隐私安全:国行机和国产应用软件安全隐患

(泡泡报道) 据官方数据,截至2014年6月,中国网民规模达6.32亿,其中,手机网民规模5.27 亿,互联网普及率达到46.9%。在网民上网设备中,手机使用率达83.4%,超越传统PC整体80.9%的使用率,移动终端已经成为一种重要的媒介。国产应用软件劣迹俯拾皆是。国行版智能手机基本都有经过深度改装,预装了很多国产APP,且无法卸载,仅此就足以丢失隐私权了,在这样的监控状态下如果翻墙浏览便是加倍危险。如果条件所限只能购买国行产品,建议卸载原有系统重装,且不支持下载任何一款国产APP。

国产应用软件劣迹

有用户发现,在百度上搜索软件,会得到一个“百度软件中心”的下载链接,如果用它来下载苹果的iTunes,会发现其签名用的是百度证书,且一运行程序就要权限(真正的安装包是苹果公司签名的,且要安装的时候才会要权限),普通用户根本不会发觉。安装包的签名就如手机上“撕毁保修无效”的贴标:贴标的完整代表内部元件没有被改动过,签名的正确保证了分发的软件内容不被篡改。带苹果签名的安装包表示这个安装包是由苹果做的,带百度签名的安装包表示百度往这里面加了某些东西,最终经手的是百度。

 

该用户称,在安装的过程中没有关掉“安装百度杀毒确保软件安全”那个选项,经测试,关掉即可下载到苹果签名的软件。但该选项是预置的,一般用户不小心就会略过。另有用户反映,用平板下载cpuz被自动安装上了百度安全卫士的进程。据悉,百度将其安全软件打包并设置后台安装,且不出现在程序卸载列表中,非专业人士难以删除。因为GFW的存在,苹果官网上的iTunes下载页面在大陆不能顺利打开,使用大陆应用商店的用户不在少数,虚拟机也并不普及,无端遭遇流氓软件侵害的用户群体是很大的。

百度的杀毒软件还会像病毒一样攻击漏洞,在用户不知情的状态下挂马,系统会莫名其妙的出现故障甚至崩溃。北京新宇科技的负责人称,自己“在一个名叫“80影档网”的百度影音联盟网站看片,结果电脑被自动装上了百度杀毒、百度卫士、百度输入法、百度浏览器一大包软件。分析结果发现是百度影音联盟网站利用IE的漏洞挂马,偷偷在电脑下载运行了一个144MB的百度一键安装程序(数字签名和服务器地址都是百度)” 。该博主称,此消息公开后遭到水军滋扰,言其造谣要其删帖,他表示如百度不给合理解释就坚决不删除。同时还有其他用户在反应类似情况,称从未安装过任何百度应用,“最多使用谷歌浏览器登陆一下百度搜索和网盘”,不清楚如何安装上的。

10月底有网友在 Sony 官方论坛 Xperia Care 上提问:为什么Sony Xperia 手机更新后,出现神秘百度资料夾?用户称,是在没有下载过任何百度应用的情况下,自动出现的百度资料夹,且不论怎么砍都会再次出现,即使將手机恢复原厂设置也无法解決问题,更严重的是资料夹直接连接到中国的伺服器上,信息安全令人担忧。

追查发现,这个资料夹与 Sony的“My Xperia”服务有联动关系,致使用户无法将其删除,且从装置管理员中都无法取消百度选项。索尼公司对此的做出的回应是:Sony My Xperia 这个应用程式需在 Google 和百度的架构下才能提供完整服务(如手机遗失时的定位或锁定),因此当 MyXperia 启动时便会出现百度资料夾,Sony 称“可保证使用者的资料不会因此储存在百度的伺服器里”。据悉,Asus手机也有类似情况出现。谷歌和百度应该可以掌握世界上很多人的行踪,但对大陆用户来说,资料落在美国政府手中还是中国政府手中,用户的担忧程度可能非常不同。

奇虎360的劣迹更为严重。如360安全浏览器,会把用户访问的网址、对应的 cookie、用户在地址栏输入的内容等等信息上传到奇虎的服务器上;360安全卫士被曝有设置木马或后门程序,来获得一些商业上的信息,以及和政府部门合作,网络监控部门可能会通过杀毒软件公司提供的信息找到发布敏感文字的人。其他国产杀毒软件如瑞星、金山、天网等都已多次被发现有后门或者是其它不可告人的代码存在。

