Reverse Engineering of a Huawei P20 from China | Hacker News Reader

Reverse Engineering of a Huawei P20 from China

twitter.com

72 pointsSchiphol33 comments

Not surprising, it's a phone model for Chinese market. The "evil services" are the Chinese equivalents of Google Maps, Google Analytics, Google Search, FB messenger, and iCloud/Samsung cloud.

The real issue is that most phone makers have tons of unnecessary services pre-installed in their phones, such as social media login, location tracking, and cloud storage. It would be better to design/license Android OS in a way that gives user complete control on what is pre-installed.

Yep. That's exactly it. Those unnecessary service calls are more likely to be Google-esque services for event tracking and user analytics than spying like U.S has portraited. In the old days when carriers released major smartphones, those will be the equivalent of bloatwares and their supporting services. If the guy examines Samsung Galaxy phones, it would almost be the same. The only difference is probably that TLS adoption are VERY LOW in Chinese market (Surprised? Not for a surveillance heavy society!), hence their services aren't using https as much as it should.

I think the comments on HN are missing the point his tweets are making, noticeably that Huawei phones are:

(a) Sending info over plain HTTP to non-secure sites based in China

(b) Sending all your browser and other online activity to a site called track.uc.cn

> The only difference is probably that TLS adoption are VERY LOW in Chinese market (Surprised? Not for a surveillance heavy society!), hence their services aren't using https as much as it should

I thought that the government has its fingers in all the tech companies so whether the data are encrypted or not doesn't matter?

Are you referring to the hardware attack against SuperMicro? If so, it's a pretty big leap to make from "we know about a single attack" to "fingers in all tech companies." Not that I trust Google and friends, but... that's a pretty big claim.

I am not, and in fact it seems just as likely that the supermicro endeavor was a private endeavor. It does seem likely, though, given the level of trust the government has in its companies, e.g. I think it was tencent that made their social credit system.

> If the guy examines Samsung Galaxy phones, it would almost be the same.

This is just guessing. If I have to bet, I'd as well bet that Google/Samsung/ISPs/Everyone is spying on you, but just guessing and shrugging it off is not helping.

We should be inspired to check even more devices and inform users about backdoor traffic.

I was surprised how well the negative campain against Huawei has worked in the US (justified or not).

I was talking to a none tech friend from the US and when I mentioned Huawei he went on a rant how they are Chinese spy devices.

Meanwhile here in Europe Huawei phone are quite popular and sold through carriers.

To raise the other kerfuffle du jour, how is Huawei going to fare when these findings meet the GDPR? Where is the informed consent to shipping all of this PII to who knows where? And in cleartext, without even the slightest effort at protections?

It's my understanding that he's reverse engineering the Chinese version of the phone rather than the international version.

I think they are also popular in Canada. You can get various versions of the Huawei P20 through carriers here. I don't regard them as spy devices. I think it's mostly a US thing.

It is absolutely insane to me that the market has not demanded for open source hardware and software. A competent company would be able to trivially hide such requests. How am I supposed to trust a large competent organization when there seems to be no incentive for them to operate on the behalf of the privacy of a user?

Actually huawei phones are open sourced, and a few other vendors open source their phones too.

https://consumer.huawei.com/en/opensource/

The harder part is to go though the source code.

That's a misconception. The open source part is limited to GPL and some other trivial components that are already available in source.

Things like the evil services in the article are not open source at all.

I still cannot believe that people would voluntarily buy Chinese phones. Would you buy a North Korean phone? If not, why are you buying a Chinese one?

I still cannot believe that people would voluntarily buy US phones. Would you buy a phone from the country known for its spying abilities with dozen of agencies involved in this, from NSA to CIA to companies like Facebook, Google and the rest? You mean to tell me that all these US phones are nice and clean? Yeah, right.

Disclaimer: I have a Huawei P10. Awesome product.

Chinese, american, korean, what does it matter to european? Not a bit. Nobody has some high moral ground we so desperately wish for. If you don't want to be spied on, don't get a phone. Otherwise, you're screwed like rest of us.

Better be smart with what you actually do with the phone and what kind of data/apps you use it for.

If North Korean can make good phones at an affordable price, people will buy them too, just like we buy Saudi Oil.

P20 lite had the best specs at a mid rande price point. and good specs. Alas it's also quite large. P20 (non lite) has a cv ai chip, how does that fit in with the spying!?

Some people like my parents only use their phones to get directions, group chat socially, and send pictures. There's like nothing interesting to steal from them.

They are good phones. I'm very interested in Xiaomi's Mix 3 that's going to be announced end of this month now.

At least we can unlock BL for XIAOMI true?

Seems like it's only the Chinese (non Play) version of the phone?

Do you have a oversea version for further investigation? You know HUAWEI will not provide BL unlock code anymore.

I'm curious do you consent with this when you buy the phone?

No. I also don't consent website tracking detailed information about my device when I visit a webpage, but that happens as long as I on internet.

One could argue iPhones collect similar data. How does apple know that the user you are texting has iMessage if it isn’t sent to apple?

One could not, really. E2E encryption does not mean peer to peer. Most messenging services use a client server model. You can easily use identifiers without ever collecting personal data.

Nobody knows for sure of course unless you have access to the relevant code but Apple is at least not in the business of selling data to advertisers or needs to bolster their budget with buy in from data mining companies.

Not sure I understand your argument. iPhones send a lot of information to Apple. Apple does keep a log of who you lookup when initiating a iMessage session, even if they aren’t using iMessage. So they know who you are trying to text. This is logged and available to the government upon request. No one is afraid of China using personal data for advertising.

It seems this news hasn't reach to Chinese media. They are still talking about the new Mate 20

Just buy a phone you can always root?

@fs0c131y (Elliot Alderson) profile description reads:

   French security researcher. Worst nightmare of Oneplus,
   Wiko, UIDAI, Kimbho, Donald Daters and others.

I wonder how he thinks about 1+'s security comparing to Huawei's.

"Hey @OnePlus! I don't think this EngineerMode APK must be in an user build..."

https://twitter.com/fs0c131y/status/930216866395672578

Reply on news.ycombinator.com