China's social network surveillance databases are apparently leaked to Internet

https://twitter.com/0xDUDE/status/1101917885100945409

by stevefan1999 • 7 years ago

369 96 7 years ago

techie128• 7 years ago

sigh

I don't condone surveillance. It is a reality of life. However, I would expect that it is done responsibly and securely. I don't consider surveillance a big violation BUT doing a poor job at protecting the collected data is an egregious violation of privacy.

mirimir• 7 years ago

Why?

Who will hurt you more than authorities can?

trsfgbb• 7 years ago

ummonk• 7 years ago

In the case of the US, the government is bound by due process, at least theoretically, which makes it far less likely to hurt me than private entities.

Granted, that may not be the case when it comes to China.

stunt• 7 years ago

Well, perhaps the fact that you justify surveillance is mostly the result of what those organizations have done around the world.

simonh• 7 years ago

The only reason to collect data is to use it and those collecting and storing the data are fully responsible for how it is used. The reasons for collecting and retaining it should be explicitly stated and it should only be used for those purposes. It doesn't matter who is doing it - Facebook, Google, a random web site or a government.

Sniffnoy• 7 years ago

Non-mobile link: https://twitter.com/0xDUDE/status/1101917885100945409

dang2• 7 years ago

Fixed, thanks.

Laforet9• 7 years ago

From the screencaps it looks like surveillance systems used to monitor internet cafes and public access points where people must use their real ID to login, so it's a bit easier to link accounts to actual identities. A number of these IM suits are actually encrypted in transit that it's very unlikely that this level of interception is possible without a root certificate installed on the client machine.

ubercow13• 7 years ago

Couldn't this data be coming directly from these IM services' servers? I doubt any of them are E2EE.

Laforet9• 7 years ago

It's possible but I really doubt it, considering the sheer volume of message being generated every moment. It would be much easier and less likely to have hiccups like these if they just give them server access on demand, rather than having a live data feed replicated to 18 separate locations. Moreover the tweets actually show names and addresses of various internet cafes in one of the pictures. This information should not be available if the data is coming from the service provider's backend.

Contrary to popular opinion on HN and other forums in the Anglosphere, surveillance in China is a nuanced problem and tech companies are far from completely passive. Local police are often denied when they request information because technically they lack jurisdiction on companies located in a different town or province. As a result they resort to catch-all interception using devices like these makeshift DPI systems(there is no clear legal requirement, but internet cafe owners are easily coerced into installing them or risk having their business hut down over various infractions) and Stingray-like fake cell sites (a constant source of conflict with major telcos because they are often poorly installed and would interfere with normal cell sites).

These ad-hoc schemes are usually put together by the lowest bidder, so they tend to be horribly inefficient and insecure like what's been shown in this case. But to local LE it's still preferable to going dark, not to mention there is usually little accountability when their system breaks.

iflp2• 7 years ago

Public APs don't require ID for login. Only the IM services require ID.

Laforet9• 7 years ago

They require your phone number which is always tied to an ID.

Consultant32452• 7 years ago

It's my understanding that if you want to play ball in China, you have to give govt the keys to the kingdom.

Here's one article of apple doing this. I'm not meaning to pick on Apple here, but imo they're the most security/privacy conscious of the really big players, and they've caved.

https://www.theverge.com/2018/2/26/17052802/apple-icloud-enc...

amrrs• 7 years ago

Is there any research that proves the causal relationship between surveillance and crime rate ? I've been constantly shut up with this statement "Don't you want your country to be safe" when I talk about privacy intrusion by Govt .

notanum• 7 years ago

It's classified

setquk• 7 years ago

Based on this leak, probably not for long

_cs2017_3• 7 years ago

There's no convincing research that establishes causality on such complex sociological matters, since you can't create clean experiments, and observations are not useful since there are too many confounding factors.

However, you don't really need research on this, it's obvious that surveillance offers meaningful safety benefits. I think the problem some people have with surveillance is that its costs may outweigh its benefits.

