Reuters yakaburitsa chinyorwa cheyambiro kuti hofori yeChinese Xiaomi iri kurekodha data remamiriyoni evanhu nezvezviitiko zvavo zvepamhepo uye mashandisiro emidziyo. "Iko kuseri kwekushanda kwefoni," akadaro Gabi Cirlig, nehafu-anoseka, nezve yake nyowani Xiaomi smartphone.
Uyu ane ruzivo muongorori wecybersecurity akataura naForbes mushure mekuona kuti yake Redmi Note 8 smartphone yaive yekusora pane zvese zvaaiita. Iyi data yakabva yatumirwa kumasevha ari kure anogarwa neimwe Chinese tech giant Alibaba, angangove akarendwa naXiaomi.
Mr Kirlig vakaona kuti huwandu hunokatyamadza hweruzivo nezve maitiro ake hwaiteverwa apo marudzi akasiyana-siyana edatha akatorwa panguva imwe chete kubva kumushini - nyanzvi yakatya kuti ruzivo rwekuzivikanwa kwake uye hupenyu hwepachivande hwainyatsozivikanwa kukambani yeChinese.
Paakatsvaga mawebhusaiti mune yakasarudzika Xiaomi browser pachishandiso, iyo yekupedzisira yakanyora ese mawebhusaiti akashanyirwa, kusanganisira mibvunzo kubva kune yekutsvaga injini, ingave Google kana yakavanzika-yakatarisana DuckDuckGo, uye zvese zvinhu zvinoonekwa munhau feed yeXiaomi shell yaive. zvakare akarekodhwa. Uyezve, kuongorora kwese uku kwakashanda kunyangwe iyo "incognito" modhi yakashandiswa.
Chishandiso chakarekodha kuti maforodha akavhurwa, izvo zvidzitiro zvakashandurwa, kunyangwe zvasvika kune iyo mamiriro bar uye peji rezvigadziriso zvechishandiso. Yese data yakatumirwa mumabheti kumaseva ari kure muSingapore neRussia, kunyangwe mawebhusaiti ewebhu akanyoreswa muBeijing.
Pakukumbira kwaForbes, mumwe muongorori wecybersecurity, Andrew Tierney, akaita ongororo yake. Akaona zvakare kuti mabhurawuza anopihwa neXiaomi paGoogle Play - Mi Browser Pro uye Mint Browser - inounganidza iyo data yakafanana. Zvinoenderana nehuwandu hweGoogle Play, pamwe chete vakaiswa kanopfuura mamirioni gumi nemashanu, zvichireva kuti mamirioni emidziyo anogona kukanganiswa.
Matambudziko, maererano naVaKirlig, anoshanda kune nhamba yakawanda yemhando. Akadhawunirodha firmware kune mamwe nhare dzeXiaomi, kusanganisira iyo Xiaomi Mi 10, Xiaomi Redmi K20 uye Xiaomi Mi MIX 3, asati asimbisa kuti vanoshandisa yakafanana browser uye vangangove vachitambura nenyaya dzakafanana dzekuvanzika.
Ikoko kunoratidzika kunge kune matambudziko nenzira iyo Xiaomi inotamisa data kumaseva ayo. Kunyangwe iyo kambani yeChinese ichiti iyo data yakavharidzirwa, Gabi Kirlig akaona kuti anogona kukurumidza kuona zvakatorwa kubva pachigadzirwa chake nekuti encryption inoshandisa yakapusa base64 algorithm. Zvakangotora masekonzi mashoma kushandura mapaketi edata kuita zvidimbu zvinoverengwa zveruzivo. Akayambirawo kuti: "Chandinonyanya kunetseka pamusoro pekuvanzika ndechekuti data inotumirwa kumasevha ari kure inobatanidzwa nyore nyore nemushandisi chaiwo."