此外,据报道,拼音加加2004v3.02、新华五笔,这两个输入法软件也被发现有后门和敏感词汇汇报功能,会在不知不觉中泄漏隐私。QQ更甚,建议尽量不要在翻墙状态下和进行敏感谈话时开启QQ。群内聊天是最危险的,基本所有敏感词语都会被记录下来。

国产手机不可靠

国产手机的安全性能也令人堪忧。本年七月,一位红米Note手机用户测试发现,在关闭小米账号和小米云服务等需要连接小米服务器的功能之后,手机仍然在悄悄连接北京服务器。这位用户删除了所有的小米内置应用,加装了防火墙,结果仍然如此,暗示小米的网络访问功能藏在底层固件内,用户无法禁止。这位用户还发现,用Download Manager在Google Play应用商店下载应用或在Gmail应用内下载附件都要经过北京的IP地址。另据东周刊报道,小米盒子也被发现有恶意程序,而大陆流行的手机播放应用PTV、PPS影音、优酷和风行视频都被发现包含有Android.Spy.origin.83木马。

两年前中兴手机就被发现留有后门。一位匿名人士在Pastebin披露,中兴公司一款在美国销售的Android手机的安全隐患,随后得到了安全研究人员的证实。这款手机是中兴和美国移动运营商MetroPCS联合推出的入门级智能手机ZTE Score M,运行Android2.3.4(Gingerbread)系统,4GB储存空间,600 MHz处理器,3.5英寸显示屏,以及名叫sync_agent的内置root shell后门的应用程序。另一款在英国销售的ZTE Skate证实也有同样的问题。但并不清楚它是否能远程激活。

对国行机来说,表面的应用权限管理似乎起不到任何作用。测试显示,国内应用软件在已经明确被拒绝使用某项功能的情况下仍然在不断请求,在没有任何操作的情况下权限请求数量还在持续增加。

以微博为例,在关闭了所有应用权限的情况下,其仍可以读出用户手机信息。

APP安装时识别的是系统版本而不是手机机型,除非授权,比如授权给Google play。微博等应用却有能力知道是哪台手机登录了微博,也就相当于是谁登录的,并且与用户名相对应,此外它们还获取了什么就不得而知了。这或许能够解释为什么有些“敏感”用户即使更换了账号、不发言,也一样会被屏蔽。     

网络犯罪中国最严重

据网络安全公司诺顿发布的一份研究报告显示,2013年网络犯罪给中国企业和个人造成了370亿美元的损失,仅次于美国的380亿美元。安全分析人士对此给出的核心解释是:新网民还太不成熟,以及政府在互联网行业方面的政策强调“增长高于一切”。政府一直在严格控制网络信息的传播,并且密切跟踪不少用户的活动,但不太关注如何阻止网络犯罪,以及惩罚允许或鼓励攻击活动的公司。

纽约时报中文网的报道,中国企业往往将吸引用户当做首要任务,“互联网企业默认大家都会使用肮脏的手段,这就是他们的态度”,调研公司迈博瑞咨询的执行董事Mark Natkin说。“傻乎乎照章办事的会死得很难看,所以他们不去设法整治,而是全都变得好斗起来。”随着新一代用户开始利用智能手机上网,情况可能会变得更糟。 “中国无法访问Google Play,所以人们会去一些不具备‘谷歌官方应用商店所有的’安全功能的应用商店,”英特尔安全全球首席技术官Michael Sentonas说。

报道显示,中国75%的智能手机用户在过去12个月中遭遇过手机网络犯罪,而全球平均水平仅为38%。2013年的一项研究表明,在中国最受欢迎的1400个应用中,有35%都会追踪与应用的功能无关的用户数据。

国内流行范围广的许多应用软件都有被曝光过“流氓”特征,如腾讯QQ、搜狗输入法、360安全卫士等很多国内软件,都出现过窃取和上传用户信息及操作记录、扫描硬盘、留有后门等行为。相比PC端,移动端暴露个人信息的危险性更大。比如用户的通讯记录、联系人、地理坐标、客户端网银等重要私人信息的泄露都是在移动端上较为常见。据悉,很多APP都会在用户不知情的状态下自动读取关键信息,然后发送到远程服务器上,如果用户自行限制,很多APP就会罢工,尤其是国产APP。即时通讯软件、输入法、杀毒软件、下载工具、浏览器、播放器等应用最好都不要选择国产产品,至少在移动端上不推荐使用,因为基站很容易对智能手机定位。相比下PC较安全些,在PC上使用国产应用时建议放在虚拟机上,或者两个浏览器,一个用来翻墙,一个用来浏览国内网站,下线前擦除浏览痕迹。

评论

excellent submit, very informative. I ponder why the opposite experts of this sector do not understand this.
You should continue your writing. I'm confident,
you have a great readers' base already!

