China forces one of its Muslim minorities to install spyware on their phones
mashable.com
mashable.com
* Fake app, so people can pass a manual inspection of their device
* Fake dataset, to feed so many false positives into their database it makes it time-cost prohibitive to investigate
* Conflicting dataset - Duplicate MD5 strings matching 'bad' and 'good' files; may corrupt internal databases or provide plausible deniability
C2 URL: http://bxaq.landaitap.com:22222/BXAQ/servlet/front/APPS?type... (HTTP POST)
Update URL: http://47.93.5.238:8081/APP/VERSION/jingwangweishi_version/v...
Interesting features:
MainActivity.this.scan = new SdcardScan("3GP,AMR,AVI,WEBM,FLV,IVX,M4A,MP3,MP4,MPG,RMVB,RAM,WMA,WMV,TXT,HTML,CHM,PNG,JPG", MainActivity.this.sdcardCallBack, true);
String SBMC = isTRN(isNull(EssentialInformation.getSBMC()));
String IMEI = isTRN(isNull(EssentialInformation.getIMEI(this)));
String MAC = isTRN(isNull(EssentialInformation.getMacAddress(this)));
String CSMC = isTRN(isNull(EssentialInformation.getPhoneCsModel()));
String XH = isTRN(isNull(EssentialInformation.getPhoneModel()));
String SJH = isTRN(isNull(EssentialInformation.getLineNum(this)));GA_AJ_JK_GXH_source_from_JADX\res\raw\test.txt
The md5's they are looking for you reckon?
Worst game ever. Is it just OK and Cancel? then it seems to do nothing?
Going up to http://47.93.5.238:8081/APP/ there are two other apk's [GT - "Download the security security project" "Download the public security project" ]
Clearly China is trying to solidify their geographical borders by turning majority ethnic groups in those given regions in to minority groups of ever decreasing influence. This is straight out of a very old playbook for colonization. That they are able to so opening continue doing this in 2017 with so little global acknowledgement is only partially surprising.
And the mainstream media actually investigates and reports on issues using facts?
There are obviously serious issues in Xinjiang. But the fantastical stories don't really help matters. The lack of serious reporting on what is really happening is a cause for concern
But even the original article aka spyware is quoting twitter as a source. I'd like a proper translation and confirmation of the sources before believing it. I'd hope the mainstream media is looking into the spyware issue since it's looks like there might be a story there but it's to hard to tell the real story atm.
This disgusts me. It's like those people are being dehumanized like the Jews. Maybe this is part of a wider conspiracy so when another another oil, resource grabbing led war is started. People will say and do nothing to stop it because people have sub-consciously brainwashed.
First, Xinjiang is in the west, not east. Second, Uyghurs in China do not speak Turkish. They speak Uighur, a Turkic language, but its orthography is Arabic and forced Chinese. It looks nothing like Turkish, which uses a modified Latin script.
Also there are about 10m Uyghurs as of 2010, not 8m.
What a dumb way to scan for "illegal" content, considering the goverment already controls their portion of the internet. So instead of monitoring who is accessing what they decide to compare checksums of files which can be trivially changed which would result in a completely new hash value.
Seems like a very incompetent way of doing this.
But it could just be v1.. or it could be the govt describing a flawed approach so the resulting countermeasures are totally ineffective against the actual approach.
For example, if the actual approach is extracting keyframes and comparing against a library of keyframes of existing content (legal and illegal) or doing object recognition within those frames, the "add a null byte!" countermeasures are meaningless.
Same with airline security theater, identifying citizens using biometric markers (Aadhar card in India), pernicious internet monitoring in the UK...the list goes on. I guess the idea is to use the dragnet to catch or deter a majority of the population from thought crimes and preserve resources for the real big fish.
> This is very competent.
I know there's been talk of "fuzzy hashes" as well, in order to catch files with trivial modifications, but when I studied forensics (about four years ago), that was still in the future.
Searching hundreds of thousands or millions of files by hand would be impractical and for many types of offensive content, the authorities don't want to have to distribute the actual offensive content to the people who are doing the detection.
i.e. in the US, possession of child pornography is such a serious federal crime that if one happens to discover it on a PC they are servicing, they (or their employer) are legally obligated to contact the FBI immediately. Therefore, it doesn't make sense to distribute a detection tool that basically contains the original images (in order to do GIS-style "find similar images" searches), because that tool would violate the law it was designed to help enforce. Short hashes can't be used to recreate the original images, so they're "safe" in that sense.
It's not an ideal approach, but it works pretty well and fits within common constraints of the field.
Experiment: tomorrow, ask 5 people you know who are not software engineers how to change the MD5 checksum on a file that resides on their mobile device.
Report the results here.
See e.g. http://time.com/3099950/china-muslim-hui-xinjiang-uighur-isl...
The TL;DR of it is that it has not much to do with religion specifically, and much to do with the region pushing for autonomy (which doesn't rate particularly high in the eyes of Beijing).
