Almost Every Chinese Keyboard App Has a Security Flaw That Reveals What Users Type (technologyreview.com) 78
An anonymous reader quotes a report from MIT Technology Review: Almost all keyboard apps used by Chinese people around the world share a security loophole that makes it possible to spy on what users are typing. The vulnerability, which allows the keystroke data that these apps send to the cloud to be intercepted, has existed for years and could have been exploited by cybercriminals and state surveillance groups, according to researchers at the Citizen Lab, a technology and security research lab affiliated with the University of Toronto.
These apps help users type Chinese characters more efficiently and are ubiquitous on devices used by Chinese people. The four most popular apps -- built by major internet companies like Baidu, Tencent, and iFlytek -- basically account for all the typing methods that Chinese people use. Researchers also looked into the keyboard apps that come preinstalled on Android phones sold in China. What they discovered was shocking. Almost every third-party app and every Android phone with preinstalled keyboards failed to protect users by properly encrypting the content they typed. A smartphone made by Huawei was the only device where no such security vulnerability was found.
In August 2023, the same researchers found that Sogou, one of the most popular keyboard apps, did not use Transport Layer Security (TLS) when transmitting keystroke data to its cloud server for better typing predictions. Without TLS, a widely adopted international cryptographic protocol that protects users from a known encryption loophole, keystrokes can be collected and then decrypted by third parties. Even though Sogou fixed the issue after it was made public last year, some Sogou keyboards preinstalled on phones are not updated to the latest version, so they are still subject to eavesdropping. [...] After the researchers got in contact with companies that developed these keyboard apps, the majority of the loopholes were fixed. But a few companies have been unresponsive, and the vulnerability still exists in some apps and phones, including QQ Pinyin and Baidu, as well as in any keyboard app that hasn't been updated to the latest version.
These apps help users type Chinese characters more efficiently and are ubiquitous on devices used by Chinese people. The four most popular apps -- built by major internet companies like Baidu, Tencent, and iFlytek -- basically account for all the typing methods that Chinese people use. Researchers also looked into the keyboard apps that come preinstalled on Android phones sold in China. What they discovered was shocking. Almost every third-party app and every Android phone with preinstalled keyboards failed to protect users by properly encrypting the content they typed. A smartphone made by Huawei was the only device where no such security vulnerability was found.
In August 2023, the same researchers found that Sogou, one of the most popular keyboard apps, did not use Transport Layer Security (TLS) when transmitting keystroke data to its cloud server for better typing predictions. Without TLS, a widely adopted international cryptographic protocol that protects users from a known encryption loophole, keystrokes can be collected and then decrypted by third parties. Even though Sogou fixed the issue after it was made public last year, some Sogou keyboards preinstalled on phones are not updated to the latest version, so they are still subject to eavesdropping. [...] After the researchers got in contact with companies that developed these keyboard apps, the majority of the loopholes were fixed. But a few companies have been unresponsive, and the vulnerability still exists in some apps and phones, including QQ Pinyin and Baidu, as well as in any keyboard app that hasn't been updated to the latest version.
What you say? (Score:5, Funny)
I totally did not see this coming. Nope, never in a million years.
Re: (Score:2)
Easier said than done, one should think it's not that hard considering how many there are, but when you need one to hug...
Re: (Score:2)
Google does the same on your phone. (Score:2, Troll)
Google keyboard on each Android phone, does exactly the same.
Re:Google does the same on your phone. (Score:5, Informative)
This is exactly why I stick to the vanilla keyboard on my iPhone ... why would I want to send my keystrokes, including passwords, to a remote third party? Because "Trust Us" TM ?
Re: (Score:2)
Re: (Score:2)
Samsung keyboard is even worse.
You have to use an opensource keyboard.
Re: (Score:2)
Google keyboard on each Android phone, does exactly the same.
This is false. Try shutting off all network connections on an Android phone and see if Gboard behavior changes.
The truth is that keyboard prediction works just fine with no network. There is absolutely no reason for any keystrokes to be sent to a server. This is true for English, and it's true for Chinese characters.
The problem is not TLS. The problem is that any data at all has to be sent over the network.
Re: (Score:3)
The language model doesn't update in realtime. They are sending aggregate data opportunistically and then later on retraining the model. The new predictive text model would be delivered in a future app update.
I don't think it's worth the trade-off necessarily, Google already had the full content of every Gmail message ever sent. But I'm also too lazy to look into it or find an alternative, because nobody has time to die on every hill.
