Baidu's and Don'ts
Total Page:16
File Type:pdf, Size:1020Kb
BAIDU’S AND DON’TS Privacy and Security Issues in Baidu Browser By Jeffrey Knockel, Sarah McKune, and Adam Senft FEBRUARY 23, 2016 RESEARCH REPORT #70 Copyright © The Citizen Lab Licensed under the Creative Commons BY-SA 4.0 (Attribution-ShareAlike licence). Electronic version first published in 2016 by the Citizen Lab. This work can be accessed through https://citizenlab.ca/2016/02/privacy- security-issues-baidu-browser/. Document Version: 1.0 The Creative Commons Attribution-ShareAlike 4.0 license under which this report is licensed lets you freely copy, distribute, remix, transform, and build on it, as long as you: • give appropriate credit; • indicate whether you made changes; and • use and link to the same CC BY-SA 4.0 licence. However, any rights in excerpts reproduced in this report remain with their respective authors; and any rights in brand and product names and associated logos remain with their respective owners. Uses of these that are protected by copyright or trademark rights require the rightsholder’s prior written agreement. Suggested Citation Jeffrey Knockel, Sarah McKune, and Adam Senft. “Baidu’s and Don’ts: Privacy and Security Issues in Baidu Browser,” Citizen Lab Research Report No. 70, University of Toronto, February 2016. Acknowledgements The Citizen Lab would like to thank Seth Hardy from Lookout for assistance with this report. Jeffrey Knockel’s research for this project was supported by the Open Technology Fund’s Information Control Fellowship Program. Sarah McKune’s research was supported by a grant from the Open Society Foundations (Ronald J. Deibert, Principal Investigator), and Adam Senft’s from the John D. and Catherine T. MacArthur Foundation (Ronald J. Deibert, Principal Investigator). About the Citizen Lab, Munk School of Global Affairs and Public Policy, University of Toronto The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs and Public Policy, University of Toronto, focusing on research, development, and high-level strategic policy and legal engagement at the intersection of information and communication technologies, human rights, and global security. We use a “mixed methods” approach to research that combines methods from political science, law, computer science, and area studies. Our research includes investigating digital espionage against civil society, documenting Internet filtering and other technologies and practices that impact freedom of expression online, analyzing privacy, security, and information controls of popular applications, and examining transparency and accountability mechanisms relevant to the relationship between corporations and state agencies regarding personal data and other surveillance activities. Contents Key Findings 5 Introduction and Overview 6 Responsible Disclosure and Notification 7 Baidu Browser: Brief Background 7 Technical Analysis 8 “Easily decryptable” encryption 9 Part 1: Insecure transmission of personal data 11 Android Version 11 a. Leaks sensitive data on startup 11 b. Leaks sensitive data and address bar contents when inputting into address bar 12 c. Phones home with sensitive data about every page view 13 d. Insecurely checks for software updates 13 Windows Version 14 a. Leaks address bar contents when inputting into address bar 15 b. Communicates with Baidu servers via an easily decryptable protocol 15 c. Phones home information about every page view that includes hardware serial numbers 16 e. Updates list of website domains triggering proxying 17 Part 2: Proxying of foreign-hosted websites 18 kv_auth resource 19 fg_pac resource 19 kv_report resource 20 Analysis 21 Part 3: Vulnerabilities in other Baidu products and third-party apps 24 Global editions of Baidu Browser 24 Sensitive data leaks in Baidu Mobile Tongji (Analytics) SDK 25 Discussion 27 Questions for Baidu 29 Analysis of Android client version 6.4.14.0 29 a. Leaks sensitive data on startup and Phones home with sensitive data about every page view 30 b. Leaks sensitive data and address bar contents when inputting into address bar 30 c. Insecurely checks for software updates 30 Analysis of Windows client version 8.2.100.3090 30 a. Leaks address bar contents when inputting into address bar 30 b. Communicates with Baidu servers via an easily decryptable protocol and Phones home information about every page view that includes hardware serial numbers 30 c. Insecurely checks for software updates 31 CITIZEN LAB RESEARCH REPORT NO. 70 阅读报告的主要发现 Key Findings › Baidu Browser, a web browser for the Windows and Android platforms, transmits personal user data to Baidu servers without encryption and with easily decryptable encryption, and is vulnerable to arbitrary code execution during software updates via man-in-the-middle attacks. › The