Huawei, other sanctions - India).
Therefore, I don't believe in hardware backdoors. Xiaomi and others even don't produce hardware themselves. Software is a different ballgame. Only evaluate the risk. Let's say that CCP would force companies to install spy software if it could be effectively covered. And what then? What's the difference? Do you trust non-Chinese phones considering that western Big Tech companies have autonomous power to spy everyone, censor everybody? They do it to the former US president, why you think that they won't do it to you?
And do you know that Apple is planning (maybe it is already implemented) to use AI to spy every iPhone pretending to seek children pornography? What is CCP different and how it can hurt you more than Big Tech which have been a long time unleashed and control your data as Orwell predicted without any restrictions or legal limitations?
The only solution are custom roms from transparent developers. And if it is not possible, totally debloated phone, no matter if it comes from east or west. With that kind of adjustment, I certainly trust any Chinese phone more than totally locked and nontransparent systems like iPhone.
Only relevant for Chinese users.
Also I prefer my data in the hands to people on other side of the world than in the hands of my own government.
As soon as you connect to the internet from any device, they have all your information already, it's just that they will use it for good or bad purposes.
nothing is safe
piskr said:
Let's be realistic. And don't get me wrong. I strongly believe that CCP is as mean as it could be. But then, they have economic interests too. China is a country that significantly leans on export, and they don't want to be hurt more than they are (Huawei, other sanctions - India).
Therefore, I don't believe in hardware backdoors. Xiaomi and others even don't produce hardware themselves. Software is a different ballgame. Only evaluate the risk. Let's say that CCP would force companies to install spy software if it could be effectively covered. And what then? What's the difference? Do you trust non-Chinese phones considering that western Big Tech companies have autonomous power to spy everyone, censor everybody? They do it to the former US president, why you think that they won't do it to you?
And do you know that Apple is planning (maybe it is already implemented) to use AI to spy every iPhone pretending to seek children pornography? What is CCP different and how it can hurt you more than Big Tech which have been a long time unleashed and control your data as Orwell predicted without any restrictions or legal limitations?
The only solution are custom roms from transparent developers. And if it is not possible, totally debloated phone, no matter if it comes from east or west. With that kind of adjustment, I certainly trust any Chinese phone more than totally locked and nontransparent systems like iPhone.
Click to expand...
Click to collapse
The CCP's primary target after its own citizens is the USA. Almost zero risk to a hardware backdoor; they could even blow it off as a vulnerability that was not anticipated or detected. A backdoor can lie dormant forever or be activated as needed.
The CCP is like that psycho b*tch gf that talks with demons.
You can't take a ride without getting stabbed
Apple just sucks. Aiding the enemy. They backed away from the user monitoring that their CCP masters taught them, for now.
Apple can't be trusted at all.
If if you're simple enough to buy an Apple...
you deserve what you get; a plain Jane you can't trust
blackhawk said:
Still feel safe?
Click to expand...
Click to collapse
Yes.
Because your profound statements didn't undo any safety measures I did to my phone, nor did they refute the validations of my tests that in fact showed the safety measures barred attempts to connect to Xiaomi servers.
They talk about this "MiAdBlacklistConfig" file that gets updated everyday and used by Mi Browser and other Xiaomi apps to check / censor "sensitive communications". It is there in my phone (funny content), but no update since the day I initially setup the phone. Also I erased Mi Browser. Even the core Xiaomi System Components is barred from reaching out to the internet etc etc etc.
seemebreakthis said:
Yes.
Because your profound statements didn't undo any safety measures I did to my phone, nor did they refute the validations of my tests that in fact showed the safety measures barred attempts to connect to Xiaomi servers.
They talk about this "MiAdBlacklistConfig" file that gets updated everyday and used by Mi Browser and other Xiaomi apps to check / censor "sensitive communications". It is there in my phone (funny content), but no update since the day I initially setup the phone. Also I erased Mi Browser. Even the core Xiaomi System Components is barred from reaching out to the internet etc etc etc.
Click to expand...
Click to collapse
If they did it right you'll never even know it happened... hardware embedded back doors aren't easily detectable when dormant.

