China spying using common car battery monitor? - Page 1
Forum section: electronics / general

author: VK3DRB
author_rank: Super Contributor
timestamp: June 01, 2023, 03:20:06 am
content: Someone in Australia discovered by accident his commonly available simple car battery monitor is being used track the user's location and other data to the People's Republic of China by stealth.The guy's investigation is nothing short of brilliant. It is well written, and it is extremely interesting how he methodically tracked down what and where the data was being sent. His link also shows the device in question:https://doubleagent.net/2023/05/21/a-car-battery-monitor-tracking-your-location. Don't know about you, but I learnt heaps from reading the post from a technical perspective. And it raises big concerns.Is this a massive breach of trust, privacy and security? Maybe every piece of data is assembled like a jigsaw puzzle as a dossier on individuals? What other devices are being sold that are secretly sending your personal information to foreign entities without you knowing?

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 01, 2023, 03:31:11 am
content: As a general rule, do not use anything that requires a mobile phone app. Unless you absolutely have no choice.The ease with which you can access all the phone resources via Android APIs is, uh... funny. And user permissions? Sure but but if you do not authorize some app to access your location and this app REQUIRES it, you just can't run it. Period. And in some cases, it's not hard for an app to even circumvent the permissions.And the fact here it's going right to China is concerning, but if you think only chinese vendors do this...The "dossier" you're talking about, Google and others already have it.

author: NiHaoMike
author_rank: Super Contributor
timestamp: June 01, 2023, 04:11:16 am
content: Time to send them a bunch of fake data to make the data collection much less useful?

author: Berni
author_rank: Super Contributor
timestamp: June 01, 2023, 05:38:32 am
content: Yep this is a common trend with ChinaThey have laws where companies have to hand over any user data to the government without even needing to give a reason. If they refuse to hand over the data then some heads are going to roll (literally even).Baking in unnecessary tracking into products that don't even need it likely lets them score some bonus points (literally even) with there local government.Quote from: NiHaoMike on June 01, 2023, 04:11:16 amThey could probably still clean up the data using IP filtering (Unless you have access to a sizable botnet for the data flood)

author: mendip_discovery
author_rank: Super Contributor
timestamp: June 01, 2023, 06:33:03 am
content: I find this somewhat ironic that people like to point out all the stuff China is up to and say how awful it is. Meanwhile a good majority of the rest of the world does some very similar stuff. Yes some of them have some legal framework in place but your data is often open to those willing to pay for it, then there is the police etc that when using the right keywords can get to a lot of that data.I have always avoided using apps that come with random stuff as you never know what it is sending back to base. I get concerned with some of the programs on my PC that insist on having access to the internet when it has to real reason for it. 20 years ago blocking stuff from the internet was easy but now it's a nightmare.

author: VK3DRB
author_rank: Super Contributor
timestamp: June 01, 2023, 08:23:05 am
content: Quote from: mendip_discovery on June 01, 2023, 06:33:03 amRead the part about Data privacy on his first page. What the device is doing is clearly violating those "assurances".One day, I mentioned to someone I was thinking of visiting a place called Warrnambool. No Google searches and I wasn't using the computer and we don't have toys like Siri and other listening devices other than two colour TV's and two telephones. Within a half hour, I got an advertisement for accommodation in Warrnambool. No coincidence.

author: AndyBeez
author_rank: Frequent Contributor
timestamp: June 01, 2023, 08:41:09 am
content: The primary location source for location-2-advert tracking is your IP address. Most ISPs share their IP to location data, including 4G/5G cell tower geolocations. So it's no wonder you had push content out in the badlands. Look down to the bottom of your Google search results. Freaky, eh?Chinese apps calling home has long been a problem. I noticed recently a LED control app 'needed' access to Files and Contacts. Why? I suspect it was to share LED patterns with other "led fans". I didn't get caught out, but I'm sure millions already have.For public domain 'location tracing':https://www.iplocation.net

author: EPAIII
author_rank: Super Contributor
timestamp: June 01, 2023, 08:44:00 am
content: Your car battery! Your refrigerator! Your toaster!Apps? Heck, the phone itself was probably made in China. They don't even need apps to spy.Only way around this is to not buy anything Chinese. Or anything with any Chinese parts. ..... Fat chance of that.

author: Siwastaja
author_rank: Super Contributor
timestamp: June 01, 2023, 11:21:48 am
content: >Android app requires location permissions to work.I don't think it counts as spying. If I understood correctly, Android literally and explicitly asks user's permission for location data, and people willingly click "yes", so what's the issue?

