Official Beijing2022 apps silently collect audio | Hacker News Reader

Official Beijing2022 apps silently collect audio

twitter.com

101 pointsjicea22 comments

Those claims seem unsubstantiated

https://twitter.com/dangoodin001/status/1486976676965715968

ok, it's importing iFlytek. But without demonstrating what it's doing and when, even if it's listening (which is not clear if it's happening) it could just be listening for a wake word (just like Cortana, Google Assistant, etc. work)

Moreover, this guy seems to have willfully mistranslated the EULA to pretend that it's doing something it isn't doing.

https://twitter.com/rpotter_9/status/1486982536232587264

Whoever implemented the app though, should've kept it simple. Adding more needless functionality is just going to drive sinophobes and conspiracy theorists in a frenzy

I certainly wouldn't trust an app like this, the Android permission list is ludicrous, and the privacy statements in the EULA are equally so, but...

Jonathan Scott has yet to publish anything that concretely backs up this statement at the top of his Twitter:

  "I can definitively say all Olympian audio is being collected, analyzed and saved on Chinese servers using tech from USA blacklisted AI firm "

I'm not an expert reverse engineer, but he needs to show more than just some extracted symbol names, string resources and unidentified network traffic before making "definitive" claims.

Yea. Especially saying the Android permission list is ludicrous, that sums about a majority of apps in existence, even from 'good ole American' companies.

Entanglement with iFlytek alone is potentially problematic for Apple and Google, who are distributing this on their respective platforms, because iFlytek is on the BIS Entity List. US persons and businesses are prohibited from business relations with these entities without prior approval and license from the US federal government, and this process is quite onerous and expensive in terms of the specialized legal talent required.

As a casual observer on the fringes of trade and sanctions law, my gut tells me this case alone will probably not result in administrative action (and certainly not criminal) against Google or Apple by the US gov, but may contribute to opening a new can of worms with regard to app review, either self-imposed by the platforms or under pressure by the US government.

A Twitter thread is not the way to reveal research like this, it’s terrible for discussion and the character limit prevents your going into proper depth.

I really wanted to believe in this but the "evidence" is pretty poor: https://github.com/jonathandata1/2022_beijing

I read a lot of security reports and you don't include a screenshot of random Wireshark packets with red arrows saying "This shows data leaving the iPhone". And this is the first one of a series of non-sense screenshots.

This means at least one thing: this was written in a way to be picked up and mentioned by larger media and non-tech people.

So, to me it sounds more like if someone with a stake in all this said "Hi researcher. Here are 10K USD. Find me something controversial to shout about on Twitter and to point fingers. Just add some technical terms here and there and we'll be fine.".

Authorian state is going to do what authorian states always did, but better and bigger - thanks to the technology. And the western politicians along with olympic committee will shut their mouths and pretend that nothing is happening.

Even the “progressive” EU politicians can’t be bothered to boycott the olympics. Really disappointing and pathetic behavior of our spineless leaders.

Would Olympic athletes need Chinese (Mandarin, etc) words translated to their native language or vice versa?

Because it seems the company involved makes translation software/devices, but do go on.

Looks we have a CCP shill in our midst. You don't even try to hide it.

This kind of comment is not appropriate for hacker news, if you are really worried send an email as explained in the guidelines:

>Please don't post insinuations about astroturfing, shilling, bots, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.

You broke the site guidelines egregiously here. We ban accounts that do this, so please don't do it again.

There are hundreds of past explanations at https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme... for anyone who wants more.

If you'd please review https://news.ycombinator.com/newsguidelines.html and stick to the rules when posting to HN, we'd appreciate it.

I was also called an "Iraq and Vietnam shill" by similar types before those wars.

>Really disappointing and pathetic behavior of our spineless leaders.

Yeah it's like 1936 and still no one has learned anything from the past.

IOC and FIFA are some of the most corrupt organizations, and even worse...supported by most country's, because it's for sport and "world-freedom"

The US is diplomatically boycotting the Olympics over "genocide and crimes against humanity" in Xinjiang.

https://www.nytimes.com/article/diplomatic-boycott-olympics....

https://www.npr.org/2022/01/27/1076047424/china-is-demanding...

The US is sending Olympians, but not any diplomatic representation. NBC is broadcasting the games, but not sending any reporters. These are both protests, but I don't think either rises to term boycott.

> China is demanding the U.S. end "interference" in the Beijing Winter Olympics, which begin next month, in an apparent reference to a diplomatic boycott imposed by Washington and its allies.

If you give the app permissions or use its built-in translation feature, can this really be called "silently"?

Check the CitizenLab report: https://citizenlab.ca/2022/01/cross-country-exposure-analysi...

Has the IOC made any official statement regarding this? I note that this isn't the first issue to have been discovered in apps bearing the Olympic trademark.

How can they silently collect audio when they need to show a permission prompt to record audio?

Title has a typo. I read it as Boeing, not Beijing. Beijing makes much more sense.

Fixed, thanks!

His twitter feed is interesting; seems folks have some doubts about his research, both this and past vulnerabilities he found.

Reply on news.ycombinator.com