German security company Nitrokey recently released a report claiming that it has discovered an unrecorded feature in Qualcomm Snapdragon chips that collects and transmits user information directly to Qualcomm servers.

The feature is not dependent on the Android operating system, which means that the data is transmitted even if the operating system is not involved. Nitrokey installed a Google-free version of Android on a Sony Xperia XA2 phone equipped with a Qualcomm Snapdragon 630 chip and found that the data was being transmitted to the izatcloud.net server, which belongs to Qualcomm.

According to the report, Qualcomm chips collect and transmit user information, including the unique smartphone identifier, chip name, chip serial number, XTRA software version, mobile country code and mobile network code, type, and version of the carrier or operating system, device manufacturer and model, program list on the device, IP address, and other data. The data is transmitted via the insecure HTTP protocol without any additional encryption, making it accessible to virtually anyone who can read the unique identifier data sent to Izat Cloud.

Unencrypted data transmission from Qualcomm chips

This feature affects approximately 30% of phones worldwide, including Android phones and iPhones that use Qualcomm communication modules. Nitrokey’s conclusion in the blog post is that Qualcomm’s customized AMSS firmware takes priority over any operating system and, because it uses the HTTP protocol, a unique device signature can be created based on the collected data, which can be accessed by third parties.

Qualcomm responded to the report, stating that the data transmission is in compliance with the privacy policy of the XTRA service, which actually allows the company to collect the aforementioned user data. However, the fact that the data is transmitted via the insecure HTTP protocol has raised concerns about the privacy and security of user information.

This report highlights the importance of ensuring that user data is transmitted securely and in compliance with privacy policies. It also underscores the need for greater transparency from tech companies regarding the data they collect and how it is used. As more devices become connected and collect more data, it is important that users are aware of how their information is being used and have the ability to control it. Google’s recent update for developers mandates that all Android apps must now include a feature allowing users to delete their accounts and data, reflecting the increasing focus on user privacy.

RELATED:

• Snapdragon 8 Gen 3 tipped to feature 3.7GHz frequency boost and new architecture
• Qualcomm’s new upscaling tech will potentially boost Android games to 4K 60fps
• Qualcomm confirms the chip underneath the Poco F5
• Honor Magic5 Pro vs Huawei P60: Specs Comparison

(Source, Via)

The post Qualcomm chips found to collect and transmit user information appeared first on Gizmochina.

A new report might make you more skeptical about allowing apps to track your location. Apparently, the user’s phone location data is a huge market, in which information is sold to the highest bidder in market that is estimated to be worth a whopping 12 billion US Dollars.

According to TheNextWeb, there are multiple data mining firms that collect location data along with other identifiers anonymously and then sell it to other companies that require it. The data is bought from various firms including retail foot traffic analysts to even military contractors. Serge Egelman, a researcher at UC Berkeley’s ​​International Computer Science Institute and CTO of AppCensus stated that “apps can circumvent the permission model and gain access to protected data without user consent by using both covert and side channels.”

Similarly, Justin Sherman, a cyber policy fellow at the Duke Tech Policy Lab added that There isn’t a lot of transparency and there is a really, really complex shadowy web of interactions between these companies that’s hard to untangle. They operate on the fact that the general public and people in Washington and other regulatory centers aren’t paying attention to what they’re doing.” The Markup even identified 47 companies that harvest, sell, or trade in mobile phone location data.

Notably, one of the location data brokers Oracle, has a partner that openly advertises data on millions of US individuals. This includes demographics information like personal activities and life preferences. Meanwhile Oracle, Epsilon, and others also explicitly advertises data sharing platforms to thousands of companies.

RELATED:

• US Secret Service bought location data from smartphone apps
• Elon Musk confirms Starlink will Transfer Data close to 97% of the Speed of Light
• Your Fitbit and other Bluetooth gadgets could be giving away your location data
• WhatsApp fined €225 million for breaching EU data privacy rules

The post Your location data is being sold to the highest bidder in a $12 billion market appeared first on Gizmochina.

Earlier this week, Xiaomi officially announced that it would be conducting an investigation for applications in its Mi Store that have violated its policies regarding the collection of user data.

The Chinese tech giant shares notice of investigation for apps that have been illegally gathering and using personal information while also infringing on user rights and interests. For those unaware, there has been an emerging call from users regarding the frequent harassment and other issues regarding their personal information that has been infringed on Xiaomi’s application store, especially in China. The Mi Store has a large user base all across the globe, with its home market alone accounting for 90 million users.

So, it arrives as no surprise that certain apps target users’ data to get a more competitive edge over their rivals in the current market. In the past, user privacy and data collection policies have been scrutinized. Now, it seems that Xiaomi aims to weed out apps that have been harmful to its Mi Store users. Notably, the Chinese government is also working on reforming user data collection policies in the country, with the nation’s cyberspace regulator even ordering companies in China to delist Didi from their app stores. This was apparently due to Didi Global Inc illegally collecting users’ personal data.