Android version of Baidu Browser transmits personally identifiable data, including a user’s GPS coordinates, search terms, and URLs visited, without encryption, and transmits the user’s IMEI and a list of nearby wireless networks with easily decryptable encryption. › The Windows version of Baidu Browser also transmits a number of personally identifiable data points, including a user’s search terms, hard drive serial number model and network MAC address, URL and title of all webpages visited, and CPU model number, without encryption or with easily decryptable encryption. › Neither the Windows nor Android versions of Baidu Browser protect software updates with code signatures, meaning an in-path malicious actor could cause the application to download and execute arbitrary code, representing a significant security risk. › The Windows version of Baidu Browser contains a feature to proxy requests to certain websites, which permits access to some websites that are normally blocked in China. › Analysis of the global versions of Baidu Browser indicates that the data leakage is the result of a shared Baidu software development kit (SDK),1 which affects hundreds of additional applications developed by both Baidu and third parties in the Google Play Store and thousands of applications in one popular Chinese app store. › Please see the “Update: Analysis of updated versions of Baidu Browser” section at the end of this report for updates on these issues, following our disclosure to the vendor and our analysis of the latest versions released prior to publication. 1 software development kit is a set of tools used for developing software applications. 5 BAIDU'S AND DON'TS Introduction and Overview Baidu Browser is a free web browser for the Windows and Android platforms, produced by Baidu, one of China’s largest technology companies. The browser offers a number of features beyond those found in standard browsers, including video and audio download tools and built-in torrent support. This report provides a detailed analysis of how Baidu Browser manages and transmits user data during its operation. The report identifies security concerns in both the Windows and Android versions of the browser that may expose personal user data, including a user’s geolocation, hardware identifiers, nearby wireless networks, web browsing data and search terms. Such user data is transmitted, in both the Windows and Android versions, unencrypted or with easily decryptable encryption, which means that any in-path actor could acquire this data by collecting the traffic and performing any necessary decryption. In addition, neither version of the application secures its software update process with a digital signature, which means that a malicious in-path actor could cause the browser to download and execute arbitrary code. This report is a continuation of our prior work examining the security and privacy of popular mobile applications in Asia. Our previous research includes a report on similar concerns with UC Browser, a popular mobile web browser owned by China-based e-commerce giant Alibaba. That report documented UC Browser’s unencrypted transmission of sensitive user information, including IMSI, IMEI, Android ID, Wi-Fi MAC Address, geolocation data and user search queries. The security issues in UC Browser were identified in documents leaked by Edward Snowden that indicated the Five Eyes intelligence alliance, consisting of intelligence agencies from Canada, the United States, the United Kingdom, Australia and New Zealand, had used these vulnerabilities as a means of identifying users. In previous work, we have analyzed the auto-update mechanisms in popular third party software. The remote code execution via man-in-the-middle attack vulnerabilities that we found in Baidu Browser’s auto-update mechanisms are consistent with vulnerabilities common in other third party software. In addition, we have conducted research into keyword censorship and surveillance in TOM-Skype and keyword censorship in messaging platform Sina UC, as well as a comparative analysis of mobile chat applications popular in Asia, including WeChat, LINE and KakaoTalk. 6 CITIZEN LAB RESEARCH REPORT NO. 70 We have also published an overview of privacy and security in mobile communications, entitled The Many Identifiers in Our Pockets. This primer on mobile technology identifiers is useful background for some of the technical issues raised in this report. Additionally, we have published, in collaboration with Open Effect, an analysis of privacy and security concerns in fitness trackers. Responsible Disclosure and Notification On November 26, 2015, we notified Baidu of our findings and our intent to publish this report. We indicated that we would not publish sooner than 45 days after notification,