[CLOSED] CCP Spying...

On the CCP (Chinese government) spying on people outside of their country.
Why I don’t believe Bloomberg’s Chinese spy chip report
China can and has stolen the information it wants from US companies without using secretly embedded hardware, so why would it jeopardize its massive semiconductor industry?
www.csoonline.com
So here is my deal...
Does Lenovo put some sort of actual spyware on these?
How I define Chinese spyware. Hardware or software that in any way reports to the CCP.
As I am starting to wonder, even if they did, what would be the benefit of this outside of their region? They have no legal jurisdiction outside of their boarders. They don't know what my work is (government to plumber to McDonald's worker), so what would they do with random information? There is just too much data to process even for machine learning and deap learning systems.
I doubt they care about you as an individual (sorry) its more about the big data just like Google or Amazon like to collect.
I could be an influential tech manager, but if I buy the tablet from an American off of ebay who bought the device from China, they don't know who I am nor do they know that I was interested in that product, so how would they even notice spy on me specifically?
It just doesn't make sense.
BIG Data is just the mass collection of Data. Google uses it for adverting. Who knows what China may or may not use it for.
However, I have personally worked with; machine learning, deap learning, machine vision, and symbolic LISP.
There is too much data to suss out for any current computing system to zero in on a specific individual without an operator specifically looking for that specific individual.
what do you think? If you have links to support your point (or other sources) please post.
The CCP wants to collect as much data as possible on USA citizens including DNA, little doubt for race targeted bioweapons.
It's terrible.
India has the right idea. Most dopes install the data collecting malware with glee onto their devices to "socialize"
FB, Instascam, WhatsApp, Twitter, Tik Dock are all trashware at the best and outright spyware at the worst. Heavily laden with disinformation and selectively censored to further their globalist goals.
Chipsets can be designed with hidden remote backdoors that are nearly impossible to detect.
The CCP requires all China based companies to share any and all data, with them. Maybe ask that a few backdoors be added to hardware, firmware and software.
Get the picture? The goal is global domination by whatever means are necessary including bioweapons. It's not hypothetical anymore; the CCP is doing it.
WYSIWYG... booster shot anyone?
blackhawk said:
The CCP wants to collect as much data as possible on USA citizens including DNA, little doubt for race targeted bioweapons.
It's terrible.
India has the right idea. Most dopes install the data collecting malware with glee onto their devices to "socialize"
FB, Instascam, WhatsApp, Twitter, Tik Dock are all trashware at the best and outright spyware at the worst. Heavily laden with disinformation and selectively censored to further their globalist goals.
Chipsets can be designed with hidden remote backdoors that are nearly impossible to detect.
The CCP requires all China based companies to share any and all data, with them. Maybe ask that a few backdoors be added to hardware, firmware and software.
Get the picture? The goal is global domination by whatever means are necessary including bioweapons. It's not hypothetical anymore; the CCP is doing it.
WYSIWYG... booster shot anyone?
Click to expand...
Click to collapse
Again, it is too much data. I am not super pro CCP considering I am of Hebrew decent, WW2 etc.
However, I just can't fathom, what the zero context data will give them especially considering they have to filter it into catagories. Also, seriously, ai isn't intelligent, it DOES NOT understand CONTEXT. So, again, it would require an operator specifically looking for person xyz. You can have a specific keyword notification system, albeit you still require a human operator to verify the supposed findings. There is just too much data for any existing computer network or system to channel into classes the amount of data that would go through.
I need real world evidence not just people saying things.
this is why.
government abc saying they have the power to spy on you out of many many billions of people. you should be afraid of that government system because they can right? or is that just a claim.
Fear mongering doesn't work on me. I need proof.
we DO have proof that the CCP has infiltrated the USA government in its current sitting. albeit to make such a claim they can pin point someone specific without knowing a name in context is just false, without proof.
Cypresser said:
Again, it is too much data. I am not super pro CCP considering I am of Hebrew decent, WW2 etc.
