Privacy and Security Issues in BAT Web Browsers Jeffrey Knockel1,2, Adam Senft2, and Ronald Deibert2 1Dept. of Computer Science, University of New Mexico 2Citizen Lab, Munk School of Global Affairs, University of Toronto Abstract released a free browser: Baidu Browser, UC Browser (de- In this position paper, we summarize our technical analy- veloped by Alibaba-owned UCWeb) and QQ Browser. sis of the security and privacy vulnerabilities in three web All based on the Chromium platform, these browsers of- browsers developed by China’s three biggest web com- fer a set of features not generally offered by browsers like panies: UC Browser, QQ Browser and Baidu Browser; Chrome and Safari, including integration with each com- developed by UCWeb (owned by Alibaba), Tencent and pany’s product suite, built-in torrent support, mouse ges- Baidu, respectively. We found them to consistently con- tures, and compression features aimed at reducing mobile tain sensitive data leaks and remote code execution vul- data usage. nerabilities in their update processes. Despite the mas- The three applications have earned millions of users, sive user bases of these browsers, particularly in China, particularly in China and throughout Asia. QQ Browser there has been limited attention paid to the applications by and UC Browser are amongst the top 5 most used the information security research community. This lack browsers in China, while Baidu Browser falls outside of attention is problematic, as it is known that the inse- of the top ten [22]. UC Browser is the clear leader of cure transmission of personal user data by UC Browser the three internationally, and is by some estimates the has been used by the intelligence community to perform second most popular mobile web browser globally, after surveillance. We conclude by evaluating explanations Chrome [21]. However, despite the significant user bases for why this class of apps has such uniform security and of these applications, as well as the dominant market po- privacy issues, and recommend researchers better en- sitions of their parent companies, there is limited research gage software development companies in developing and into the privacy and security practices they employ. Our newly industrialized economies. research demonstrates that this lack of attention has been problematic. 1 Introduction In this paper, we describe the results of detailed secu- rity analyses of the three browsers, including what user Browsers are ubiquitous across all platforms and hard- data is collected, stored and transmitted by the browsers, ware types, and so the variety of browsers available— what methods are used to secure these transmissions, and particularly on mobile devices—is wide. Although most whether the applications exhibit any vulnerabilities that browsers contain similar features, the manner in which could compromise the privacy and security of user data. they collect and use personal user data may vary widely. In addition, we discuss our responsible disclosure of these This is concerning, as web browsers are used to transmit issues to the three companies. sensitive user data across a broad variety of media and Our main findings are as follows: devices. Each browser collects and transmits significant Nowhere is the market for third-party browsers more amounts of personal user data. All three browsers col- competitive than in China, particularly amongst the coun- lected and transmitted a large number of personal data try’s “Big 3” tech giants. These companies—Baidu, points, including a variety of hardware identifiers, loca- Alibaba, and Tencent, collectively known as “BAT”— tional data, and user web browsing history. operate in China’s highly competitive and dynamic mar- Each browser uses insecure methods to transmit ket, where the absence of companies dominant in western this data. Each application transmitted user data through markets have opened up opportunities in the largest Inter- insecure means, ranging from using easily decrypted net market in the world. The three companies have each symmetric encryption methods to sending user data with- 1 out any encryption. Browser O/S (Edition) Version Each browser has vulnerabilities in the software up- Baidu Browser Windows (C) 7.6.100.2089 date process. At least one version of each browser per- Baidu Browser Windows (I) 43.22.1000.452 formed software updates in a manner which left it vulner- Baidu Browser Android (C) 6.2.18.0 able to an attacker executing arbitrary code. Baidu Browser Android (I) 5.1.0.1 The browsers did not use established, industry- QQ Browser Windows 9.2.5478 standard methods of securing data transmissions. The QQ Browser Android 6.3.0.1920 methods employed to secure the transmission of personal UC Browser Windows (C) 5.5.10106.5 data, where used at all, did not use well-tested implemen- UC Browser Windows (I) 5.5.9936.1231 tations of industry-standard protocols (such as OpenSSL) UC Browser Android (C) 10.9.0.703 and were often home