MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

https://gist.github.com/interpiduser5/547d8a7baec436f24b7cce89dd4ae1ea

by interpidused • 5 months ago

320 142 5 months ago

gist.github.com

I only run software from Chinese companies inside a sandbox, either on my Android/iOS phone or inside a VM for desktop apps and only enable necessary permissions. Unfortunately Mainland tech giants have no sense of user privacy and would like to maximize their profit by collecting every single bit of your data because they don't profit on selling you the software, they profit on selling your data.

cwel• 5 months ago

Chinese mainland or mainland US?

nerdsniper2• 5 months ago

China mainland. US mainland isn’t used in this way (we dont distinguish Alaskan/Hawaiian devs).

Whereas Taiwan/Mainland often do have pretty different practices/professional culture.

rorychatt• 5 months ago

Yes

djtango• 5 months ago

How do you sandbox on mobile? I can't say I love having various apps like wechat on my phone...

brendyn• 5 months ago

Separate grapheneos accounts for everything does that I believe

charcircuit• 5 months ago

Every app is sandboxed by default.

nerdsniper2• 5 months ago

Secure Folders on Samsung. Multiple user profiles on Pixels/AOSP.

Crestwave• 5 months ago

I quite like Shelter [1]. Shelter apps are installed in a separate work profile, which essentially sandboxes it from the rest of your data. It also has a neat feature to automatically disable (freeze) specific apps and seamlessly re-enable them when you launch them through Shelter.

[1] https://github.com/achalmgucker/Shelter

hsbauauvhabzb2• 5 months ago

Unfortunately Mainland tech giants have no sense of user privacy and would like to maximize their profit by collecting every single bit of your data because they don't profit on selling you the software, they profit on selling your data

/s/Mainland//

FTFY.

largbae• 5 months ago

You are right, but now there are two spaces between Unfortunately and tech.

plagiarist• 5 months ago

You really have to put everything in a box nowadays. Companies are indiscriminate. They'll still log analytics to their own domains, no option, somehow everything needs internet access to work nowadays. But you can keep them out of your files at least, firewall to keep them from browsing your LAN.

SV_BubbleTime• 5 months ago

You really have to put everything in a box nowadays.

What if that was always a good idea.

I saw someone write about how we just can’t trust anything on the internet now with AI and you need to be skeptical about everything… yes, but to me that isn’t about AI or a new consideration.

nandomrumber2• 5 months ago

I recently downloaded the Soundcloud app for the first time on this iOS device and it said something along the lines of:

By continuing you agree to us sharing your data with our 954 partners…

raincole3• 5 months ago

Yeah and that means the data that you share with Soundcloud.

It's very different from:

ps aux # Every running process with full arguments

If you think these two cases are even remotely comparable, I don't know what to tell you.

pibaker• 5 months ago

Shits like this is what makes me wary about Chinese made video games proliferating in the west. You never know if your kid's genshing impact or black myth wukong is listening to you and siphoning all data on your local network to China.

A competent Western administration would have banned it all years ago. But instead of securing the future of Western civilization, they want detente and cheap plastic goods instead. Shrug.

jesterson6• 5 months ago

is listening to you and siphoning all data on your local network to China.

How is it any different from western apps listening to you and siphoning all data on your local network to 3 letter agencies?

tatersolid• 5 months ago

[citation needed]

Please stop with the hyperbole. Shit is bad enough; more fake news from any direction doesn’t help.

inventor77774• 5 months ago

I hear this theory being claimed so much, but I don't see any real evidence for it; we have routers that you can monitor traffic on, we have microphone use indicators on mobile, and I would imagine it would be pretty clear if an app was uploading audio with even very basic monitoring tools. Correct me if I'm wrong, however.

I'm not denying that a lot of data is likely surreptitiously collected, but I'm talking microphone/camera in particular.

debazel• 5 months ago

There's a massive difference between having a country spying on it's own citizen versus having an adversarial country doing it. The three-letter agencies would likely not be trying to sabotage or destroy their own country's economy and global standing for one.

anonym294• 5 months ago

The difference is that the Chinese intelligence agencies abide by Chinese law and don't really pose any kind of threat to American citizens, while the American intelligence agencies engage in unconstitutional schemes (as ruled by a federal judge) to illegally spy on Americans and lie about it to both congress and the American people, murder American citizens, and can, at any moment they want, fabricate evidence to procure no-knock search warrants where a team of armed gunmen will throw flashbang grenades into the homes of journalists and political dissidents in the middle of the night before barging in with assault rifles.