author: Shonky
author_rank: Frequent Contributor
timestamp: June 01, 2023, 11:59:25 am
content: Quote from: Siwastaja on June 01, 2023, 11:21:48 amOK it needs the permission simply because that's how Android works to access the Bluetooth device.It becomes spying when it takes extra data and posts it to server that is absolutely not needed for the device to work properly. Also the declaration that it doesn't send any personal data is false.You could argue it's a shortcoming in Android's permission system but at the end of the day it's certainly doing way more than users would expect from that permission.I have one of these and the app is OK but certainly not the best. I have toyed with the idea of writing my own as an exercise.

author: eugene
author_rank: Frequent Contributor
timestamp: June 01, 2023, 01:22:33 pm
content: It's no wonder that people are concerned about apps collecting information they don't don't actually need and sending it home. But, it's a little perplexing to me that (most) people allow Google to do this on a massive scale. I understand that we need to trust someone, but Google, I don't trust you that much.

author: madires
author_rank: Super Contributor
timestamp: June 01, 2023, 01:50:39 pm
content: It's not just a chinese vendor, it's a general problem! Usually apps for Amdroid and IOS are based on so called app ordevelopment frameworks which come with all that nasty spying and data collection. If the framework is free for the app developer it's very likely that it will collect data to make money for the framework developer.

author: NiHaoMike
author_rank: Super Contributor
timestamp: June 01, 2023, 01:52:59 pm
content: Quote from: Berni on June 01, 2023, 05:38:32 amIf it's a popular product, easiest would be to make a hacked version of the app that fakes the data being sent back. Or if you're on a CGNAT or VPN, they'll discard a lot of good data when they try to strip out the fakes.

author: eugene
author_rank: Frequent Contributor
timestamp: June 01, 2023, 03:01:52 pm
content: The challenge with faking data in Android is that much of it is retrieved via a set of "apps" generally referred to as Google Services. In order to fake the data you literally need toreplacethose services at close to the operating system level.There are de-Googled versions of Android like/e/oswhich will (depending on settings) give fake location and IP to any app that ask for such data. They don't fake everything. I wish I could completely hide my contacts list for example (if you get junk mail, odds are the email address was obtained from someone else's contact list.) It's definitely inconvenient because if I install any Google apps (App Store, Maps, Google Keyboard, gmail, etc...) then the purpose becomes defeated. But it does prevent others from tracking my location. I still have my old phone running a factory version of Android at home. It has no SIM card, so I can't make phone calls, but as long as there's wi-fi I can still use certain apps when I need to.

author: edpalmer42
author_rank: Super Contributor
timestamp: June 01, 2023, 05:12:06 pm
content: Quote from: Siwastaja on June 01, 2023, 11:21:48 amYes and no. Android does ask, but if you say no, the app doesn't work. That happens with all Bluetooth Low Energy (BLE) devices like this battery monitor. When Google introduced BLE, they designed it to enforce that requirement. The responsibility for this situation ultimately lies with them. I'd like to see them justify this in front of a Congressional committee.I have this battery monitor and I use this app. When my firewall asked if the app should be allowed to access the net, I said "HELL NO!!!". It's not a perfect solution but, these days, you're asking for trouble if you don't run a firewall program to control outgoing access.Ed

author: Infraviolet
author_rank: Super Contributor
timestamp: June 01, 2023, 05:18:36 pm
content: "20 years ago blocking stuff from the internet was easy but now it's a nightmare."A virtual machine perhaps, isolate not-entirely trustworthy programs within it? Then cut off internet access from/to that VM in VirtualBox/VMWare's settings. The programs would run slower, but with modern hadware usually not even enough to be noticeable.

author: abeyer
author_rank: Frequent Contributor
timestamp: June 01, 2023, 05:56:09 pm
content: Quote from: edpalmer42 on June 01, 2023, 05:12:06 pmYou say that like google is somehow to blame for the privacy situation... but if anything their choice on this wasmoredisclosure than there otherwise would have been. BLE by design is fairly short range and allows enumerating unique ids of nearby devices. Companies have abused this by planting networks of BLE beacons and have databases of their geocoded locations... so any app developer with access to BLE data on your device and willing to spend some money for access to that geocoding data or use one of the frameworks that's already linked to these systems can effectively get your location data, even if you hadn't granted that permission.

