uh
[Music]
me
[Music]
it is working
uh hello
uh i'm gabby
uh
just a small disclaimer all of the
research that i'm gonna present here
today
is
independent research it has no
affiliation with
whitetops or the future company where
i'll be working
so um
it's going to be a deep dive into how
big companies go out of their ways to
basically spy on their users and mostly
when
the product is cheap
you are the product
first thing first
as i said i'm gabby they call me the
public transportation hacker back home i
hacked the publishing transit system in
bucharest
um
after that it turns out i couldn't
travel anymore uh for free with the
public transit system back home so
i had my car turns out it knew a lot
more about
me than i knew about myself i mean go
figure and after that i just started
hunting for um
bad threats on the internet uh mostly
bots and privacy issues
um
that being said let's find out a bit
more about yourselves
raise your hand whoever has a mobile
phone
all right seems like we still have some
guys that
are really old school
raise your hand who if you have an
android
now
if you have ios
cool cool i have something for both
sides basically unfortunately i don't
have anything for like
windows linux desktops but it's going to
be juicing
in mobile spyware
so
who knows what this is
anyone
anyone okay
how about a little hint
do you know about these guys
i guess you do
all right
they decided to get a browser because
that's the quickest way to access
somebody's data nowadays
that happened
six years ago
they bought a company called uc web
uc web has one of the biggest browsers
in asia basically
um
and turns out that it's not only them
that are in for the for the user this
data uh raise your hand if you know
about these guys
yeah those are xiaomi for whoever
doesn't know right now they have
one of the biggest market shares i think
in android in certain areas of the world
they are basically number one
now
they don't only make android phones they
were
founded uh
11 years ago
they're called like the uber of asia
they make
smartphone tablets batteries mice tvs
bluetooth speakers selfie sticks
umbrellas
toys
and all of their send data and to be
honest i mean
we're basically screwed so they might as
well make some sex plays as well
to do it properly
um
as i said
uh they own the biggest market share
i think the graph is in india
and the black guys over there are
their market share
in that area no wonder that they got
banned at some point and can no longer
push the products
now a year and a half ago i decided to
get a new phone
and
i found the note 8 d i think that's the
name it looked really cool it was really
cheap like extremely cheap
it had a um
good camera it was powerful
uh it had nfc so you can do all kinds of
mi fair hacks
uh solid display
and what's the catch right i mean how
can a phone that's 150 euros
have so many features packed in
um
that's why i basically started doing the
usual tear down process of whenever i
get a new device i start sniffing on the
traffic in order to determine if
there's something shady about it
and
i rooted it
by the way the root process is extremely
painful
it's it takes like one week in which you
have to use the phone after you applied
for
unlocking the bootloader because it
turns out that other companies
buy xiaomi phones they root them they
rebrand them and resell them in order to
turn in some quick cash without allowing
them data to the switch
without allowing them access to the data
of the user
and this is what i found
straight out
like
new phone
in
30 uh in a few hours
a lot of requests
it's gonna get a lot worse just you wait
and this is done basically but not by
not doing anything
so naturally when there's so much data
being exfiltrated there must be
something shady going around and i can
do a live demo but i have the next best
thing i have a recording and i'm just
launching the default browser
on a xiaomi phone
i'm incognito
and i am doing some random history facts
research you know
and we have the first call right there
unfortunately we can't see anything
i mean in incognito they block
streaming the display
and we're gonna get a new hit soon
you can see
all of the requests
another hit
and now i switched off uh incognito mode
making sure that i'm gonna be like put
on some lists over there in
asia now
this is a base64
that's being sent in plain text
and you can see
that my search query was sent
to their servers
just like that
in incognito mode
correlated with the miui id that i have
and the miui id is correlated with a
real
uh address
that i use there's
no other way to skip it basically and in
addition to that
there's all of my
browsing history up to that point
now
let's dive a bit more into the details
so i can
basically give the tools for everybody
who wants to dive into android research
how they can to enable them to do
the kind of research that i did as well
so
you can see that
they are sending
this request
over there date underscore list we have
to remember that
to an ip
to a domain
that's being
registered in china and that was the big
like red flag
then
the domain points to three ips based on
the location where you are for usd sends
the data to us for rashad russia for the
rest of the world to singapore
allegedly in a neutral data center
so a new phone no apps
34 calls to their server in three hours
just idling to a chinese infrastructure
remember the parameter data underscore
list all right
now we pull out jdx which is the de
facto
android compiler
and we look for that parameter
