Baidudisclosureofusercodeisassignedtocollectdata:ImpactthousandsofapplicationsResearchpapersDownloadNews:BeijingFebruary24morningnews,accordingtoReuters,theresearchersfound,therearethousandsofapplicationsrunningBaiducodewillcollectusers’personalinformation,andsendittoBaidu,ofwhichMuchoftheinformationcaneasilybeintercepted.Totaldownloadsoftheseapplicationshasreachedhundredsofmillionsoftimes.CanadianCitizenLabresearcherssaidtheyfoundtheprobleminthedevelopmentofBaiduAndroidsoftwaredevelopmentkit,affected,includingBaidumobilebrowserandapplication,andtheapplicationofothercompaniesusethesesoftwaredevelopmentkitdevelopment.Baidu’sWindowsExplorerequallyaffected.CitizenLabresearcherslastyearfortheUCbrowserAlibabaraisedsimilarissues.Alibabahassincecorrectedtheseproblems,butBaidutoldReutersthatthecompany1willreviseencryptionvulnerabilitiesinitssoftwaredevelopmentkit,butwillcontinuetocollectuserdataandusedforcommercialpurposes,somedatasharedwiththirdparties.CitizenLabchiefresearcherJeffreyNuoKeer(JeffreyKnockel)beforetheconclusionofthestudyreleasedWednesdaysaidtheunencryptedinformationincludingtheuser’sgeographiclocation,keywordsearchandsitevisitrecords.Thisproblemindicatesthattheuserisdifficulttoknowwhichofyourphonedataiscollectedandsharedapplicationvendors,butiftheencryptionalgorithmisnotstrongenough,ornoencryptionalgorithm,andindeedtheriskofleakageofpersonaldataexists.Thisalsoshowsthatmanyinterestgroupsareveryinterestedinthesedata.‘Eitherpoorlydesignedorintentional.’CitizenLabdirectorRonDaiBote(RonDeibert)said.CitizenLabsaidthatsinceNovemberlastyear,theagencywillinformBaidu,thecompanyhasfixedsomeoftheproblems,butBaidu’sAndroidbrowserwillcontinuetobeaveryeasywaytosendthedecryptiondeviceID2andothersensitivedata.BaidutoldReutersthatthecompany’sinterestinthedataislimitedtothecommerciallevel,butdeclinedtosayexactlywhocanobtainthesedata.DatasecurityandprivacyissueshavesparkedwidespreadconcernintheUnitedStates,‘AppletochallengetheFBI’isatypicalcase:FBIaskedAppletounlockashootingsuspect’siPhone,butApplewasrejected.TheresearcherssaidtherewasstillunabletodeterminehowmanypeopleareaffectedbythisissueBaidu.SomesoftwaredevelopersinChina,saidthelackofencryptionalgorithmisaverycommonsituation,aweaktoacertainextentfromthemarket’srapidgrowthandsafetyawareness.ApplicationdevelopersCloudZhaopinCEOTianXingzhisaid:‘Thisisreallyverypainful,butitisgrowingpains.’(Source:SinaTechnologyWen/BookYu)3