author: edpalmer42
author_rank: Super Contributor
timestamp: June 01, 2023, 06:10:47 pm
content: Quote from: abeyer on June 01, 2023, 05:56:09 pmWhat I said is that Google linked location services to BLE. You can't have one without the other. Without this apparently arbitrary linkage, you could use BLE while denying permission to access location services. Then, if a BLE app refused to run without location services, the fault would lie squarely with the app developer. Now, an unscrupulous app developer can just shrug and say that he doesn't use location services but Google forces it. Then he just does what he wants and hopes nobody catches him. Ethical developers are caught in the same trap. They don't use location services, but their apps won't run without access to the unnecessary and unused service.Ed

author: abeyer
author_rank: Frequent Contributor
timestamp: June 01, 2023, 08:53:54 pm
content: Quote from: edpalmer42 on June 01, 2023, 06:10:47 pmIn that scenario you propose, you could agree to allow bluetooth but not location, and any untrusted app couldstillget your location even though you never agreed to it. That's the fundamental problem: it isn't really possible to give full access to use bluetooth while not making it possible to extract your location even without GPS. So, what's the value in separating them?In theory I could see maybe a hierarchical permission system, where you gave permission for location and then could specify which specific mechanisms to allow eg allow location only via bluetooth and not via GPS... but that would be a pretty big departure from the existing permissions model, from what I know.

author: .RC.
author_rank: Frequent Contributor
timestamp: June 01, 2023, 11:14:13 pm
content: Quote from: AndyBeez on June 01, 2023, 08:41:09 amMy location given by google, many many many hundreds of km away, I might as well be on the moon.I thought someone use starlink is also going to show up as being in the USA?

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 01, 2023, 11:19:37 pm
content: Quote from: Siwastaja on June 01, 2023, 11:21:48 amUh, the issue is that the app won't work without it, so whether users are AWARE of it (or even asked about it) or not matters only if users are willing NOT to use the app.Otherwise, once granted access to location, the app can do pretty much what it pleases with it.Not sure I get your point. Obviously it's "spying" only if the app actively tracks and uploads your location, which sure the app is not FORCED to do, but you can bet that many will.And this whole Bluetooth Android location thing is mind-boggingly stupid. That would be a good reason enough to ditch Android.

author: haxrob
author_rank: Newbie
timestamp: June 01, 2023, 11:20:53 pm
content: Hi all, first time poster on eevblog - really enjoying reading the variety of view points in the discussions in this thread. Thanks for showing in interest in this minor endeavor.On the topic of the Bluetooth permissions - with iOS you don't need to hand out all the neighboring (mobile) cell ids, GPS coordinates and wifi network BSSIDs for BLE scanning - and I'm pretty OK with that.Based on some comments in this thread, it appears there some interest on developing a new application to replace the official version. That's enough to give me motivation to finish reversing this interface. Here is what i've done so far:https://doubleagent.net/hardware/ble/bluetooth/2023/05/22/a-car-battery-monitor-tracking-your-location-part2.And the resulting python code to read the voltages from the device over BLE:https://gist.github.com/x1sec/3af7efdcd3465aac09093081c32ba321What needs to be implemented next is to be able to obtain archived voltage readings stored in the device's memory for when it isn't paired.I'll also be tackling the firmware for the SoC at some point. Waiting for the debugger for the Texas Instruments CC2541 to arrive. In the post linked above, I provide a way to pull firmware it uses for OTA updates from their cloud servers. It's bundled in a proprietary format so there is some further reversing work to be done here.FYI I have reported my findings to Jaycar and and have responded promptly - immediately initiating an investigation on their side.

author: NiHaoMike
author_rank: Super Contributor
timestamp: June 03, 2023, 03:10:22 am
content: I think it would be good to add a feature to send tracking with fake data to really show them how much the users hate tracking, of course have it disabled by default so it would be opt in. (What should it be called? I vote "chaffing" after the aerial combat device.)

author: RJSV
author_rank: Super Contributor
timestamp: June 03, 2023, 05:51:02 am
content: My doctor's conventional office uses Google enterprise stuff, although I don't recall the exact product name, but has a logo, and I've also seen Google 'Play' involved in the various office interactions.Radio receivers unavailable retail now, so you get a choice of some crippled podcast that has horrible drop-outs, and, YouTube style advertisements have been creeping in, starting May 2023.If you get tired of the seemingly crippled podcast you MUST get the APP.After all, you never did PAY for that (free) radio show. Congress, early in the days of radio broadcasting, specifically placed measures to ensure a decent flow of info traffic to the public, meaning that a large part of that intent was to avoid the whole 'gouging' or exploitation of listener by way of excessive charges.Many of the medical office situations involve staff that certainly are tone-deaf to this whole discussion, saying things like "What's the big deal, you sign up, get the APP,...and then you can access all your (private medical data! Convenient !"You might then ask "How did Google get my private medical data?"...By reading it, in the WEB Portal App.Funny thing, I just realized, the host of those APPs has your private data, but if you haven't signed up, you don't have access; they have more of your stuff than you do, in that case !