For example surveillance can be used to shift political system in the authoritarian direction, by suppressing political opposition. It can be used to sustain inequality since it provides those with money or power a powerful leverage to entrench their positions. It can be used by corrupt officials and hackers to commit serious crimes (partly offsetting its crime reduction benefits). Finally, even if surveillance isn't abused, it can be uncomfortable to some people who just don't like being watched.

zAy0LfpBZLC8mAC2• 7 years ago

partly offsetting its crime reduction benefits

No, potentially outweighing them. There is no reason to think surveillance cannot enable more crime than it solves, and the more surveillance you have the more likely that gets.

Vinnl• 7 years ago

it's obvious that surveillance offers meaningful safety benefits.

Is it, though? As far as I know, most crime is of the "spur of the moment" type, decided on the stop, without much regard for the consequences. Thus, I'd expect more surveillance to be able to increase the odds of getting caught, but to not actually reduce the amount of crime.

I'd also be ware for increased surveillance to hamper the ability to correct "wrong" laws.

chii• 7 years ago

I do believe higher levels of surveillance will have higher levels of inhibition for petty crime.

But it will not inhibit white collar crime (such as corruption or fraud etc). It won't inhibit crimes of passion. And it won't inhibit premeditated crimes that require lots of planning and hardcore execution (like drug/human trafficking etc).

pishpash• 7 years ago

Apparently the appearance of surveillance was enough. "The cardboard cutout cop":

https://www.bostonglobe.com/metro/2013/08/10/the-cardboard-c...

knolan4• 7 years ago

I guess you could look at major European cities like London where CCTV is pervasive and other cities with considerably less.

It seems to me that most of the justification for surveillance systems is focused on edge cases, terrorism and paedophilia which are statistically unlikely of affect the vast majority of people.

If you watch some of the reality TV you see in UK about CCTV surveillance you’d think the county is suffering from a crime epidemic when in fact a lot of the situations are minor and often escalated by overly aggressive police officers interacting with uneducated angry drunk people.

Better social policy regarding education and alcohol would be the better solution.

tonyedgecombe• 7 years ago

If you watch reality TV then you aren't getting the facts.

peteretep2• 7 years ago

when in fact a lot of the situations are minor and often escalated by overly aggressive police officers

Do you have a citation for this?

ericdykstra• 7 years ago

If you watch some of the reality TV you see in UK about CCTV surveillance you’d think the county is suffering from a crime epidemic when in fact a lot of the situations are minor and often escalated by overly aggressive police officers interacting with uneducated angry drunk people.

I couldn't find London's murder rate further back than 1990 for some reason, but for England, the murder rate is higher now than it's been since at least 1900.

We don't know if CCTV surveillance, gun bans, and silverware purchasing restrictions have had an effect reducing violent crime, but at the very least it hasn't been enough to counter the increase.

Better social policy regarding education and alcohol would be the better solution.

I'm pretty skeptical that this would decrease violent crime and/or murders. Do you have any evidence for this?

raxxorrax2• 7 years ago

No expert on US law, but I think mass surveillance is illegal. So yes, there is a very direct connection between surveillance and criminality.

Cthulhu_2• 7 years ago

An argument can be made that any prevented crimes are not published, with the intent of lulling would-be criminals or terrorists into a safe sense of security - that is, that communicating via a certain platform is safe enough, not knowing the NSA is listening in.

And on the other hand, what makes you feel safer: no news at all, or "1000 potential terrorist threats thwarted through surveillance". The former is dull, but dull is good right? The latter is stressful on both sides, on the one hand that apparently there are at least 1000 terrorists active - and what about the ones they didn't catch - and on the other that the government is listening.

So that's my theory; if government surveillance is effective, it's kept under wraps so it remains effective.

viraptor• 7 years ago

An argument can be made that any prevented crimes are not published

Between the police fighting for funding, media fighting for content (Florida man), and police force for recognition (police posing with stashes of money/drugs/guns), I'm not sure there's much strategic hiding going on.