And yet, for reasons that remain beyond me, many Americans remain more fearful of the former than that latter.

gruez5• 5 months ago

How is it any different from western apps listening to you and siphoning all data on your local network to 3 letter agencies?

Examples?

jamesnorden• 5 months ago

More than one thing can be bad at once.

thenthenthen2• 5 months ago

The new Delta Force is made in China nowadays and apparently scans your whole hdd (for anti cheat).

wiseowise3• 5 months ago

For security, yo.

Pay084• 5 months ago

Isn't that somewhat common in AC software?

ddtaylor• 5 months ago

It's even worse now with cheating creating the world of Kernel Level Anticheat (KLAC) who knows what they are doing! A dream for someone who wants to move laterally through a network, probe, etc.

ponector2• 5 months ago

But non-chinese game listening and siphoning all your data is ok.

brachkow• 5 months ago

Epic Games partially owned by Tencent and already was caught of including spyware [0][1] in their launcher, but “Tim Sweeney is the anti-corporate robinhood who will dismantle hegemony of Valve and Apple” is very popular narrative on every western tech site

[0] https://news.ycombinator.com/item?id=19394399

[1] https://www.reddit.com/r/PhoenixPoint/comments/b0rxdq/epic_g...

gruez5• 5 months ago

Epic Games partially owned by Tencent and already was caught of including spyware [0][1] in their launcher,

Your sources for that claim is a bit underwhelming, given that epic apparently (?) doesn't upload any information without explicit user consent.

apublicfrog2• 5 months ago

You never know if your kid's genshing impact or black myth wukong is listening to you and siphoning all data on your local network to China.

Don't be ridiculous, all that garbage is VLAN'd off, and my router has strict firewall logging for any suspicious outbound traffic.

I'm sure I can trust my Chinese made router to handle this safely for me.

antonyh• 5 months ago

This is why I don't mix work and play and have a dedicated machine for games, but this only solves half the problem. It really needs it's own VLAN or to use 'guest' wifi to keep it isolated, but that only solves half the remaining problem. Two easy steps to get to 75% solved, but still leaves a high-powered machine connected to the internet that could be abused, can still listen on bluetooth and enumerate wifi (precise geolocation), and so on. At least this way it's only online for a few hours a day at most. It's the most I can do without investing serious time trying to block state-level intrusion in a battle I can never win.

jeffwask• 5 months ago

A competent Western administration

...because they have done so well with X, Meta and etc doing exactly the same thing.

1vuio0pswjnm72• 5 months ago

If was open source then could remove the reconnaisance

userbinator• 5 months ago

Source code is neither necessary nor sufficient.

All you need is the ability to edit any byte on your hard drive. ;-)

1vuio0pswjnm72• 5 months ago

Generally, I dont use a hard drive

I run programs from RAM (mfs and/or tmpfs)

blahgeek• 5 months ago

I would always refer to Hanlon's razor on things like this: Never attribute to malice that which is adequately explained by stupidity. I'm not trying to finding excuses for them, just saying that most likely there's no deep conspiracy theory involving government level surveillance here, they are just stupid. On average, Chinese software engineers are less educated and have no sense about privacy or how to implement privacy related features properly.

thenthenthen2• 5 months ago

Privacy is a totally different concept in China, this becomes very clear once you visit a public toilet in Beijing’s Hutongs.

inventor77774• 5 months ago

While logging serial number and some of the basic analytics stats might be attributed to stupidity, I tend to think that using a pretty advanced set of system commands and logging output consistently to log files is very sketchy.

TheDong• 5 months ago

One possible stupid-but-not-malicious explanation is that some anti-cheat company made a sketchy anti-cheat that includes server-side "is CheatEngine.exe running" code, and they're doing that via ps aux... and then this game player app was bullied by some game company into including this anti-cheat library to allow their game to run.

phantomathkg• 5 months ago

This only reinforce the image, software/hardware from China and no ethics. They will do whatever they can to get hold of their user's info.

jimmydoe• 5 months ago

This is ugly and bad.

Meanwhile they do tell you they collect everything

https://www.mumuplayer.com/privacy-policy.html

Not to defend them, but just feel sad about the world.

wildzzz2• 5 months ago

"other network/technical information" is pulling a lot of weight there.

nerderloo• 5 months ago

Where does in that webpage say they're collecting output of `ps aux`?

uni_baconcat• 5 months ago

I think it's this part:

(3) In order to ensure account security, identify and prevent malicious programs, and create a fair, healthy and safe environment, we will collect your device identifier information, product identification information, hardware and operating system information, installed application list, application process and product crash record information during your use of the service, including during the background operation of the application, so as to combat acts that damage the product environment or interfere with the normal operation of the product service.(Used to detect piracy, scan cheating programs or software, prevent cheating).

supersing• 5 months ago

It still surprises me that such behavior is still allowed on modern macOS, which is supposed to be privacy focused. What’s the point of having an app sandbox when it is opt-in?

spartanatreyu• 5 months ago

MacOS is not privacy focused, it's marketing focused.