you can see it right there
where it's being used inside the gun zip
uh function a bit
higher up
right
here
now we can just do some
manual stuff unfortunately i'm not that
savvy to automate this kind of of
research i just
went by
by hand from one request to another i
discovered that it was going over the
wire
and then
the data was being encoded
in a good gzip output stream
and then after unzipping it you would
get
this whole packet
this whole json being sent to china
which contained the visited url
the network to which were connected
the device info
this was the android advertising id for
whoever is familiar with that
it can be reset
unfortunately is the kind of data that
every ad exchange has also access to so
it can be very easily correlated back to
you even though it's allegedly
anonymized
and a bit more
it even
contained whatever the user was in
incognito mode
so i guess do the data shifting a bit
faster
and the miui id which is right here
now in order to get the miui id on
xiaomi phone
all xiaomi phones run what is called
miui it's a spin-off of
android that looks a bit more like an
ios device
anyway potato potato it's basically
android
chinese version
and in order to get the miui id you have
to register
using your mobile phone number or your
personal email address you can do it
otherwise and they also have a block
list for email addresses so you can use
five minute email and stuff like that
they really want to make sure that that
is like your legitimate id
it's populated inside the distinct id
field and this even happens nowadays
and it's being sent to something called
sensor analytics we'll get into that a
bit later
up until now
we learned that
xiaomi sends all of the urls that you
visit on the pre-installed browser
your browsing history your search engine
history your browsing behavior because
it also sends touch events as well
inside the website for
god knows what reason
and everything can be correlated
with
your
real persona
and it happens even in incognito mode
now my miui phone had the news app
and i just um
clicked a piece of news right
and of course
it went to china
and it said hey
this guy is looking at this piece of
news right now
the my xiaomi phone had
a music app
and i was gonna listen to some music
that i downloaded offline
and of course it sent
the name of the song
to china
and it didn't only happen on my phone
turns out this is a
feature
pre-baked into all phones that run me ui
so naturally i pulled
and this is when the fun automation
kicks in i pulled all of the binaries
like the blobs the firmware blobs
for all of their phones
i used a broadly extractor
then something called sdat to image
written by a guy like really smart
i pull the apks and the videxes
and then run some static analysis over
all of that
and it was no surprise that all of them
all of them contain the same code that i
showed you before that was actually
sending
the data from my phone from the browser
from the news app from the video player
and the home screen as well i forgot to
mention about that one the name of the
folders that you make in your phone
screen yeah they go to china as well
there's no exception to that
and it's being processed by a company
called sensor analytics as i've
mentioned before
which basically
have a bunch of
chinese clients
and no ties to the west
and they removed this from their web
page but at some point they were
bragging that they can you can you can
contact them for information about
data on your website
uh like user behavior data on your
website even though you didn't embed
their sensors
and i wonder where they get got that
data
now the cfo for sensor analytics was in
really close ties with xiaomi
so
like of the record
somebody is really keen on siphoning uh
browsing data
but anyway enough xiaomi bashing
um
actually no let's not stop with the
xiaomi basic bashing because i actually
got something
done
and together with this fine gentleman
right here we started doing
raising awareness about that and
what can i say doing uh
constructive discussions on twitter
with xiaomi
we got forbes to
to get notice of that
and a lot of other publication including
android ones
and went through this whole scenario
i mean they ignored me
at first then they laughed at me they
fought us but we won i mean this is one
of the cases where the collective
collective uh or quality let's call it
the hacker cooperative managed to
actually influence a big product and do
something
so
xiaomi was disappointed to read that the
recent article from forbes we feel that
they have misunderstood what we
communicated
this was the lasting phase
then they moved to fighting
below are four certifications xiaomi
received from widely acclaimed
international third-party companies and
organizations blah blah blah they
started like throwing isos and all of
the accreditations they had like hey
guys these guys are talking
it's not
um
then
forbes might be
misinterpretative of the facts
i mean
our users privacy and security are top
priority they didn't encrypt the data i
mean come on what's that at least you
would like do it properly you know and
we're gonna see how this is properly
done like in the follow-up
and in the end we would like to express
our appreciation for researches
engagement passionate and constructive
criticism
and we did it guys
all of this
for
the enhanced incognito mode that you
have to turn off
if you want to stay private
and it's turned on by default
at least we put like a checkbox and uh
they called it a day but the data is