My page ... <a href="http://idpro.widblog.com/13554422/id-pro-ternama-di-pkv-games-terbaik-da... Id Pro</a>

Your software system needs to use money management as better.
So what do you say could it have been your failure or
success? Start investing in only a single currency pair. http://www.local-content-industry.com/casino-on-the-internet-betting-why...

This article is truly a fastidious one it assists new web users, who are wishing in favor
of blogging.

Also visit my page ... <a href="https://cloudoctane.com/website-builder/">Website Builder</a>

I am in fact glad to glance at this blog posts which carries lots of valuable facts, thanks for providing such
information.

Here is my web site: казино - https://www.youtube.com/watch?v=jxB71msIeXY

Hello there! Do you know if they make any
plugins to protect aagainst hackers? I'm kinda paranoid about losing everything I've worked hard
on. Any tips?

Also visit mmy weblog; <a href="http://www.mayaera.com/member/space.php?uid=7874&do=blog&id=7407">req black diamond trader</a>

best online gambling sites for real money
play blackjack - http://onlinelistcasino24.com/
gambling online
sex roulette - http://onlinelistcasino24.com/
casino gambling

Right now it appears like Drupal is the top blogging platform out there right now.
(from what I've read) Is that what you're using on your blog?

my web-site - <a href="https://www.daeguanma.com/">대구출장안마</a>

Pretty section of content. I just stumbled upon your web
site and in accession capital to assert that
I get in fact enjoyed account your blog posts. Anyway I'll be subscribing to your feeds and even I achievement you access consistently rapidly.

Also visit my web blog - <a href="https://www.digitalcorsaire.com">growth hacking</a>

Saved as a favorite, I really like your site!

Look at my blog post poker online ( https://hbo365.net/ - https://hbo365.net/Member/Register/?R=225B9FC2 )

Pretty! This has been an incredibly wonderful article.
Many thanks for supplying these details.

Feel free to visit my blog ... Cloud Hosting - https://cloudoctane.com/website-engine/

I am in fact grateful to thee owner of this web page who has shared thiis
impressive piece of writing at at this time.

Also visit my weblog: how to make money online for free in south africa, <a href="http://dle.web.kr.ua/user/NewtonRanken8/">Geri</a>,

What's up colleagues, how is the whole thing, and what you desire to say on the topic
of this piece of writing, inn my view its in facht remarkable in favor of me.

Here is my web page - fx incognito download - http://En-Invest.com/user/LucioSynan57608/

I will right away clutch your rss as I can't to
find your email subscription hyperlink or newsletter service.
Do you have any? Please allow me realize in order
that I may just subscribe. Thanks.

Havee a look at my site :: sports betting strategy reviews (<a href="https://retepalliative.ars.toscana.it/index.php/component/k2/itemlist/us...)

Excellent post. I used to be checking constantly this blog and I'm impressed!

Extremely helpful info particularly the final section :) I handle such info a lot.

I used to be looking for this certain information for a very lengthy time.
Thank you and best of luck.

Feel free to surf to my blog Domain Names - https://cloudoctane.com/domain-names/

Highly energetic post, I loved that a lot. Will there be a part 2?

Also visit my web site - <a href="https://buydesign.pl/kategoria-produktu/obrazy/">obraz do domu</a>

Are you customers interested in funky, sophisticated, or gorgeous?
So you loose the sale that was probably just a few email messages away.
You will have better chances of attracting target customers this way. http://searsrentatruck.com/__media__/js/netsoltrademark.php?d=918.credit...

Link exchange is nothing else except it is simply placing the other
person's blog link on your page at appropriate place and
other person will also do same in support of you.

Here is my weblog; Fortnite Map Code Creative - https://fortnitemapcode.com

hello there and thank you for your info – I've definitely picked up
something new from right here. I did however expertise some technical
issues using this site, since I experienced to reload the
site a lot of times previous to I could get it to load correctly.