In other words, Xiaomi is also joining in the efforts of its home country and is ordering app developers to reform data collection methods or face removal from its Mi Store. In the note, the brand said that it has received large amounts of feedback that have criticized apps on its platforms for their predatory data gathering practices. So, the company is springing into action, in compliance with the latest regulations from the Ministry of Industry and Information Technology.

RELATED:

• Xiaomi Mi 8 Explorer Edition, Mi 8 Pro, Mi 8 SE bag MIUI 12.5 update
• Xiaomi Mi Smart Steam Oven 30L may hit India soon, launched in the Philippines!
• Xiaomi India Mi Anniversary Sale 2021: All the Best Deals

The post Xiaomi investigates apps that violate its user data collection policies on the Mi Store appeared first on Gizmochina.

Its been known for a while now that iPhones or Android smartphones send user data back to Google or Apple. But now, a new study has revealed that the former receives as much as 20 times more data from Android than the latter from its iOS platform.

According to a ArsTechnica report, researcher Douglas Leith from Trinity College in Ireland provided side by side comparisons that suggests that Google’s Android collects a lot more information than Apple’s iOS. As per Douglas, transmit telemetry data that are sent to the tech giants collect information like whether a user has logged in or has configured privacy settings to opt out of certain options regarding data collection. Both iOS and Android also send data to the companies when a user does simple tasks like inserting a SIM card or browsing the smartphones screen settings and more.

The study also found that even when the device is idle, these devices connects back to its end server on an average of every 4.5 minutes or so. Collecting data and sending it back to these companies are not strictly restricted to just the operating systems and are also a common occurrence from preinstalled apps and services in smartphones. These apps also made connections even when they hadn’t used or opened.

While, the iOS automatically sent Apple data from Siri, Safari, and iCloud, Android collected data from Chrome, YouTube, Google Docs, Safetyhub, Google Messenger, the device clock, and the Google search bar. Notably, a Google spokesperson has contested these findings and stated that the study was based on faulty methods for measuring the data that’s collected by each OS. The spokesperson added that data collection is a core part of any internet connected device.

RELATED:

• Google Maps gets a new Live View AR feature that guides through indoor spaces
• Google has a new document scanner app with AI features and biometric security
• Google hires Intel veteran to lead its custom chip division

The post Google receives 20 times more data from Android than Apple from iOS: Study appeared first on Gizmochina.

Recently, the Indian government proposed a new data act that would regulate all the “non-personal” information. This would immediately affect various tech firms, including US giants like Facebook, Amazon, and Google, who are planning on pushing back against these proposals, according to Reuters report.

Back in July 2020, a government panel recommended setting up a regulator for information that is anonymized. The panel also proposed a mechanism for firms to share data with other entities, citing a spur in the digital ecosystem. If this system was adopted by the government, a new law would form to regulate such data. However, the U.S.-India Business Council (USIBC) called out this system.

Editor’s Pick: TikTok is suing the Trump administration to challenge the app ban

According to the group that is also a part of the U.S. Chamber of Commerce, the new data sharing act “anathema” would be promoting competition and says that it “undermines investments made by companies to process and collect such information.” USIBC letter stated that “USIBC and the U.S. Chamber of Commerce are categorically opposed to mandates that require the sharing of proprietary data.”

This letter has yet to be completed but will be submitted to India’s information-technology ministry in the arriving few weeks. The new data sharing act is the latest move which is another issue that big data companies face. More and more nations have been forming tighter rules and regulations around e-commerce and data storage. With India now proposing a “forced data sharing,” foreign trade and investment in developing nations would be limited.

UP NEXT: Indian Smartphone Market sees a massive decline of 50.6% YoY in Q2 2020, expected to recover in H2

The post US tech giants plan on pushing back against India’s data curb plan appeared first on Gizmochina.

According to the latest report published by Forbes, Xiaomi smartphones are found that the company is recording data of what the user is doing with the devices and the data are then sent to remove servers hosted by Alibaba, which are ostensibly rented by Xiaomi.

It found that Xiaomi’s default browser records all the websites visited, including search queries even from privacy-focused search engines, and every item viewed on its news feed. It reports that the tracking happens even when the user is in the private mode.

Further, the report adds that the Xiaomi device records what folders users open and to which screens they swipes, including the status bar and the settings page. All of the data are then being packaged and sent to remote servers in Singapore and Russia, while the web domains they hosted were registered in Beijing.

The report from Forbes reveal that the company wasn’t just collected web browser data but also data about the phone, including unique numbers for identifying the specific device and Android version.

However, Xiaomi denies that there’s a problem with privacy. The company claims that data is encrypted when transferred to protect user privacy. But it just takes a few seconds to decode the base64 encryption and to change the garbled data into readable information.