DanielBMarkham• 7 years ago

There are hidden assumptions in the question "Don't you want your country to be safe?"

What the question is really asking is this: "Don't you want your country to be safe no matter what?"

No, I do not. I want my country to be a place where I am proud of living. It doesn't have to be perfect, it just has to have traditions that are important to me that stay the same over time and try to get better over time.

I want my country to stay a place I am happy living in. I can live with some danger much easier than I can a surveillance state. Danger is a situation that is stable over time. Operating a panopticon is not.

The second premise is that it is possible to make some universal rules that will make everybody safe. Throughout history we have lots of examples of places where large groups of people were "completely" controlled. Modern prisons in the U.S. are a good contemporary example.

These places are not safe. In fact, the tighter we grip a population in order to make them safe, the more we create criminals who are part of the surveillance system itself. These criminals are in many cases impossible to discover. So now you have a lot of control and surveillance with criminals you can't identify or catch. The Chinese deal with this by every now and then sacrificing some of the party apparatchiks to the mob. The jury is still out on whether that actually works over several decades or not. I doubt it. But even if it did, it's still an unstable system.

Nations don't exist to extol one virtue over all others. "Safety" is a great thing, but it's not the end of the conversation when it comes to decision-making. It's a complex balance that should dynamically change over time as conditions force. When you systematize things like massive surveillance, you actually hurt the cause of public safety. It gets better for a short while -- then the rebound happens. And it's not pretty.

analog31• 7 years ago

Indeed, safety also has different aspects. You might be safer from getting mugged, but less safe from getting arrested and tortured, run over by a car, or from breathing polluted air and getting cancer. The same apparatus that makes people afraid to be muggers, will also make them afraid to point out abuses.

dqpb• 7 years ago

There are way more hidden assumptions than just "Don't you want your country to be safe no matter what?".

What's really happening when you agree to surveillance, is you're agreeing to give power in the form of information asymmetry to people you don't know. You assume those people will use that power for your benefit. In reality, there is very little guarantee that that's true - though there is some statistical likelihood that it's true.

At the end of the day, there is no such thing as law and order, no such thing as values and ethics, no such thing as society and civilization. All there really is is groups of people with varying levels of power and cohesion, varying overlap of shared interests, rather predictable human nature, and game theory. If you lose sight of that, you do so at your own peril.

ArrayList• 7 years ago

I must say this is the sort of quality comment that makes me come back to HN again and again. I've never been fully able to articulate why the "safety" argument is a farce, and I think you've done a cogent, lucid, commendable job here.

entity345• 7 years ago

Well, a policeman on the beat or patrolling in a car is surveillance.

Based on that surveillance does work.

The question is rather at what level surveillance does not meaningfully reduce crime anymore but becomes a (political) control tool.

wetpaws• 7 years ago

In my country I'm more afraid of police than of thugs, tbh

raxxorrax2• 7 years ago

I still differentiate between public and private spaces.

I do believe surveillance and the threat of surveillance does heavily undermine public trust in a society and its institutions and that this can be easily deduced by reasoning. Good thing trust is not an issue in 2019...

Ever wondered why so many constitutions around the world forbid surveillance?

I believe the studies about people becoming dumber...

chj• 7 years ago

We knew this all alone, but seeing the screenshot still turns my blood boiling. FK THEM

Scoundreller2• 7 years ago

And the most remarkable part is that this network syncs all this data to open MongoDBs in 18 locations.

Lol, again.

I recall in a previous list of open MongoDBs, the Chinese equivalent of the US Food and Drug Administration had an open MongoDB.

arthurcolle2• 7 years ago

is the _index key common to nosql dbs? looks like elastic at first glance, but i haven't used mongodb ever

Scoundreller2• 7 years ago

How typical is it for the Chinese to use English headers in their DBs?