However, I just can't fathom, what the zero context data will give them especially considering they have to filter it into catagories. Also, seriously, ai isn't intelligent, it DOES NOT understand CONTEXT. So, again, it would require an operator specifically looking for person xyz. You can have a specific keyword notification system, albeit you still require a human operator to verify the supposed findings. There is just too much data for any existing computer network or system to channel into classes the amount of data that would go through.
I need real world evidence not just people saying things.
this is why.
government abc saying they have the power to spy on you out of many many billions of people. you should be afraid of that government system because they can right? or is that just a claim.
Fear mongering doesn't work on me. I need proof.
we DO have proof that the CCP has infiltrated the USA government in its current sitting. albeit to make such a claim they can pin point someone specific without knowing a name in context is just false, without proof.
Click to expand...
Click to collapse
You have no idea of their capabilities unless you have a top secret security clearance. In which case you wouldn't be posting this at all... unless you're fishing.
Meh, do want you will...
US Lags Behind India on Blocking Chinese Apps, Including TikTok
News Analysis India sent a special Valentine’s Day gift to China on Feb. 14. Citing national security reasons, ...
m.theepochtimes.com
MOD ACTION:
Thread closed since no political discussions are allowed. Rule 2.4
2.4 Personal attacks, racial, political and / or religious discussions: XDA is a discussion forum about certain mobile phones. Mobile phones are not racial, political, religious or personally offensive and therefore, none of these types of discussions are permitted on XDA.
Click to expand...
Click to collapse

Chinese phones and spyware - is rooting / custom firmware & ROM the answer?

So I'm looking to buy a new phone and it seems that about 70% of the market share in the best buys is comprised of Chinese owned manufacturers.
There have been numerous reports of such manufacturers collecting user-identifable data and phoning home with it. I know that western owned phone companies collect data but believe that the rules /laws, ehtics and security are better followed in the west. I'm not trying to get into a debate of east vs west btw this is just my opinion. Yes I know that almost all phones are manufactured in China but I'm more concerned about who is influencing the companies themselves if they are Chinese.
So given that I value my privacy and want to keep personal data out of the hands of bad actors I'm left with a choice of buying a western owned phone which are generally much lower spec for a price point or perhaps buying Chinese and rooting.
My question is whether this is a practical answer given the need to use a phone as a secure device e.g. 2FA and internet banking apps etc and a daily driver? Also my experience tells me that when one takes a custom ROM they take on responsibility for applying patches and updates which is something of an administration burden I probably don't have the time /inclination for.
For the record I've flashed and used custom roms on about 3-4 devices in the past so have some first hand experiance but wondered if things have changed for the better or worse?
They could have embedded hidden backdoors in the hardware or worse.
Well, things are still the same, if not even worse. Beside security patches, Google has been cracking down on rooted users, so in the near future some features and some apps might stop working. Unfortunately users with just an unlocked bootloader might be caught in the crossfire. As for privacy, try Xiaomi. Sure, there have been rumors of Spyware on Xiaomi devices. Well, back in January some cybersecurity firm from Germany test that theory. Proved it was false.
Germany: No evidence of spying from Xiaomi phones
One point for Xiaomi
www.gadgetmatch.com
Thus Xiaomi might be one of the good ones. At least in terms of being spied by them. Sure, third party apps also spy on you, but for that you have adb.
Fytdyh said:
Well, things are still the same, if not even worse. Beside security patches, Google has been cracking down on rooted users, so in the near future some features and some apps might stop working. Unfortunately users with just an unlocked bootloader might be caught in the crossfire. As for privacy, try Xiaomi. Sure, there have been rumors of Spyware on Xiaomi devices. Well, back in January some cybersecurity firm from Germany test that theory. Proved it was false.
Germany: No evidence of spying from Xiaomi phones
One point for Xiaomi
www.gadgetmatch.com
Thus Xiaomi might be one of the good ones. At least in terms of being spied by them. Sure, third party apps also spy on you, but for that you have adb.
Click to expand...
Click to collapse
That's bad to hear that Google are trying to put the squeeze on and a deterrent to investing time and energy installing Roms that may only get worse with time in terms of G Apps and services.
Hmmm that article refers to an absence of censorship rather than not spying.
