5

I am not sure if this is the right area for the question, or if it is even a big deal, but here i go. When using by Nvidia tablet to develop an app I realized that it was attempting to reach a server in china. this doesn't make sense to me because I don't have any apps that I would think would try to do this. What I would like to know is if this is a security concern?

02-12 14:09:32.448  11220-11284/? E/sdkstat﹕ sdkstat send error++++++java.net.UnknownHostException: Unable to resolve host "hmma.baidu.com": No address associated with hostname
6
  • This shouldn't be a security concern. Some chinese app developers store their apps or data for them on that servers. Baidu itself is safe as well (neglecting the fact of copyright infringements) so everything is ok. Also your DNS seems to not have an address for that host (probably blacklisting it) so you stay even more secure. (And it comes from your SDK statistics process that tries to send data.) – GiantTree Feb 12 '15 at 21:17
  • 1
    I am still unsure about this. Do you think nvidia, apps use this domain. I dont really have anything on here but google apps, nvidia apps and the one I am working on. – Theyouthis Feb 12 '15 at 21:21
  • Depends on how you build your app. What process/app throws this error? If you know this you can easily determine why it is trying to connect to baidu. – GiantTree Feb 12 '15 at 21:24
  • That line in the code block is all I know about regarding the attempt to connect to baidu. Do you know how I can find this out using the information provided? Sadly I don't. – Theyouthis Feb 12 '15 at 21:28
  • If the process is still running (I suppose it does) then you can try to do a ps command in shell (adb shell) and search for that process id. I am not sure but I think the pid should be 11220 and the tid 11284 (pid = process id, tid = thread id) – GiantTree Feb 12 '15 at 21:33
1

You might want to read this February 2016 article at citizenlab.org.

Most relevant part of the article:

Leaks sensitive data on startup

Upon application launch, we observed Baidu Browser sending an HTTP POST request to https://hmma.baidu.com/app.gif

The body of this HTTP request is a gzipped JSON file. The JSON file contains a list of fields with various details about the phone and the user, some in plain text and others encrypted.

Unencrypted fields in the JSON file include:

  • o: the user’s operating system (e.g., “Android”)
  • n: Baidu Browser version number
  • w, h: width and height, respectively, of the screen in pixels
  • gl: GPS coordinates and time of last GPS update

Some fields are encrypted using AES+ECB with the hard-coded ASCII-encoded key h9YLQoINGWyOBYYk

and then Base64 encoded. These fields include:

  • dd: IMEI number
  • ii: a string containing the phone’s IMEI number written backwards and an MD5 hash of Android software version information
  • wl2: list of all in-range wireless networks and their MAC addresses and signal strengths

With knowledge of the hard-coded key, these fields can easily be decrypted. The source code for a python script for decrypting these fields is available here.

And then there's Baidu's response (PDF file hosted at citizenlab.org). They don't seem to see an issue in collecting this data, they just acknowledge that they need to improve their encryption:

Baidu endeavors to collect data in a way consistent with the highest standards of security and user privacy in the industry. We disclose our practices in our terms of service under privacy rights as detailed here (Chinese): https://www.baidu.com/duty/yinsiquan.html

We're grateful of Citizen Lab for being mindful of data security in transmission and we have already made substantial progress toward ensuring that any such transmission will be secure.

So citizenlab's article is probably no more describing what you can see on the net nowadays.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.