still and this is only for the browser
the data is still being aggregated from
your home screen from everywhere and it
goes over the wire and everybody's like
yeah let's get xiaomi phones because
they're so cheap well if your privacy is
that cheap then yeah go ahead and get
one
now i decided to do an experiment
they build a lot of devices right
let's get a band
on a xiaomi phone pair it with the
xiaomi phone
with miui let's see what happens
we've got like
i i have less fingers than
the number of requests a bunch of
requests in four minutes
uh
a lot of them and it was going all the
time all the time all the time in
addition to draining my battery
they're also sending this can you spot
like
what's wrong
that's wrong
all of the apps that i have installed
are being sent by by smartband somewhere
in china
because reasons i guess they want to
like optimize the notifications for me
they could have
hashed the name of the apps or something
like but no
it's okay they need to know that they
have telegrams to leave whatsapp
instagram and the
wire
now let's talk about somebody who did it
like professionally
and
it was a lot harder i actually had to do
like legit reverse engineering to to
bypass them and this happens happened on
both ios
and still happens on android spoiler
alert
um this is alibaba's browser
they have a
tiny market alissa can brag is the first
biggest browser in the world
i guess but in asia where this data is
not that aggregated they're big
like it's alibaba they have a browser
it's optimized for privacy
powered by the cccp
i'm gonna do another demo
this is on the same ui phone
quality stuff
it's got alibaba browser installed
it's in niconito mode
i'm going on my website boom requests
we just have to
take the request spoiler alert say yes
and you can see that they're sending
the
address that i just visited
to china
i like that they're consistent at least
so
this is also an ios
you can see i'm in incognito mode
and they send the data like straight
from the get go
who can recognize this header
it's something something zip
something
you can zip it
and you can see that
they contained in plain text
the unique url that i was visiting on my
website
on my own an ios device apple didn't
like that needless to say they got
they just went medieval on them
it also sent at one point the mac
address or it does send the mac address
in some locations around the world
the email
it also sent the serial number of the of
the ios device and a lot more metadata
that unfortunately is kind of like
common practice to send nowadays
it's got like the cccp's eagle eye over
here
on android the situation was a bit more
complicated because i was seeing a lot
of garbage i couldn't recognize any kind
of useful headers in the
traffic analysis
i just looked some
funny facts about
china's political party
and yeah
a lot of traffic going on
now
the domain was being sent unencrypted
for
statistics i guess at least they didn't
send the url but they did send the
domain that i was visiting
in order to get the data from the aes
encrypted stuff
i had to at least
identify if the data was being
exfiltrated
there's this really great
tutorial on hooking with rida on android
you need the rooted device and you
spawn it's like a debugger basically but
for people that don't know debugging
like me
and
i got i intercepted
the plain text before being sent to
encryption
right
and it was
the domain and the url
and a lot more metadata like the android
id
the e from each two sent and all that
stuff
this is the
hooking in action i could catch
i also like through an exception
where i would get an aes
some as data being intercepted and i
basically started going through
these points in the source code after
decompiling the app with
jdx
and needless to say i found
a cipher being instantiated and the do
final being called on it which does the
actual encryption
and i managed to isolate the aes key
that was being used
we won
not yet not yet
so i used that
key
i decrypted the data and i got like
conclusive proof that what i was seeing
being hooked before because i wanted to
have proof that this was sent over the
wire i didn't want like to get on the
bad side of some nasty people
for no reason i i want like conclusive
proof
and of course all of the data was being
sent to china
in some of their
ips in the alibaba
cloud now
can you see what's missing
over here after i started like
doing the usual
twitter storm
there's no uc web browser
at least for europe
there's the apple got really mad
pull the browser instantly right now you
cannot install it on an ios device
you know that apple
also implemented the policy where you
have to
declare the permissions the data that
your app is
is sending to their to the servers
they manage to circumvent that
kind of like declaration verbosity by
just not updating the app
you don't update it you don't have to
declare anything
um
yeah
unfortunately on android they just
didn't care
google was like yeah man it's their app
with their data they do whatever they
want
um uc will be still up on the android
store i don't know maybe we need to do a
bigger coordinated effort to
stop them from doing
that kind of stuff
remember guys
it is our duty
to do
the right
thing
i'm gabby and thank you for listening to
me
[Applause]
and
remember that rights are very easy
to lose and very hard to obtain
so for privacy
this is a fairly like modern concept
that we have we have to fight for it and
fight all of the companies that are
actually slurping our data thank you
[Music]
you