Here's an example of the story which I've seen repeated elsewhere on Xiaomi spying:
Exclusive: Warning Over Chinese Mobile Giant Xiaomi Recording Millions Of People’s ‘Private’ Web And Phone Use
Xiaomi is collecting users’ browser habits and phone usage, raising red flags for privacy researchers.
www.forbes.com
steveyc2 said:
That's bad to hear that Google are trying to put the squeeze on and a deterrent to investing time and energy installing Roms that may only get worse with time in terms of G Apps and services.
Hmmm that article refers to an absence of censorship rather than not spying.
Here's an example of the story which I've seen repeated elsewhere on Xiaomi spying:
Exclusive: Warning Over Chinese Mobile Giant Xiaomi Recording Millions Of People’s ‘Private’ Web And Phone Use
Xiaomi is collecting users’ browser habits and phone usage, raising red flags for privacy researchers.
www.forbes.com
Click to expand...
Click to collapse
Sorry about that.
At this point, I doubt there isn't a smartphone maker that does not track its users. From chinese makers to American makers, everyone tracks their users. Their data sells the best. At this rate, if you want to totally protect your privacy, don't buy a phone. Anything and everything can be tracked. Dumb phones and smartphones. So picking a smartphone isn't going to keep your privacy secure. You might have a say in how many people do you want to track you, based on phone's price.
steveyc2 said:
So I'm looking to buy a new phone and it seems that about 70% of the market share in the best buys is comprised of Chinese owned manufacturers.
There have been numerous reports of such manufacturers collecting user-identifable data and phoning home with it. I know that western owned phone companies collect data but believe that the rules /laws, ehtics and security are better followed in the west. I'm not trying to get into a debate of east vs west btw this is just my opinion. Yes I know that almost all phones are manufactured in China but I'm more concerned about who is influencing the companies themselves if they are Chinese.
So given that I value my privacy and want to keep personal data out of the hands of bad actors I'm left with a choice of buying a western owned phone which are generally much lower spec for a price point or perhaps buying Chinese and rooting.
My question is whether this is a practical answer given the need to use a phone as a secure device e.g. 2FA and internet banking apps etc and a reliable daily driver? Also my experience tells me that when one takes a custom ROM they take on responsibility for applying patches and updates which is something of an administration burden I probably don't have the time /inclination for.
For the record I've flashed and used custom roms on about 3-4 devices in the past so have some first hand experiance but wondered if things have changed for the better or worse?
Click to expand...
Click to collapse
To be on the safe side, you can install an alternative ROM, such as LineageOS, instead of the preinstalled OS: requires phone's bootloader is unlockable.
Be aware that no cell phone provides you with true anonymity.
xXx yYy said:
To be on the safe side, you can install an alternative ROM, such as LineageOS, instead of the preinstalled OS: requires phone's bootloader is unlockable.
Click to expand...
Click to collapse
yes i know i can do that- and the firmware too- my question was about the practicality of living with such a phone once done
xXx yYy said:
Be aware that no cell phone provides you with true anonymity.
Click to expand...
Click to collapse
Yes, aware of that, just trying to minimise exposure while still having a usable phone
blackhawk said:
They could have embedded hidden backdoors in the hardware or worse.
Click to expand...
Click to collapse
worrying but if one wipes the firmware and ROM then that would mitigate any hardware backdoor risks I would have thought?
Has anyone actually tested a custom rom on a chinese phone that was known to send data back to chinese servers?
For example:
test with stock rom: wireshark shows phone sending information to chinese IP
test with custom rom: wireshark shows no packets sent to chinese IPs.
sso003 said:
Has anyone actually tested a custom rom on a chinese phone that was known to send data back to chinese servers?
For example:
test with stock rom: wireshark shows phone sending information to chinese IP
test with custom rom: wireshark shows no packets sent to chinese IPs.
Click to expand...
Click to collapse
Some infos could go to an American proxy server then to Chinese. In order to be sure no one gets you data, learn to code and make your own rom and your own apps. Open source apps are an option if you know to check the source yourself.

Categories

Resources