Cross posted from: https://beehaw.org/post/13390116

Typing logographic languages such as Chinese is more difficult than typing alphabetic languages, where each letter can be represented by one key. There is no way to fit the tens of thousands of Chinese characters that exist onto a single keyboard. Despite this obvious challenge, technologies have developed which make typing in Chinese possible. To enable the input of Chinese characters, a writer will generally use a keyboard app with an “Input Method Editor” (IME).

Almost all keyboard apps used by Chinese people around the globe share a security vulnerability that can be exploited to to detect what users are typing, researchers at the Citizen Lab, a technology and security research lab affiliated with the University of Toronto, have found.

Acvording to Citizen Lab, the keystroke data that these apps send to the cloud to be intercepted, has existed for years and could have been exploited by cybercriminals and state surveillance groups.

“Our analysis revealed critical vulnerabilities in keyboard apps from eight out of the nine vendors in which we could exploit that vulnerability to completely reveal the contents of users’ keystrokes in transit,” a new report says, adding that “most of the vulnerable apps can be exploited by an entirely passive network eavesdropper”.

Combining the vulnerabilities discovered in this and our previous report analyzing Sogou’s keyboard apps, Citizen Lab estimates that up to one billion users are affected by these vulnerabilities. “Given the scope of these vulnerabilities and the ease with which these vulnerabilities may have been discovered, it is possible that such users’ keystrokes may have also been under mass surveillance,” the report says.

In their report, the researchers analyzed the security of cloud-based pinyin keyboard apps from nine vendors: Baidu, Honor, Huawei, iFlytek, OPPO, Samsung, Tencent, Vivo, and Xiaomi.

We examined these apps’ transmission of users’ keystrokes for vulnerabilities.

In eght out of the nine vendor, the researchers could exploit the vulnerability to completely reveal the contents of users’ keystrokes in transit, the only exception being a phone by Huawei.

Having the capability to read what users type on their devices is of interest to a number of actors — including government intelligence agencies that operate globally — because it may encompass exceptionally sensitive information about users and their contacts including financial information, login credentials such as usernames or passwords, and messages that are otherwise end-to-end encrypted.

  • Zworf@beehaw.org
    link
    fedilink
    arrow-up
    77
    arrow-down
    1
    ·
    edit-2
    7 months ago

    This is something that the amazing Naomi Wu brought up for years before, and was ordered to stop publishing by the local government. It was about the same thing. It’s sometimes misrepresented as being about Signal, but her point was: There’s no point in using a secure messaging app like Signal if your keyboard (IME) leaks everything you write! So she was making the exact same point as in this article.

    I really miss her content. 😢

    • CanadaPlus@lemmy.sdf.org
      link
      fedilink
      arrow-up
      4
      ·
      7 months ago

      Given that they explicitly ruled out interception at the cloud endpoint in this report, maybe? Then again, it could be a way of getting at it in situations where the server isn’t totally compromised.

    • CanadaPlus@lemmy.sdf.org
      link
      fedilink
      arrow-up
      9
      ·
      edit-2
      7 months ago

      From the article:

      Because of the complexities of predicting which characters a user may want to type next, especially in logographic languages like Chinese, IMEs often offer “cloud-based” prediction services which reach out over the network. Enabling “cloud-based” features in these apps means that longer strings of syllables that users type will be transmitted to servers elsewhere.

    • Melkath@kbin.social
      link
      fedilink
      arrow-up
      6
      ·
      7 months ago

      Because the world has long since surpassed far beyond 1984 levels of spying on unsuspecting innocent civilians.

    • milicent_bystandr
      link
      fedilink
      arrow-up
      5
      ·
      7 months ago

      Essentially for predictive text: to make it easier to give good Chinese character suggestions when typing in Pinyin.

    • esaru@beehaw.org
      link
      fedilink
      arrow-up
      1
      ·
      7 months ago

      Keyboards for typing Chinese can work completely without Internet connection. There’s one in the F-Droid store: Guileless Bopomofo.

    • beefcat@beehaw.org
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      7 months ago

      Given that the FBI’s targets probably don’t type in Chinese or other logographic languages very often i doubt they care.

    • Melkath@kbin.social
      link
      fedilink
      arrow-up
      5
      ·
      7 months ago

      As long as you ensure a US based entity is spying on you with it, and not a China based entity, then no.