The Chinese Communist Party published an app called "Studying the Great Nation" earlier this year which it strongly advertises and also allows many citizens to use. Although at first glance it looks like a simple propaganda tool and seems to act as a news and factual resource for Chinese President Xi Jinping and his party, it seems designed to monitor its users and even sport the back door of a super door like the can use to collect more information.
With the country's extensive human rights violations in mind, Open Technology Fund instructed German security research firm Cure53 to review the product developed by Alibaba. The first obstacle the researchers encounter can already be read as proof of the app's unspoken intentions: The code is equipped with anti-reversing techniques. Cure53 causes it to be likely that there are more harmful or curious instructions hidden behind this unusual coding practice than the company could find among the decrypted parts of the app.
The evidence that the security researchers found found is significant enough, though. Some "code that resembles a backdoor" gives the app superuser permission. Although Cure53 states that "no evidence of use could be identified during this test and further investigation is required", an app like this should have no root access company. Obviously, Alibaba is not only involved in maintaining the app itself but was also commissioned to build the back door, since the company name is in the respective code.
Additional evidence includes file transfer of user data and information on the device, intentionally weak cryptographic algorithms for login and personal data, and similarities to other Chinese spy apps. You may argue that the former is for statistical purposes only, but in combination with other evidence it should set up some alarm bells.
The results are not surprising for a country that does not value integrity in any form. The app is not in the Play Store; It is only officially available in China and is only aimed at its citizens, but since Alibaba is an internationally operating company, some scrutiny by regulatory authorities abroad can lead its way.
Image: Hanson Lu on Unsplash