Re: Google does the same on your phone. (Score:2)
Re: (Score:2)
You're assuming the OS tells the keyboard what the context is? As far as I know, that data shouldn't be leaked to the keyboard app maker.
Re: (Score:3)
If Google isn't lying, Gboard allows one to turn off sending statistics to Google and also turn off personalized suggestion.
The news article is about keyboard apps developed by companies in China. Their "security flaws" are probably a feature for the government, not a bug.
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
I'm amazed it's so obvious though - it's like they didn't even try to hide their intentions here. Not using TLS? OMG that's obvious. You'd have thought maybe it was more like "use TLS with a janky cert" or "use TLS, but separately send keystrokes to second server" - but no, just leave it wide open for all nation states to snoop over.
Re: (Score:2)
From what I read, it's typing Chinese characters by spelling phonetically with latin characters. If it's transmitting on each keystroke, it will probably use UDP with no handshake. That said, it doesn't mean you can't have a key exchange and use public key cryptography. EncryptWall is what they were using, which was apparently broken since 2002.
Nevermind. They aren't that clever anyway. I found a security researcher's writeup [citizenlab.ca] from last year and it is using an HTTP endpoint. It would have taken zero ef
Re: What you say? (Score:3)
How about we only choose keyboard apps that don't require internet permission. To hell with predicitive typing by sending to a server. Not worth it.
Re: (Score:2)
Re: What you say? (Score:1)
Re: (Score:1)
I have a feeling the -1 is from your actual Karma. :D
Re: (Score:3)
I have a feeling the -1 is from your actual Karma. :D
If you click on the score, you'll see the actual moderation that's been done. Ironically, you're right AND the post has at least one, "Troll," mod at this point.
Re: (Score:2)
Wow, did you think of that all by yourself? How long did it take you? Anymore gems?
Gee, I wonder how that happened (Score:2)
Word use (Score:5, Funny)
Security "flaw"? As it if were some accident?
Re:Word use (Score:4, Insightful)
Maybe all those people were accidentally born in China.
Re: (Score:2)
Re: (Score:2)
Probably just a case of them not really thinking about it, like we didn't before Snowden.
People seem to forget that most sites didn't bother with HTTPS and most apps send data in the clear before Snowden's revelations. That was when the push really started to encrypt everything by default, and browsers started warning about non-HTTPS etc.
China just hasn't had their Snowden moment so is like we were 10 years ago.
Re: Word use (Score:2)
We knew that http was sent in the clear, that is why we used nicknames and never sent personal information over the internet.
Re: (Score:1)
The same people that say China is incompetent at tech then blames them for willingly having this security flaw. Pick a lane! In this case it's much likely to just be incompetence. After all, they don't need an intentional security flaw; even if the traffic was 10
Re: (Score:2)
Flaw/design feature .... potato/potato
fdpaiaope lhiadfjs lksfda qjlg lkasd (Score:2)
fposa djvoint aeoincow. ampcsaliocjdoi qjrc0iqjvav. hsaoifj fjsf. afds fasf fdoso af wt f apptrpe ca l ja f papivmcnbzxmf rp afjoapqmc admdas cdma camfka!
Take that ya Chinese!
Re: (Score:2)
What? My mother was a saint!
Every Chinese Keyboard App Has a... (Score:5, Informative)
They found one phine (Score:3)
Re: They found one phine (Score:3, Interesting)
So, this confirms why Huawei was banned. Blame the uk since they worked with Huawei to secure their products...until the USA ordered the UK to stop doing so and instead ban Huawei.
All your keyboard (Score:5, Funny)
"keystroke data that these apps send to the cloud" (Score:2)
Seems deliberate and obvious.
Hmmm (Score:2)
A government spying on their citizens. Say it isn't so! This isn't something that just the commies do either. There are plenty of 3 letter agencies in the US that I'm sure are doing the same thing in the guise of "security".
Re: (Score:2)
Hey, now. We're far more civilized and make spying on our own citizens illegal. ...That's why we have agreements with our allies to spy on each other's citizens and share the information to ensure we don't break this very important law.
comedy (Score:5, Insightful)
This is pure comedy: Huawei, the company accused the most of spying, is found to spying the least.
Re: comedy (Score:2, Insightful)
I missed where it said anyone was spying. In fact, I'd be amazed if this wasn't being exploited by the CIA (et al) more than anyone else - after all, they're the masters of spying.