EDITOR’S PICK: Samsung’s unannounced full-screen smartphone spotted in an advertisement

In its response, the Chinese smartphone maker says that “privacy and security is of top concern” for them and adds that it “strictly follows and is fully compliant with local laws and regulations on user data privacy matters.” The spokesperson for the company also confirms that it was collecting browsing data, claiming the information was anonymised so wasn’t tied to any identity.

Xiaomi’s spokesperson also denied that browsing data was being recorded under incognito mode. However, two security researcher found in their independent tests that their web habits were sent off to remote servers regardless of what mode the browser was set to. When Forbes sent a video proof of the claim to Xiaomi, the company continued denying it.

Upon further digging, Forbes found that to better understand its users’ behaviour, Xiaomi is using services of a behavioural analytics company called Sensors Analytics which has tools that help its clients in “exploring the hidden stories behind the indicators in exploring the key behaviors of different businesses.” Xiaomi’s spokesperson also confirmed the company’s relationship with Sensors Analytics.

UP NEXT: Black Shark 3 and Black Shark 3 Pro gaming smartphones are launching in Europe on May 8th

(Source)

The post Xiaomi is recording private web and phone usage of its users: Report appeared first on Gizmochina.

Sensor Tower, an analytics platform which aggregates data on app downloads and usage for developers, has secretly collected data from millions of Android and iOS users through VPN and ad-blocking apps, reports Buzzfeed News.

The report adds that the company owns at least 20 Android and iOS applications with more than 35 million downloads. Out of those, Free and Unlimited VPN, Luna VPN, Mobile Data, and Adblock Focus were recently available in the Google Play Store while Adblock Focus and Luna VPN were available in Apple’s App Store.

However, Apple has now removed Adblock Focus while Google has removed Mobile Data after being contacted by BuzzFeed News. The companies are further conducting an investigation regarding this.

Here is how it all worked. When Sensor Tower’s app gets installed on the device, it asks users to install a root certificate, which enables Sensor Tower to monitor all traffic and data passing through the phone.

EDITOR’S PICK: Xiaomi rolls out Android 10 Stable update for POCO F1 with February 2020 patch

Sensor Tower bypasses Apple and Google’s restrictions on root certificate privileges by requiring users to install the certificate through an external website. The company says that it only collects anonymised usage and analytics data.

Interestingly, none of the applications have been tied to Sensor Tower on the App Store as they were listed under other company names. They were tied to Sensor Tower after BuzzFeed realised that the apps “contain code authored by developers who work for the company.” Apple spokesperson has confirmed that a dozen of Sensor Tower apps have been removed from the App Store due to violations.

Randy Nelson, Sensor Tower’s head of mobile insights, explains that the “vast majority” of the apps are “defunct and a few are in the process of sunsetting.” He doesn’t admit that the apps are now defunct because they were removed for policy violations.

UP NEXT: Vivo is now all set to launch yet another 5G smartphone pretty soon, dubbed as Vivo S6

(Source)

The post Sensor Tower secretly collected data from Android and iOS users appeared first on Gizmochina.

A free weather information application from TCL named ‘Weather Forecast—World Weather Accurate Radar’ has been collecting unusual amounts of information from its users, claims security experts.

According to the reports, the application has been collecting personal data including email addresses and mobile identification numbers and the data are then transmitted to servers based in China. Further, it is claimed that the app has also subscribed users to paid services without permission.

This is very crucial given that the app has been downloaded over 10 million times on Google Play Store. According to a London-based security firm Upstream Systems, TCL‘s ‘Weather Forecast’ asks to collect information including users’ geographic locations, email addresses, and International Mobile Equipment Identity (IMEI) numbers.

It goes on to claim that TCL has also been attempting to fraudulently subscribe users of budget Alcatel smartphones in countries like Brazil, Malaysia, and Nigeria to paid “virtual reality services”. As per the security firm, Brazil alone received around 2.5 million transaction attempts from Alcatel devices in July and August last year.

The security firm says that the attempts were blocked after the company discovered the activity. It further says that while the app is no longer attempting to subscribe users to third-party services, it still continues to collect user data.

In response to these accusations, the company said that it is “evaluating new security consultants who can provide additional validation of the safety of our mobile applications we develop.”

As said, the app is owned by TCL Communication Technology Holdings Ltd. which is based in Shenzhen, China. TCL is the company that manufactures smartphones for BlackBerry and Alcatel and phones from both those companies come pre-installed with the weather application.

It remains to be seen if Google takes any action against the app or the company. Previously, in December, Google had suspended two Chinese apps from its Play store after allegations that they were exploiting user permissions under an ad fraud scheme.

Read More: TCL working to become a global leader in smart products and internet services

The Internet Society of China’s analysis into data-gathering practices found that 18 of the most popular apps in the country collected what it deemed excessive user information – including text messages, address book data, and recordings. Almost half of those apps appeared to do this without consent from the user.

(Source)

The post Weather App from TCL reportedly collects too much user data appeared first on Gizmochina.