Penetration Test Report (Cure53): analysis report sgn

Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Analysis-Report “Study the Great Nation” 08.-09.2019
Cure53, Dr.-Ing. M. Heiderich, various Cure53 members and an external Contractor
Index
Introduction
Scope
Classification of Findings
SGN-01-001 Information gathering (Assumed)
SGN-01-002 File transmission and protection (Evident)
SGN-01-003 Code execution and backdoors (Evident)
SGN-01-004 Obfuscation for hiding functionality (Proven)
SGN-01-005 Collaboration with external companies (Evident)
SGN-01-006 Similarities & differences to other spy apps (Unclear)
Conclusions
Introduction
“Study the Great Nation is a multifunctional smartphone application created around the
Communist Party of China and the life of Xi Jinping. It was developed by the Parties
Propaganda Department and tech-giant Alibaba. It allows to video chat with friends,
send messages that get deleted after having being read, create a personal calendar, get
informed through the state media or watch TV series about the History of the
Communist Party of China.”
From https://en.wikipedia.org/wiki/Study_the_Great_Nation
This report documents the results of an analysis targeting the so-called “Study the Great
Nation” mobile application. Cure53 was tasked with reviewing the premise of this app by
the Open Technology Fund and completed the assessment in late August 2019.
To clarify the interest in this topic and scope, it should be noted that the “Study the Great
Nation” mobile application has gained a massive following. Allegedly, it has been
downloaded more than 100 million times. According to various sources, the app is
getting heavily promoted by various powerful stakeholders, such as Chinese state
media, universities, schools and similar parties.
Cure53, Berlin · 09/11/19 1/18
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
In this context, the Open Technology Fund decided to sponsor an investigation into the
application’s capacities and operations. In particular, Cure53 was supposed to analyze
what the “Study the Great Nation” application was actually doing “under the hood”. One
of the main objectives was to verify if any activities were performed by the app without
the public’s awareness, i.e. as regards advertising and/or documentation. An explicit
focus was therefore placed on unadvertised features which could be seen as aiding the
maintainers of the app in data collection. From there, a careful leap would be made in
terms of looking at ways of collecting data in a manner that violates human rights. To
guarantee transparency, it should be emphasized that the European Convention on
Human Rights (ECHR) served as a baseline for Cure53 during this project.
In terms of resources and timeline, Cure53 performed the analysis in Calendar Weeks
34 and 35, i.e. late August 2019. A number of team members and an external contractor
were involved in this assessment and spent a total of fifteen days on this project. The
budget was dedicated to the core research and analyses, as well as to communications
and documentation of findings.
It needs to be mentioned that Cure53 has accumulated considerable expertise in
conducting similar projects over the years. Consequently, as with similar reports, for
example the 2018 BXAQ mobile app analysis1 or the 2019 IJOP mobile application
analysis2, the team decided to deploy a dedicated and optimized classification system
for the findings and aspects. This should be seen as a means to discern both the level of
harm and the existing certainty about each potential violation of human rights. This
system is discussed in greater detail below.
At this stage, it can be stated that Cure53 managed to prove one case of a clear human
rights violation (HRV) by the “Study the Great Nation” app. All other items, grouped in an
array of six discoveries, should also be considered, yet only in the context of having all
vital information at hand. Three of the six findings were rated as “Evident” HRV and the
remaining two remain unclear as regards human rights implications.
In the following sections the report first elaborates on the scope and then sheds light on
the link between severities of the findings and the employed classification system. After
addressing all findings, Cure53 reiterates some of the key points about the studied
application in the context of human rights in the Conclusions section. More broadly, it is
hoped that this Cure53 report will provide a stepping stone for further research capable
of shedding more light on what this application does, especially in terms of processing
information it aggregates on the server-side.
1 https://cure53.de/analysis-report_bxaq.pdf
2 https://cure53.de/analysis-report_ijop.pdf
Cure53, Berlin · 09/11/19 2/18
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
Scope
• Analysis of the “Study the Great Nation” Mobile App
◦ Background info on the analyzed mobile app
▪ https://www.nytimes.com/2019/04/07/world/asia/china-xi-jinping-study-the-great-
nation-app.html
▪ https://www.nytimes.com/2019/02/14/technology/china-communist-app.html?
module=inline
▪ https://gizmodo.com/chinas-little-red-book-like-app-is-blowing-up-the-chart-[PII_REDACTED]
◦ Sources for obtaining the app during this analysis
▪ https://www.xuexi.cn/
▪ https://apps.apple.com/cn/app/%E5%AD%A6%E4%B9%A0%E5%BC%BA
%E5%9B%BD/id[PII_REDACTED]
▪ https://h5.xuexi.cn/page/download.htm l
◦ Detailed Scope:
▪ Cure53 was to check if the app does anything it does not publicly advertise, as
well as specifically look at what possibly points in the direction of possible human
rights (HR) violations.
▪ Special focus was placed on collection of PII or phone details - IMSI, IMEI, PII,
microphone data, file-system data, etc.
▪ Attention was given to checking if any of the servers this app talks to is related to
the servers of the other apps, with the question being about connections.
▪ Special focus was placed on the external companies that help build and maintain
this app - i.e. who runs the servers, who licenses libraries to them, and so on.
◦ Spotted prior research
▪ https://github.com/fuck-xuexiqiangguo/Fuck-XueXiQiangGuo
Classification of Findings
During this assessment, the Cure53 team has been using the following classification to
specify the level of certainty regarding the documented findings. Given that this research
had to happen on the basis of reverse-engineering and needed to be executed in a
stealthy manner, it is necessary to classify the findings to address a given level of
reliability that can be assumed for each discovery.
• Proven - Source code and the analyzed activity clearly indicate a HR violation.
• Evident - Source code strongly suggests an HRV.
• Assumed - Indications of a HR violation were found but a broader context
remains unknown.
• Unclear - Initial suspicion was not confirmed. No HR violation can be assumed.
Cure53, Berlin · 09/11/19 3/18
Dr.-Ing. Mario Heiderich, Cure53
Bielefelder Str. 14
D 10709 Berlin
cure53.de · mario@cure53.de
SGN-01-001 Information gathering (Assumed)
Q1: “What files/information is gathered by the app?”
The app collects the following information:
• General information about the phone (IMEI, device model, brand, device ID,
AppKey, info on whether the device is rooted);
• Connection information (Wifi-SSID, carrier, VPN-check)
• User-information (UIDs, cookies, session-IDs, Event-, Page- and Track-IDs,
calls, call statistics, contacts);
• Location;
• Running processes and services.
Affected Files:
com/alibaba/android/rimet/statistics/service/api/lwp/models/DataPlatParams.java
com/alibaba/android/rimet/statistics/service/api/lwp/models/DataPlatStaticParams.java
com/alibaba/android/rimet/statistics/service/api/lwp/models/DataPlatLogsParams.java
cn/trust/mobile/key/api/d/a.java
The list was compiled on the basis of information contained in the files, as well as by
Inspecting the logs generated on the filesystem.