Re: (Score:2)
The Chinese state is pretty good too and, in fact, has multiple times the number of people that the US has, dedicated to that. Both sides must have been fully aware of this. They must 100% both already now about this. The disturbing thing should be that clearly both of them are more happy for the other to have the data than for the people to be able to protect there data. We already knew that about western security services which have kept back zero days repeatedly, but did we know that the Chinese security
Re: (Score:1)
I missed where it said anyone was spying. In fact, I'd be amazed if this wasn't being exploited by the CIA (et al) more than anyone else - after all, they're the masters of spying.
I think you also missed the part where these apps were developed by Chinese companies. Did the CIA infiltrate them too? What I expect is that every organization with ISP wiretaps has been taking advantage of this leak, especially now after the widespread discovery.
What's not in the article and would be interesting to know is how much these apps are being used outside China to type Chinese, as the article claims these apps are used around the world.
Re: (Score:2)
This is pure comedy: Huawei, the company accused the most of spying, is found to spying the least.
To be fair, the difference is that Huawei controls the networks so they can do their spying there based on the characters that arrive at the servers. So nobody's accusing them of not spying, it's just they're doing their spying securely.
Re: (Score:1)
Then all the Chinese people in America are forced to use insecure versions that the US can spy on.
Re: (Score:1)
This is pure comedy: Huawei, the company accused the most of spying, is found to spying the least.
You misunderstand. Huawei's apps were the only ones not leaking to third parties with ISP level wiretaps. Nothing in the story or even logically says Huawei isn't spying on users of it's apps. The mere fact that all these apps are connecting to third party servers suggests they're all sharing private information, it's only that some are not keeping the content shared private from MITM attacks.
Re: (Score:2)
Only if you think Google isn't spying because they made Chrome warn about non-HTTPS, but they get everyone's data directly from the browser.
Re: (Score:2)
Next thing you know, we'll discover that social media via TikTok doesn't actually contain any state secrets worth spying upon.
And the CIA says... (Score:2, Troll)
...don't tell everybody!
Not a bug (Score:2)
the keystroke data that these apps send to the cloud
So they already tell the govt everything you type. No need for any security.
The irony is strong with that one (Score:2, Interesting)
A smartphone made by Huawei was the only device where no such security vulnerability was found.
Wasn't Huawei on the US administration's radar for being a PRC spyware distributor?
If that doesn't convince you the US spews out just as much propaganda as China does, I don't know what does.
Re: (Score:2)
Yes, because Huawei phones have implemented a more advanced version of the backdoor. Why just leak unencrypted data when you can encrypt it and send it directly to the CCP?
"flaw" (Score:1)
The CCP want to make us all their slaves like the mainlanders.
It isn’t a “flaw” (Score:5, Informative)
How wrong would I be... (Score:1)
...if I just assumed that every single one of my keystrokes is recorded and exfiltrated some place without my knowledge? Maybe one of them listening in right now could let me know?
Trying to understand the purpose (Score:2)
I guess my question is: why is it necessary to send that data up to the cloud at all? Can't that character generation and predictive text all be done natively on the phone? Do these C
Re: (Score:2)
AOSP? (Score:2)
Does AOSP not support Chinese input?
BTW, Heliboard is available from Izzy and is open source and does good (non-nudge) prediction locally.
Re: (Score:2)
There appears to be one [googlesource.com]. The Chinese language involves thousands of characters. A lot of them have you type the word phonetically using latin characters (Pinyin). So predictive text is difficult and I expect it's probably not that good or efficient.
The original Google Pinyin keyboard released by Google China used a dictionary stolen from Sogou, so that's not great. But it does illustrate how hard it is to make a good keyboard in the Chinese language.
Anti-virus is watching you (Score:2)
Backdoor (Score:1)
And the CCP says (Score:3)
"Security flaw...or security feature?"
No TLS is bad. But why cloud? (Score:3)
"flaw"? (Score:2)
Is that what they're calling it?
but y tho (Score:2)
"Security Flaw" or government spying? (Score:3)
"Every Chinese Keyboard App Allows Chinese Government Spying"
That's the real headline. It's not a "security flaw". It's an intentional backdoor to allow the government to monitor what people are typing.
Because once they post it, it's too late - even if you get the platform to take it down, someone's probably seen it, and if it contains "sensitive information" then the ideas might spread.
But if someone starts typing some keywords, then it could be pre-emptively shut down ahead of time. Posting something pro-democracy? Better to lock your phone than let you post it. Hey, we can cause your phone to reboot so it looks like a phone bug!
And if you're a known torublemaker, well, then everything you type is being monitored.
Is it really a flaw? (Score:1)
OnePlus? (Score:1)
It's not a bug (Score:1)
It's a feature.
And North Korea! And Japan! And Indonesia! And... (Score:1)