China's top Android phones exfil significant data without consent - Mobile Privacy Briefing 2023.104

If you’re in the market for a new Android device and value your privacy, avoid purchasing it in China! While this is not likely for most folks following my content, it was eye opening to see just how much data is exfiltrated from mainland China devices.

I first came across this research in an article by The Register titled “Surprise! China’s top Android phones collect way more info”.

The researchers on the paper include Haoyu Liu (The University of Edinburgh), Douglas J. Leith (Trinity College Dublin) and Paul Patras (The University of Edinburgh). They tested 3 Android devices purchased in China and found that they have 3-4 times the number of preinstalled 3rd party apps (generally difficult or impossible to uninstall) and they have 8-10 times as many permissions.

Data that observed being transmitted included:

  • IMEI
  • Call/SMS history/time
  • Contact phone numbers
  • MAC address
  • GPS coordinates
  • Mobile network cell ID
  • Phone number
  • App usage patterns
  • App telemetry

and more. They state:

“Combined, this information poses serious risks of user deanonymization and extensive tracking, particularly since in China every phone number is registered under a citizen ID.”

Here’s one of the data flows whenever certain preinstalled apps are used:

POST https://tracking.miui.com/track/v4
{ "imsis": "[b2d5c6783e3fa6eef38ff1fc7dedfb10,]",..,
{"pkg": "com.xiaomi.smarthome","action": "
first_launch", "fit": 1666816796000, ...},
{"pkg": "com.android.settings","ts": 1666818456958,"
duration": 1424, ...},
{"pkg": "com.miui.securityinputmethod","ts":
1666818463544,"duration": 4706, ... },
{"pkg": "com.miui.notes","ts": 1666818784908,"stat":
"app_start",...}...}

None is this is likely shocking to folks as China is consistently ranked the most surveilled country in the world.

Devices tested

Details on the three devices tested:

  • Xiaomi Redmi Note 11 with Android 11/MIUI 12.5.4.0 RGBCNXM
  • OPPO Realme Q3 Pro with Android 11/realme UI v2.0 RMX2205_11_A.13 (based on ColorOS 11)
  • OnePlus 9R with Android 11/ColorOS 11.2 LE2100_11_A.05.