(This is not to say it's ok, just stating the reality of the situation)
The ordinary people's resentment towards Muslim stems from the Hui's abuse of political privileges to expand their religious strengths, such as Saria Law, to intervene Han people's daily life everywhere, from Ningxia, Gansu to Henan and Shandong, from Canteens, Schools to Police, Courts.
In the meanwhile, the majority has little to zero knowledge about the Uyghurs because only a few Uyghur people live outside Xinjiang.
The situation is really weird and there is a conspiracy theory saying that the CCP leadership has been controlled by the Hui Muslim.
BTW, the Hui Muslim and the Uyghur Muslim have been enemies since the Qing Dynasty.
Just a week ago I read about traffic warnings personalised by face recognition. Now this. Soon China might become Ingsoc with Minlove and Double think and what not.
http://www.rfa.org/english/news/china/china-orders-xinjiangs....
I don't think rfa.org should be banned, perhaps message the admins and they'll take it off the banned domains list.
[1] https://news.ycombinator.com/item?id=14785838
"Countermeasures" don't matter when there're a million ways to terrorize you, your family, and your friends into submission. They just have to suspect you.
- Append a null byte to the end of your files, giving them a unique hash value.
- Disallow internet access to the application.
- Spoof the server using DNS tricks and control what is sent and received.
- Reverse engineer the application to make it look as if it's working while it actually isn't.
- Sandbox the application.
- Use an alternative phone for all of your "sensitive" activities.
- Don't keep "sensitive" information on phones, rather store on an encrypted computer.
- Use an old burner phone.
So not only is the policy utterly disgusting, it's also completely ineffective. A small blessing perhaps.
Then they came for the Trade Unionists, and I did not speak out— Because I was not a Trade Unionist.
Then they came for the Jews, and I did not speak out— Because I was not a Jew.
Then they came for the Muslims—and everyone rejoiced in their unity of hating them together.
https://www.ushmm.org/wlc/mobile/en/article.php?ModuleId=100...
*typo
I don't understand why this isn't seen as a serious problem.
Good thing we have nothing like that. Only just closed hardware with closed or with some parts open complicated software mostly made by a few corporations which tend to and have in fact in past coopoerated with governments without even thinking about their customers.
I don't think they're the same.
Of course, if I were the Chinese official responsible for this policy, I would use highly visible and easily circumvented spyware in addition to backdoors and other more covert forms of surveillance. The spyware would just be a diversion.
Second, dedicated criminals will now actively avoid the compromised smartphones and seek alternate means of communication. As others have noted, the current surveillance malware seems easy to circumvent. This is why spy agencies don't generally advertise their sources and methods.
It would be analogous to a big red icon on your home screen with Snowden's face on it. You already know everything he told the world about the American government's recent behavior. The icon is just a reminder that the country you live in does unethical things, and in the case of China, a helluva lot more unethical things.
Yes, it will have a chilling effect -- but only because the truth is chilling and this app reminds people of that truth. In America, a lot of what we say on these forums regarding our three-letter agencies is speculation. In China, pervasive surveillance and censorship is a reality, not just speculation. And I'm not sure whether it would be a good thing or a bad thing for the Chinese people to become more aware of this reality in their daily lives. I'm not saying this to pick an argument. I really don't know what to think of it.
EDIT: I'm surprised about how many people jump to the defense of the Chinese government here on HN. Seems in stark contrast with the usual political opinion of the crowd. I can only ascribe this phenomenon to massive cultural relativism.
Suspicions are of course lesser.
But sneakily compromising hardware is worse then officially compromising hardware!
> defense
That comment ain't a defense.
Probably not all people from that area have the gps on non-stop with facebook and google accounts signed in non-stop to receive those goody notifications.
What do you do in that case if you're the government ?
What's more, they seem technologically ineffective. As if the government were just trying to make a show of its power rather than provide real solutions.
It's absolutely indefensible and you must know it, considering you opened a new account to comment this.
*Edit: the headline was originally 'China forces its Muslim minority to install spyware on their phones'
And then the first sentence starts with "China has ramped up surveillance measures in Xinjiang".
So I don't consider the headline misleading at all. News sites necessarily have to use short titles. The lack of an exhaustive title shouldn't be criticized unless it is clearly clickbait or contradicts facts or the article.
"China's forcing citizens in Muslim-majority region to install spyware on their phones"
Note the "Muslim-majority region", which was missing from the original HN title.
And even if the first version of this spying app only checks for md5 sums, which is arguably useless, I'm sure they're working on something more effective.
Ethnic separatism may be a problem to the Chinese state. But it is not a problem for the people or something that needs to be solved.
It may as well be 'Fnord' for how it's used.
It is not removed from YouTube, e.g. all ISIS songs (nasheeds) are available on YouTube.
In western countries, you get detained for years in Guantanamo under torture without knowing for sure why you got arrested. Young girls get married as early as 12 to creepy old dudes and there is no need to ask for installing spyware because the phones and communications are already tapped by default.
Anyone criticizing China while permitting their own country to do worse is an hypocrite. Still waiting for the outrage about the mass surveillance from Amazon Echo, Google and others. Only the European Commission is doing something visible against this trend.