Mukupindura zvakawanikwa nenyanzvi dzakataurwa, mutauriri weXiaomi akati zvichemo zvekutsvagisa hazvisi chokwadi, uye kuvanzika uye kuchengetedzeka kwakakosha zvakanyanya, uye kambani inoomerera uye inoteedzera zvizere mitemo yemuno nemirairo ine chekuita nenyaya dzekuvanzika kwevashandisi. . Asi mutauriri akasimbisa kuti data rekubhurawuza riri kuunganidzwa, achiti ruzivo urwu haruzivikanwe uye haruna kusungirirwa kune chero munhu, uye vashandisi vanobvumirana nekutevera kwakadaro.
Asi sekutaura kwaGabi Kirlig naAndrew Tierney, yanga isiri iyo ruzivo nezve mawebhusaiti akashanyirwa kana kutsvaga paInternet kwakatumirwa kune sevha: Xiaomi yakaunganidzawo data nezve nhare, kusanganisira nhamba dzakasiyana kuti dzione imwe mudziyo uye shanduro yeAroid. Metadata yakadai inogona kuwiriraniswa zviri nyore nemunhu chaiye kuseri kwechidzitiro kana ichidikanwa.
Mutauriri weXiaomi arambawo zvirevo zvekuti data rekubhurawuza riri kurekodhwa mune incognito mode. Nekudaro, vaongorori vezvekuchengetedza vakawana muyedzo yavo yakazvimirira yekuti maitiro avo epamhepo anotumira mameseji kumasevha ari kure zvisinei nekuti browser iri kuita modhi ipi, ichipa ese mafoto nemavhidhiyo sehumbowo.
Vatori venhau veForbes pavakapa Xiaomi vhidhiyo inoratidza matsvagiro eGoogle uye kushanya kwewebhusaiti kwakatumirwa kumasevha ari kure kunyangwe ari incognito mode, mutauriri wekambani akaramba achiramba kuti ruzivo rwacho rwakarekodhwa: "Vhidhiyo iyi inoratidza kuunganidzwa kwedata risingazivikanwe rekubhurawuza. ndeimwe yesarudzo dzinowanzoitwa nemakambani epaInternet kuvandudza ruzivo rwekubhurawuza kuburikidza nekuongorora ruzivo rusingazivikanwe nemunhu."
Nekudaro, nyanzvi dzezvekuchengetedza dzinotenda kuti maitiro ebrowser yeXiaomi ane hukasha kupfuura mamwe mabhurawuza anozivikanwa seGoogle Chrome kana Apple Safari: iwo ekupedzisira haarekodhe maitiro ebrowser, kusanganisira maURL, pasina mvumo yemushandisi uye mune yakavanzika nzira yekubhurawuza.
Mukuwedzera, mukutsvakurudza kwake, Mr. Kirlig vakaona kuti mimhanzi inoridza pre-yakaiswa pa Xiaomi smartphones inounganidza ruzivo pamusoro pemaitiro ekuteerera: nziyo dzipi dzinoridzwa uye rinhi.
Gabi Kirlig anofungidzirawo kuti Xiaomi iri kutarisa kushandiswa kwesoftware nekuti pese paanovhura maapplication, ruzivo rudiki runotumirwa kune server iri kure. Mumwe muongorori asingazivikanwe akataurwa neForbes akati akanyorawo kuti nhare dzekambani yeChinese dzakatora sei data rakafanana. Xiaomi haana kutaura nezvenyaya iyi.
Iyo data inonzi inotumirwa kuChinese analytics kambani Sensors Analytics (inozivikanwawo seSensors Data), iyo yakavambwa muna 2015 uye inobatikana mukuongorora kwakadzama kwemaitiro evashandisi uye nekupa hunyanzvi hwekubvunza masevhisi. Zvishandiso zvayo zvinobatsira vatengi kuongorora data yakavanzika nekuongorora maitiro akakosha. Mutauriri weXiaomi akasimbisa hukama nekutanga: "Kunyangwe Sensors Analytics ichipa mhinduro ye data analytics yeXiaomi, data rakaunganidzwa risingazivikanwe rinochengetwa pamasevha eXiaomi uye harizogovaniswa neSensors Analytics kana chero mamwe makambani echitatu."
Source: 3dnews.ru