Could this “solution” be off the shelf, or developed by non-Chinese?

The front-end users wouldn’t see the backend structure.

Along with some native English speaker names like “CertificateNo” for certificate number.

qlk1123• 7 years ago

As a non-latin language user, I can say that we do use English headers most of the time because nobody wants to deal with potential locale/coding problems.

est• 7 years ago

How typical is it for the Chinese to use English headers in their DBs?

very typical. because unicode table names or key names are rare.

arthurcolle2• 7 years ago

Where are these leaks available?

deckar01• 7 years ago

It sounds like the leak is just the mongodb instances being open to incoming traffic from the internet without authentication. This a common problem with MongoDB, because its default configuration is insecure.

throwawau3243• 7 years ago

I wonder if India's neighbor also engages in "our ability to arrest you proves our network is secure" tactic. Aadhar, the BS cattle-tagging project is premised on this principle, while they ship Indian citizens' information to Inqtel backed corporations ... because "it's nationalist" to do so.

virgakwolfw• 7 years ago

He will be a Hero of China in 21 century to save Chinese from communist party.

dang2• 7 years ago

Please keep political and ideological flamebait off HN. Ditto for nationalistic flamebait.

Sendotsh• 7 years ago

It's a copy/paste of one of the comments on Twitter. No idea to what purpose though.

https://twitter.com/xiaojianguo2013/status/11023946262191308...

mnemotechny• 7 years ago

But who need it?

rqs2• 7 years ago

The most dialogs which are being monitored are typical teenager conversations.

In the picture "你还用说我大", "那是衣服紧" (Translate: "You don't need to tell me that mines was big", "That's because the cloth is tight").

I don't know about the "typical" thing due to lack of context. But my sense tells me, that "teenager" is doing some sex talk.

Another one: "说:!收【【【46--48道士号】】】卖的微信XXXXXXXXXXX" ("Buying 46~48 level Taoist account, contact me using WeChat XXXXXXXXXXX"). I guess this person is trying to buy a in-game character. Taoist is a type of character similar to magician.

I think the message is captured by some type of Internet Cafe managing software, which can be installed on the machine so the admin could remotely control and "auditing" it. Typical feature includes shutdown, force logout, timer etc. I don't know it can also record chat messages, but the fact it can does not surprise me that much to be honest.

ep1032• 7 years ago

Where is this data? It sounds like they haven't disclosed it, just announced it?

rqs2• 7 years ago

I have no idea. Those messages I've quoted is from the Twitter page.

uses• 7 years ago

Just leaving aside for a second what a crime against humanity this surveillance is...

It never ceases to amaze me how many of these massive data leaks are simply "mongodb in default configuration".

I just don't understand how it was thought, at any point in time, to be a good idea that mongodb in its default configuration, would be open to the world with no authentication.

andrenth2• 7 years ago

That what happened when DevOps started to mean “we don’t need an ops team, the devs can do it”.

ep1032• 7 years ago

"we don't need dbas, the ops team can do it."

ressetera• 7 years ago

Who are the leakers and how easy would it be for the government to track them?

SZJX• 7 years ago

The opening statement of the author is really overblown and sensationalist. Only at the end of the thread did he admit that all data there apparently come from net cafes, but 1. there is no evidence that messages from private devices are being included in this database 2. one has to understand that China is vast, and each local authority differs a lot from the next one in deciding what it does. It totally wouldn't surprise me that the local authorities of several cities/provinces decided to sign a contract with this net cafe management software provider, who essentially installs a spyware on each net cafe computer and routes the traffic to the police. Doesn't suggest it's any sort of coordinated, deliberate action from the central government though. Comparing it to PRISM and NSA is highly misleading and irresponsible, and just putting a blanket word "China's" in the title is inaccurate. Sadly it's how most news stories are done these days.

China's social network surveillance databases are apparently leaked to Internet

Related Stories