Being a hypocrite is irrelevant with regard to what the hypocrite is saying.
And you cannot determine if one is a hypocrite just from a fact, there's no outrage, or can you? Many solves this problem their way, pointing out, talking about it, criticizing it and so forth.
There is no higher moral ground on this situation so option c) would be suited. It is great when we strive to get better human rights for everyone, and yet the human rights for the citizens of another country are being threatened by religious extremists.
How the government of this other country replies is really their own business whether we like it or not. Is it a mass violation of human rights? Perhaps. What made them reach such decision? We don't know either. Are we in the west doing any better? No. China is not bombing Syria nor toppling moderate Islamic governments in North Africa.
This bad situation won't charge in our own turf while the majority of netizens think that this only happens in other turfs.
In Xinjiang region, the concern is more about separatism, which is not terrorism, and which should be a right of any group.
> "Anyone criticizing China while permitting their own country to do worse is an hypocrite"
One can be critical of their own government while still being critical of others. Even in US, ordinary people don't have much control over the government, in particular over the security state, other than complaining, so "permitting" abuses shouldn't be considered hypocritical.
You can surely be critical of others, your own government does comparably worse to the same minority without even letting ordinary people know. That is hypocrisy.
What do they call extremism in other areas with deep socioeconomic problems? Non-islamic extremism?
wait. how would that work?
seriously.
would that apply to Texans and Californians who want to secede from the US?
what about:
* a sect of highly conservative polygamists in the American West?
* the Michigan Militia?
* extreme American Communist party members?
* David Koresh followers?
* a population of immigrants from country X who now live in country Y?
* ethnic Russians in Ukraine?
do any/all of these groups have the right to separate from their current government?
what are the ground rules?
Answer: "Governments are instituted among Men, deriving their just powers from the consent of the governed, That whenever any Form of Government becomes destructive of these ends, it is the Right of the People to alter or to abolish it, and to institute new Government...But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security." -US Declaration of Independence
Depending on the specific case, it would be up to people to determine whether these conditions have been met.
Ridiculous statement. "Permitting", like it's my choice? You can live in a country and disagree with some of what it does. Even better in democracies where you can do so publicly and have some form of impact through voting.
Also happy I'm able to discuss this topic online without this post getting blocked/deleted and facing possible repercussions.
"Still waiting for the outrage about the mass surveillance from Amazon Echo, Google and others" Yes like that debate doesn't exist and no one talks about it?
I guess a better analogy would be:
"How is negotiation comparable to shooting?"
"When they were used to free the hostage."
https://news.ycombinator.com/item?id=14763085
Your response to me back then seemed in good faith, if a bit naive. This continued trend of blatant propagandizing is a bit worrying though.
Perhaps change it up so your work isn’t immediately recognizable? Even sounding the least bit neutral would probably be enough to blend in.
Consider my criticism and one day you might.
Why are you attacking him rather than the argument?
> Perhaps change it up so your work isn’t immediately recognizable? Even sounding the least bit neutral would probably be enough to blend in.
You don't sound very impartial either.
I’m obviously not attempting to be impartial considering I’ve directly called them out by name, but I’m glad you’ve noticed the tone of my comment awkarddaturtle.
Human rights is just an opportunity for many to grandstand and make smug declarations while making the flimsiest of excuses with a straight face and hand waving away their own government's actions. Unfortunately so much water has flown under the bridge this is just not credible.
What happened to the concern for all the refugees from Syria now, everyone is fighting to keep them away yet are happy to make sanctimonious statements feigning concern to justify destructive action that decimates entire countries and destroys millions of lives driven entirely by political and economic agendas. This kind of odious hypocrisy is just not tenable anymore.
You're also putting a lot of words in people's mouths. Many or most of folks who have a problem with things like this are also the people concerned with their own government's actions abroad, and are _not_ those "fighting to keep [Syrian refugees] away".
Everything can be made to look like hypocrisy if you just freely mix and match opinions of completely different people.
It was the media. I'm sure if people had voted to say whether they wanted the refugees in Europe or not, the "no" would've won.
And as soon as refugees stopped giving them ratings, the media stopped talking about them, and that was it.
I was talking with my wife this morning and other parts of western china (not xinjiang) have some issues with radicalization. The muslims have been on a non stop jihad since its inception and this is just a continuation of it. We could also go over what's been happening in the russian republics (like kazakhstan) which also have been feeling the effects of "invasion".
What percentage of those "muslim minorities" actually took part in those acts? Does that percentage justify treating everyone who qualifies as "muslim minorities" like a criminal?
> The muslims have been on a non stop jihad since its inception and this is just a continuation of it.
That's not remotely true despite what extremists on both sides like to delude themselves into believing.
the issue isn't 'percentage' of active agents, or 'supportive' agents. it's about ideologies with structural support for violence and oppression.
> That's not remotely true
how do you think islam spread historically? peaceful dialog over tea?
a rather significant contribution was conquest and the 'education' of other people's children in the 'islamic worldview'.