grown. UC Browser Android (C) 7.9.3.103 These results show that these privacy and security con- UC Browser Android (I) 10.9.0.731 cerns are not isolated to any one company, and reflect broader issues with development and security of applica- Table 1: Application versions analyzed; (I) refers to inter- tions popular in China. As a result, we argue that security national edition, (C) refers to Chinese-language edition researchers should focus more attention on these applica- tions, which are used by hundreds of millions of people without significant external scrutiny. There is some prior research on both the leakage of personal data as well as the execution of malicious code in the three browsers. Wu and Chang [25] examined 115 2 Background and Related Work Android web browsers, finding that more than half, in- cluding versions of Baidu and UC Browsers were vul- The application’s developers are the three biggest tech- nerable to attackers gaining access to personal user data nology companies in China, collectively dominating the stored on the device. Similarly, Wu and Chang [26] online search, social media and e-commerce fields [27]. find that Android versions of QQ and Baidu Browsers Baidu’s search engine dominates the Chinese market in are vulnerable to attacks which could compromise pri- the absence of Google, having captured 70% market vate user data. Ma [14] finds that vulnerabilities with UC share and recording over 660 million mobile monthly Browser’s integration of Alibaba’s search engine Shenma search users in March 2016 [2]. Tencent operates two caused the active user sessions for a number of popular of the world’s largest communications platforms, with Chinese social media sites to be cached by the search en- QQ Instant Messenger having 853 million users and mo- gine, allowing anyone to gain access to user accounts. bile messenger WeChat/Weixin having 697 million active Liu and Wang [13] use automated methods to identify monthly users [24]. Alibaba operates a number of the the leakage of personal data in popular Chinese Android largest e-commerce sites in China, including Taobao and apps, confirming Dalek et al.’s earlier findings [5] about TMall, which have over 367 million active shoppers [7]. leakage in UC Browser via a hard-coded AES key. Combined, the companies operate five of China’s top seven most visited websites [1]. 3 Technical Analysis Definitive estimates of the market share of these three browsers are difficult to obtain. Of the three browsers ex- Our analysis includes both Android and Windows ver- amined, UC Browser is by far the most popular, ranking sions of Baidu Browser, QQ Browser, and UC Browser. as the most popular mobile browser in China, India and In total, we examined 11 different versions, as summa- Indonesia [20], and is by some estimates the second most rized in Table 1. popular mobile browser in the world [21]. While some es- We found that each version of the browsers we ana- timates report QQ and Baidu Browsers as the second and lyzed collected personally identifying information such third most popular mobile browsers in China [4], others as hardware serial numbers. Many also transmit loca- put their combined market share at less than 10% [21]. tion information such as GPS coordinates or nearby WiFi The insecure transmission of personal user data and networks, and most track the full URLs of pages viewed, potential for the execution of arbitrary code in these ap- even if the pages were originally retrieved via HTTPS. plications are not merely hypothetical concerns. Docu- We also found that each version of the browser trans- ments leaked by Edward Snowden show that western in- mitted this data via easily decryptable encryption. By telligence agencies had, as far back as 2012, identified this we do not mean that the encryption algorithm used is information leakage vulnerabilities in UC Browser and itself insecure (although in many cases it is). Instead we successfully used them to design an XKeyscore plugin to mean that the encryption is entirely symmetric and uses surveil users of the application [6]. hard-coded keys. Since the algorithms are not asymmet- 2 Browser (O/S) PII Location Activity Data point Type Encryption Baidu Browser (W) X X IMEI PII Easily decryptable Baidu Browser (A) X X X GPS coordinates Location Not encrypted QQ Browser (W) X X In-range WIFI Location Easily decryptable QQ Browser (A) X X X access points UC Browser (W) X X Search terms Activity Not encrypted UC Browser (A) X X Full HTTP(S) Activity Not encrypted URLs Table 2: Whether the latest version of each Chinese- language browser was found to leak a user’s personally Table 4: Data leaks in version 6.2.18.0 of Chinese- identifiable information, location, or browser activity; language Baidu Browser for Android (W) refers to Windows version, (A) refers to Android ver- sion MCBC+MTEA algorithm, and the downloaded binary is Data point Type Encryption only verified using MD5 hashes, not digital signatures.