Home / News

China's App Allows "Superuser" Access to Entire Data of Over 100 Million Android-Based Phones

The Chinese Communist Party's app called 'Study the Great Nation' released in January is reported to have "superuser" access to the entire data of over 100 million Android-based phones via a backdoor. The propaganda app, billed as an educational tool, has been promoted aggressively throughout the year. The app was analyzed by the human rights activist group, Open Technology Fund (OTF), in partnership with the German cyber-security firm Cure53. "Earlier this year, it became the most downloaded app on the Chinese App Store, and the Chinese government claims that it now has over 100 million users," reports OTF, which revealed the results over the weekend. It adds: "The numbers are sky-high, with the Huawei store reporting 300 million downloads, and Wadoujia 195 million downloads. 'Study the Great Nation' features content like news articles and quizzes alongside a leaderboard where users' scores can be viewed alongside those of their coworkers."

What the audit found about the app's backdoor capabilities:

Superuser Privileges: "Contains code that amounts to a backdoor to rooted devices, essentially granting complete administrator-level access to a user's phone."

Scanning Apps: "Study the Great Nation actively scans to find other apps that are running on the user's device, drawing from a list of 960 applications."

Weak Encryption by Design: "While Study the Great Nation collects and transmits large amounts of personal user data, the app's security is weakened - seemingly by design - through the use of weak cryptographic algorithms in areas containing information linked to users' biometric data and emails."

Detailed Log Reports: "Cure53 also found that the app collects general information such as the device's unique IMEI number, connection information, information about app usage sessions, and location."

By CircleID Reporter – CircleID's internal staff reporting on news tips and developing stories. Do you have information the professional Internet community should be aware of? Contact us. Visit Page

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

VINTON CERF
Co-designer of the TCP/IP Protocols & the Architecture of the Internet

Comments

 Be the first to post a comment!

Add Your Comments

 To post your comments, please login or create an account.

Related

Topics

Cybersecurity

Sponsored byVerisign

Cybercrime

Sponsored byThreat Intelligence Platform

Domain Names

Sponsored byVerisign

Brand Protection

Sponsored byAppdetex

Whois

Sponsored byWhoisXML API

DNS Security

Sponsored byAfilias

New TLDs

Sponsored byAfilias