-2

China is forcing tourists to install text-stealing malware at its border.

Also, U.S. intelligence officials imply that Huawei, ZTE devices aren't safe for consumers (even in the West).

Some suggested avoiding Chinese phones:

Consider a scenario where you may use a Hauwei or KTE phone to have a conversation with a friend or a work colleague. It could be a discussion about a business deal, a programming project you’re working on, or important business meetings. You could inadvertently pass along proprietary information to a foreign government without even realizing it.

What global intelligence communities are hinting to the world is that there is enough evidence in their posession to warrant banning these phones from military bases and governments. Even if you don’t believe them, history has turned up enough wrongdoing by these companies to justify very real concern.

Avoiding phones made by Chinese manufacturers is a good start.

Assuming the accusers are correct, does the use of Android One, as is done by some Xiaomi phones, reduce the risk of OEM spying on you, or is Android One irrelevant here?

(There is a difference between trusting an American company, like Google, subject to US laws and regulations, and trusting a Chinese OEM)

  • 2
    Not at all. Android One makes it easy to get long term AOSP updates from Google. But after all device hardware and ROM is routed through OEMs, and they DO put a lot of stuff inside device. See /vendor partition on your device, those are all closed source binary blobs put by your OEM/SoC vendor. And then there are other firmware e.g. baseband processor (modem) which you never know what's doing in background, even when you think your device is powered off. And above all, Android One is a business deal between Google and OEM which makes sure every device has GApps; the legal way of spying. – Irfan Latif Oct 24 at 20:58
  • 2
    The China one is a special case due to their law. However, the question seems to become more biased to China instead of global case? – Andrew T. Oct 28 at 3:06
  • 1
  • 2
    The thing is you hear a lot of propaganda resonating around you against a country. Obviously when one is losing economic war, the frustration and anxiety is justified. But please be noted that there could be no difference between trusting an American company and a Chinese OEM for the whole world. – Irfan Latif Oct 28 at 8:18
  • 2
    -1: the question appears to be targeting Chinese practices, not recognizing that surveillance is not a Chinese problem only. – Death Mask Salesman Oct 29 at 21:30
5

You could inadvertently pass along proprietary information to a foreign government without even realizing it.

This holds true when a person is using non-Chinese communication or computing devices as well. Just because western economies are also democratic countries do not mean that those democratically elected governments or their intelligence agencies do not engage in the activities the Chinese national government and the Chinese companies are alleged with. Here, try this food for thought.

If you get hold of the book Permanent Record, its author mentioned one obvious but highly uncomfortable point: the internet, the computing and communication hardwares, and the softwares upon which the world runs at large are mostly US centric (whether developed in the US or by companies from the US), so it is natural for US govt and its agencies to make use of this monopoly for ends that may not necessarily be in public interest.

Let this be clear that this aggressive anti-China stance in technological matters is not precisely because of Chinese intrusive activities in civil and military affairs of the US and its nationals (this has been going on for a decade or more), but because China had the audacity and showed the capacity and the will to buy leading chipset and communication device manufacturers of the US, and China -- a non-Western, non-democratic, non-NATO country -- further frustrated the US by beating it in developing, testing, and marketing the 5G (the next revolution in communications that would bring unimaginable amount of data -- currency for tech companies and billions of dollars to a 5G leader's economy). If there continues to be demand for Chinese 5G products (either by individual consumers for cellphones or by telecom operators for 5G communication and relevant equipments) in the US, its national security would continue to be undermined1 by China, so it is natural for the US to create this anti-China fear among its people and beyond.

Assuming the accusers are correct, does the use of Android One, as is done by some Xiaomi phones, reduce this risk, or is Android One irrelevant here?