Specifically: can we market this [feature/change/refusal/etc...]?

raincole3• 5 months ago

I've never heard people describe macOS as 'privacy focused.' Perhaps copywriting from Apple itself?

iOS maybe. macOS no.

altairprime• 5 months ago

This is why I run educational software (and VMware’s edusoft remote VM client) in native Mac VMs. Not surprised to see someone trying to abuse data harvesting from another country, too. Perhaps a report to Apple Security might be in order, to let them evaluate whether it’s an RCE/CNC scenario (we only have the telemetry detected so far!) and whether it deserves a malware kill worldwide. Though I’m surprised it’s allowed to access all those properties without a Permissions dialog. Maybe this will inspire Apple to finally let us deny Discord its system-wide data collection activity!

ps. UTM.app is a nice way to sandbox Discord, since it’s using the OS-level sandbox already in a way that prevents us from limiting it further with a .sb file. Takes some extra space, I suppose.

ziml772• 5 months ago

I'm a little wary of believing this without confirmation. It certainly sounds like something an app from a big Chinese company might do, but the LLM writing style with em-dashes replaced by double hyphens looked like someone trying to hide that they use an LLM. And I noticed that the account for the Gist submission is only 3 hours old. And then looking here the account on HN is also only 3 hours old. Seems a little sketchy to me.

wiseowise3• 5 months ago

Totally, Chinese software would never do anything like that. Shocking news, I say, shocking!

ziml772• 5 months ago

I didn't disagree with that?

"It certainly sounds like something an app from a big Chinese company might do"

Doesn't mean I want to blindly trust a random source about it though.

ra• 5 months ago

years ago everyone used a personal firewall called "little snitch" that would make this behaviour visible. Do we trust OS supplied security too much?

raincole3• 5 months ago

Every time a Chinese company does something like this, the comment section is always "but the US companies..." or slightly soften version "but all tech companies..." It's so predictable.

dakolli• 5 months ago

because its true lol

apublicfrog2• 5 months ago

Now, why do you think that might be?

shevy-java• 5 months ago

I think people who create such spy-software need to go to prison for +10 years mandatorily. CEOs who are involved here should go to prison as well.

ILoveHorses• 5 months ago

I am curious how the author of the GitHub gist managed to figure all this out. Any ideas?

halapro• 5 months ago

You can use fsevents to see which apps write where and firewalls will tell you which app is connecting to the internet.

Grisu_FTP• 5 months ago

This is why im always feeling bad when putting mobile versions of games i love made by netease on my phone. Where i felt especially bad was Dead by Daylight mobile. Persona 5X is not made by NetEase but i still dont have a good feeling about them.

I would think they would be more restricted in what they can collect on a Phone OS (android in my case) but i still wonder if there is some way to fully isolate shady apps.

andrewstuart• 5 months ago

Don’t feel bad.

Enjoy the games and feel good.

eks3912• 5 months ago

Look into GrapheneOS. Or Calyx

n0n0n4t0r• 5 months ago

I see a lot of discussions about government level spying, this is a legitimate debate, but it mustn't obscure the "boring" security threat storing the results of ps aux poses! This is security 101 to never store this kind of information. I mean a bad actor now just has to (gain) access to these files!

I mean besides the theorical high level threat, there is a very practical one maybe sufficient for suing the company if it was a western one (I don't work in legal, I don't know what I'm saying)

nottorp2• 5 months ago

But how is that different from your usual SaaS using 3 kinds of intrusive analytics packages at the same time?

maxglute2• 5 months ago

Android emulator used by Chinese gamers for competitive online games have anticheat, news at 11.

mangogogo• 5 months ago

yeah like… no shit?

_slih• 5 months ago

the gist author being new and the writing looking polished doesn't change that the log files are right there on disk for anyone to verify. ls the directory and read the output yourself.

sunaookami• 5 months ago

the writing looking polished

it's AI slop. And they obviously collect the Mac hardware ID because the emulator is DRM'd and the license & trial is bound to your HW ID.

MuMu Player (NetEase) silently runs 17 reconnaissance commands every 30 minutes

Related Stories