I had been wondering if your hosting is OK? Not that I am complaining, but sluggish
loading instances times will sometimes affect your placement
in google and could damage your quality score if advertising and marketing with
Adwords. Well I'm adding this RSS to my e-mail and can look
out for much more of your respective fascinating content.
Ensure that you update this again very soon.

Also visit my page <a href="https://Liganike.com">judi online</a>

http://cialiisensf.com/ - best place to buy generic cialis online forum buy brand viagra <a href="http://cialiisensf.com/#">buy cialis in mexico</a>

What's up to all, the contents existing at this web site are actually amazing for people
experience, well, keep up the good work fellows.

Also visit my web-site; phone sex - http://lovebyt.es/phonesex490378

http://1cialisehds.com/ - cialis once a day online cheap viagra uk <a href="http://1cialisehds.com/#">buy generic cialis online canada</a>

http://gogogeneric.com/ - side effects of generic viagra buy tadalafil 20mg price <a href="http://gogogeneric.com/#">cheapest generic viagra</a>

http://us24casinoonline.com/ - new usa online casinos pch slots <a href="http://us24casinoonline.com/">onli ne casino slots</a>

http://casinoslotsgambling24.com/ - parx online casino casino games free online online casino bonus <a href="http://casinoslotsgambling24.com/">slotomania on facebook</a>

I think the admin of this site is actually working hard
in favor of his website, as here every material is quality based information.

Have a look at my homepage intime watches - http://www.intimewatches.co

Hello superb blog! Does running a blog such as this require a
massive amount work? I have absolutely no knowledge of programming however I was hoping to start my own blog in the near future.
Anyway, should you have any suggestions or tips for new blog owners please share.
I know this is off topic nevertheless I simply wanted to ask.
Thanks a lot!

My web blog :: <a href="https://www.domainregistrationdatabase.com/">Whois Domain Lookup Search</a>

http://casino-online.us.org/ - top online casino real money 456 free slots casino <a href="http://casino-online.us.org/">all slots casino free download</a>

Side Effects Cycle <a href=http://purchasecial.com>cialis cheapest online prices</a> Will Cephalexin Help Pneumonia

May I simply say what a comfort to discover somebody
that truly understands what they are talking about over the internet.
You actually know how to bring a problem to light and make
it important. More people should check this out and understand this
side of the story. It's surprising you're not more popular given that you certainly have the gift.

Here is my web site :: pièces détachées xiaomi m365 - https://www.more4m365.fr

If you would like to obtain a great deal from this article
then you have to apply these techniques to your won web site.

Also visit my web-site: Managed Wordpress - https://cloudoctane.com/wordpress-engine/

http://7realonlinecasinos.com/ - foxwoods casino online us online casinos for real money <a href="http://7realonlinecasinos.com/">best online casino</a>

[url=http://bestcasino365us.com/]online casino deposit methods[/url] fortune bay casino <a href="http://bestcasino365us.com/">online slot jackpots</a>

I like the helpful information you provide to your articles.

I will bookmark your weblog and test again here regularly.

I'm fairly certain I'll be informed many new stuff right right
here! Good luck for the next!

my page Simple Cloud Hosting - https://cloudoctane.com/

http://freecasinogames.us.org/ - virgin online casino potawatomi casino <a href="http://freecasinogames.us.org/">lady luck online casino</a>

http://onlinecasino365list.com/ - foxwoods resort casino online casino no deposit bonus <a href="http://onlinecasino365list.com/">bovada casino</a>

http://onlinewwwmen.com/ - cialis or viagra viagra 50mg <a href="http://onlinewwwmen.com/#">buy viagra online cheapest</a>

http://onlineviagriabuy.com/ - over the counter viagra substitute walmart non prescription viagra <a href="http://onlineviagriabuy.com/#">womens viagra</a>

http://buyviagricxr.com/ - who makes viagra buy viagra online no prescription <a href="http://buyviagricxr.com/#">what is viagra used for</a>

http://cheapnowaaaa.com/ - what happens when you take viagra generic viagra india <a href="http://cheapnowaaaa.com/#">generic viagra online</a>

http://onlinevirgargeneric.com/ - when will generic viagra be available viagra use <a href="http://onlinevirgargeneric.com/#">how long does it take for watermelon viagra to work</a>

页面

冒个泡吧!

Plain text

  • 不允许HTML标记。
  • 自动将网址与电子邮件地址转变为链接。
  • 自动断行和分段。