  1. If you do not have access to the source code of the software you are using;
  2. If you cannot understand that source code in entirety;
  3. If you do not have access to the blueprint (or whatever that is called) of the hardware you are using (including the software that is part of the hardware);
  4. If you do not have the skills and the means to detect hardware vulnerabilities or backdoors;

than you cannot have absolute control over your device. You risk unwillingly giving away your private information to a party you may not even know. Everything than rests on trust (that you would not be harmed and the data not be collected involuntarily or misused) and the mitigating measures that you can undertake within the flexibility provided by the software and the hardware.

At last, if you want to stick with some western technological products, do it, but know that you are trusting one potential adversary with another. It is all the same if you are not from the western world.

1: FCC to vote to bar Huawei, ZTE from government subsidy program, sources say

  • +1 true........ – Irfan Latif Oct 24 at 22:48
  • 1
    It's like saying "Don't bother being afraid of cigarettes, because you can be killed by a freak lightening strike at any moment. None are safe! Don't delude yourself or others" – MaxB Oct 25 at 3:43
  • @MaxB I was not trying to be condescending with my last sentence, and I apologize if it came out that way, but I am not a native English speaker so I am not good with articulation. Read my answer from the perspective of a middle eastern or a south Asian or an African. For them, it is all the same. As for the cigarettes analogy, this is not useful because some US or European products do give reasonable flexibility to take mitigative measures, but this hope is lost with Chinese ones. – Firelord Oct 25 at 8:22
3

AndroidOne can lower risk of spying due to vendor's negligence or non-systematic action (e.g., one employee adds some spying code without anyone else in the company knowing about that). The more modifications are there, the more places to inject some malicious modification and the more employees to care about.

You might argue that the vendor is just replacing the code from Google, so this is exchange of one potentially risky part for another part with the same risk. However, I would assume that the code from Google (especially the AOSP parts) get much more scrutiny both internally (within the vendor) and externally (by phone vendors and others).

When talking about some backdoors intentionally added (and probably approved by the management), AndroidOne cannot protect you. It might be harder to find a suitable place, but there always will be some:

  • There can be an additional app in AndroidOne. Nokia is known to add a controversial app for battery management. While this one is not known to be malicious, it shows that Android One can be less pure than you think.
  • The phone vendor can add some hardware-based backdoor.
  • The phone vendor can claim it is AndroidOne, while actually not fully being AndroidOne. This can be even obscured in some ways, so it is not noticable from the OTA update packages.
  • This makes sense, but I don't understand how Google can detect that the phone's been rooted, but it can not detect that the OS's been altered. – MaxB Oct 28 at 2:42
  • Google can detect root if you don't bother trying to hide it. Also, some apps need to use it, so you cannot hide root from all the apps. If the OS has been altered (especially altered by manufacturer), it can be virtually undetectable. – v6ak Oct 28 at 6:09
  • @MaxB @v6ak is right. You can't compare detecting the presence of /sbin/su binary or an alien magiskd process with detecting a modification to code where only kernel source is over 3 million lines. And why would Google detect that the OS is altered, OEMs are supposed to do alteration. Google only provides generic AOSP part, hardware-specific code is developed by respective vendors. – Irfan Latif Oct 28 at 8:57
  • @IrfanLatif Well, with AndroidOne, OEMs are not supposed to do alternations, although they can provide additional apps. It is designed for some specific SoCs, so Google likely also provides drivers. But let's suppose they cannot add any additional apps, so Google can try to check it. The OEM technically can provide their own kernel that hides some processes. And if Google tried to read the kernel, it could provide them the original kernel. So, this is not going to work for an OEM that decides to break it… – v6ak Oct 28 at 9:23
  • @v6ak Google likely also provides drivers? Really? If by drivers you mean kernel, then yes, that can be true. Kernel is meant to be open-source. But what about the userspace HALs which interface with AOSP code? Are OEM/SoC vendors providing the source for those proprietary binary blobs to Google? If no, how is HIDL going to work without alteration to AOSP's reference implementations for hardware e.g. RIL? Including closed source code to AOSP should be considered alteration by the intellectual owner of that code, irrespective of who is practically doing the alteration. – Irfan Latif Oct 28 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.