Baidu, il browser e servizi web società che è abbastanza come il Google cinese, è appena stato coinvolto in uno scandalo privacy. Secondo i ricercatori di sicurezza, il browser Baidu sia per Windows e Android si comporta come un Infostealer, collecting information from its users and sending it to Baidu’s servers.
A research by Citizen Lab indicates that Baidu invades its users’ privacy by collecting data. Tuttavia, there’s not a single web-based services company that doesn’t do the obligatory la raccolta dei dati. Così, dove è la cattura?
The catch here is that Baidu does the data collection in a very unsecure way – via connections that are either unencrypted or easy to decrypt.
Learn More about Encryption Security: APO Encryption Software
What kind of information does the Android Baidu version collect? Ecco l'elenco:
- Dettagli sul sistema operativo;
- Browsing and search history;
- The device’s IMEI (International Mobile Station Equipment Identity);
- The device’s last GPS location;
- Nearby WiFi networks and local MAC addresses;
What about the Windows version of the browser? Eccoci qui:
- Search and browsing history;
- modello di CPU;
- Indirizzo MAC;
- Hard disk drive model, numero di serie;
- File system volume number.
The browser would collect and send all that information upon startup, whenever the user is typing content in the address bar and on a page view.
More Flaws in Other Baidu Products
In aggiunta, Citizen Lab, in cooperation with another security vendor, Attenzione, revealed a range of vulnerabilities in other Baidu products. The biggest problem pointed at an SDK (software development kid) trovato in 22,548 app packages. A novembre 2015, Trend Micro experts reported a similar Baidu SDK, situato in 14,112 Android applications. Such SDKs can be easily used to install backdoors on users’ devices.
More on the Subject: Spies Taomike SDK biblioteche sul SMS in 18,000 Applicazioni Android
Another troubling issue should be added to the list of Baidu’s vulnerabilities. The browser would check for updates and download them without applying code signatures. A lack of code signatures could cause MitM (man-in-the-middle) tipo di attacchi. In un tale scenario, an attacker can send out malicious files to users, masqueraded as Baidu updates.
Did Baidu Fix the Issues?
The security researchers contacted Baidu, letting them know of their findings. Here’s a small part of the Chinese company’s answer:
We’re grateful of Citizen Lab for being mindful of data security in transmission and we have already made substantial progress toward ensuring that any such transmission will be secure. Our timetable for making remaining changes to encrypted transmission are detailed […].