Item — HN Reader

The list of apps being monitored which are hardcoded directly in the implant[1] include :

    com.yahoo.Aerogram
    com.microsoft.Office.Outlook
    com.netease.mailmaster
    com.rebelvox.voxer-lite
    com.viber
    com.google.Gmail
    ph.telegra.Telegraph
    com.tencent.qqmail
    com.atebits.Tweetie2
    net.whatsapp.WhatsApp
    com.skype.skype
    com.facebook.Facebook
    com.tencent.xin

[1] https://googleprojectzero.blogspot.com/2019/08/implant-teard...

3 comments

This is an odd list. Some big messaging apps like Signal and Line are notably missing, while tools like Mail Master and Voxer seem like pretty minor players compared to the rest.

Is there a particular region of the world or community where this specific list makes most sense?

I suppose this list must be combined with the following explanation: "To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group."[^1]

So the suspects are countries that fight against the autonomy of a region where the population is ethnically different. The most obvious suspect is China: they have gulag camps in Xinjiang where Uygurs are interned, up to 1.1 million according to the UN[^2]. The dominant ethnic in China is Han, and Uygurs have been oppressed for decades.

Of course, other countries could do this, but the probabilty of Birmania/Rohingya, SaudiArabia/Yemen… seems much lower. On a side note, Voxer seems to be quite proeminent in China, according to the popularity of their Android app[^3].

[^1]: https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...

[^2]: https://www.theguardian.com/world/2019/jan/11/if-you-enter-a...

[^3]: https://play.google.com/store/apps/details?id=com.rebelvox.v...

To shed some more light on the situation, the Uyghurs in the region had affirmative action programs and were exempt from the one child policy. They had more perks than regular Han Chinese.

However, with the spread of Salafism [1] in that region, China started to suffer multiple terrorist attacks a year. With the worst resulting in 35 deaths and hundreds injured [2].

As a result, to stop these terrorist attacks, China started these de-radicalization centres. Since then, there have been no attacks.

1. latimes.com/world/asia/la-fg-china-saudi-arabia-20160201-story.html

2. en.wikipedia.org/wiki/2014_Kunming_attack

> The most obvious suspect is China: they have gulag camps in Xinjiang where Uygurs are interned, up to 1.1 million according to the UN[^2]. The dominant ethnic in China is Han, and Uygurs have been oppressed for decades.

But China doesn't need exploits to spy on their iPhone-using citizens, right? Because Apple has been cooperating with the Chinese government.

Do you have some evidence of that? Aside from iCloud hosting and App Store censorship, I haven’t heard of a case where they’ve weakened security for the Chinese government.

"Aside from iCloud hosting" is a pretty big "aside"

It's a pretty big aside but it is not iOS

I must have been thinking of iCloud.

> Some big messaging apps like Signal and Line are notably missing

Line is mostly used in Japan, Signal is mostly used by nerds. So you can assume neither japanese peopel nor nerd were their primary target. Given that this is true for the vast majority of the world population I'd not call this odd.

I've recently seen a surge of non-nerd Signal users. Mostly random people from my contacts starting to use it.

Hopefully a popularity surge will translate into the app getting better. It's notably less pleasant to use than Telegram, which I'd think of as its closest competitor.

Given that Telegram uses an entirely different encryption scheme, and does not e2e encrypt by default, I'd consider Wire (using some variation of the Signal protocol) the closest competitor. And Wire is rather pleasant to use, with clients on many platforms, sign-up with phone number or email, encrypted voice chat, encrypted group chats, etc.

Wire is pretty good these days, but I'd go for Matrix due to it being federated.

See, I'd consider WhatsApp the closest competitor - it's the most similar feature-wise, and the Signal Foundation is primarily funded by one of the WhatsApp founders.

What features of Telegram are more pleasant? I don't use Telegram much due to its makeshift encryption scheme and bad defaults (no E2E by default), but I've found Signal extremely usable in the last year or two.

Opening up the picker for sending a picture was notably slow. Approximately a three second count from pressing the button to having the pictures available to choose from. Then similar occasional lags throughout the process (e.g. hitting "back" from a picture to return to the library and select a second picture).

By contrast, Telegram has a quick selection of the last few pictures available immediately, and the general picker opens quicker if you request it -- maybe because it's using the stock iOS picker rather than the custom one Signal implements?

Since sending a picture to a contact was a super common action of mine, this was incredibly frustrating.

Signal also had notification issues if I was running the desktop client at the same time. It'd sometimes clear notifications from my phone before I'd actually read them in either location.

Thanks. I've never encountered either of those issues, possibly because I'm on Android. Specifically, the photo quick selection is instant for me.

Telegram does not use the system iOS photo picker, since it asks for permission to access all photos on the system.

There is also Facebook Messenger which seems to be missing, and "Messenger Lite", made for parts of the world without good connectivity, neither of which are on the list despite being very popular.

Line is the default messaging app in Taiwan, so one would assume that the Chinese government would be interested in targeting it.

com.tencent.xin makes a lot of sense in China https://en.wikipedia.org/wiki/Tencent_QQ

com.netease.mailmaster -- Netease is a Chinese App Platform

In addition though:

> The command-and-control server can also query for a list of all 3rd party apps and request uploads of their container directories.

These are all social networking services. Maybe, just maybe, this was tied to the PRISM program led by the NSA?

Maybe, just maybe, this was tied to the space program at NASA?

Tremendously unlikely, PRISM was something very different from this.

PRISM would have had to migrate to methods like this with the rise in e2e encryption.

I doubt they'd have written such shoddy and simple implant code though. At a minimum, they would have encrypted the data uploaded, since intelligence agencies love to steal data from other intelligence agencies, and sniffing wires I'm sure isn't unique to the USA.

No, PRISM had nothing to do with this at all. PRISM didn’t involve any sort of attack or offensive capability, and anything doing that would not be PRISM.

Wasn't PRISM mostly to spy on Americans? Most of the apps there aren't very popular in the US, and half of them are just straight up Chinese. Seems more like it would be a PRISM-like program but in some Asian country or China.