author: mendip_discovery
author_rank: Super Contributor
timestamp: June 03, 2023, 09:46:46 am
content: Quote from: Infraviolet on June 01, 2023, 05:18:36 pmBack then not every program had a reason to phone home but now everything needs the internet to check you have a current subscription, updates checks and cloud stuff. Back in the 2000s, I remember running ZoneAlarm so you allow individual programs access to the internet and turn it off later. It did help cut down on your 56k dial-up grinding to a halt just because something was calling home to report your recent usage.On a phone, it's a nightmare. I recently had to install an app so I could connect to a boroscope that uses WiFi. While in use it's fairly safe as I have to connect to the WiFi of the camera unit so its not connected to the outside world, but I don't like having the app on my phone.QuoteI remember with a charity someone suggested we make a list of all the members and put pins on a map to see the coverage we had. Then someone pointed out that this is a big risk with the DPA as Google will harvest the names and the postcodes for these people and add them to the collective. They even stated sending URLs to development web pages via Google can cause the crawlbot to know of it and crawl it shortly afterwards exposing your work to the rest of the world. I did think this was paranoia but I was assured it was true and given the job the person saying it had, there was a good chance he had actually read the terms and conditions for things.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 03, 2023, 07:57:18 pm
content: Quote from: NiHaoMike on June 03, 2023, 03:10:22 amI think you can do that if you enable the developer mode in Android and select a fake location app. You can have a look there:https://www.howtogeek.com/795277/how-to-spoof-your-location-on-android/But it's system-wise as far as I can tell, so of course it'll affect everything you do and say goodbye to when you actually need your location. Maybe you can manage to make it application-specific.But otherwise I strongly suggest not to use any product that requires a mobile app to function at all. It's like constantly giving away your house keys and expecting that no one will ever enter.I don't see a definitive way around it though. It's just going to get worse. There are too many interests at stake. It's a gold mine. No amount of individual choice or public regulation will be able to curb that.

author: vk6zgo
author_rank: Super Contributor
timestamp: June 04, 2023, 01:05:28 am
content: The PRC government would have to spend all their intelligence budget tracking where people of no conceivable interest to them are going, creating a "perfect storm" of noise, & handicapping their more useful intelligence gathering efforts, so a lot of this is paranoia as far as State action is concerned.Private sector efforts are maybe of more interest, as if somebody, somewhere, can make money out of your information it may be worth doing.Not China, but various people in another very populous country seem to have an old scam going on several levels, along the lines of people ringing up & saying "I am from Windows/ Telstra/ the Tax Department" or whatever.One level sells phone number databases to the second level of suckers who think they have bought into a "nice little earner", only to find that they get told off or abused most of the time, with only a few of the most gullible "sucked in".Level one still keeps going, selling the scam to the large number of level two participants blinded by greed.

author: Shonky
author_rank: Frequent Contributor
timestamp: June 04, 2023, 02:52:24 am
content: Quote from: haxrob on June 01, 2023, 11:20:53 pmPresumably the firmware here can only be fairly harmless since it only has the BLE connection and is essentially a data logger of voltage only. Presumably it's basically using TI's SDK so most of the code is actually TI. The packaging doesn't look overly complex to figure out. I'd guess again it's largely using whatever TI provide for a firmware upgrade process.I've grabbed a copy with your instructions, thanks.What did Jaycar respond with? Just that they'd investigate.

author: RJSV
author_rank: Super Contributor
timestamp: June 05, 2023, 07:20:06 am
content: Having mentioned, here recently, some things noted that make (radio show) podcasts lame or deliberately crippled, when an APP is not used, here is a couple measures that I noted today:Radio talk show went in and out of advertising time, as the hour progressed. The show got to :52 meaning 9:52, and started the 'Top of the Hour' which is (supposed) to mean time for some news coverage. But, nope; all advertisements, and they ran until 10:17 !That's 25 minutes, of pure advertisements, a really unbelievable stretch of time, (until I measured) !So, if that is a dumbing down of listener quality, to force the subscription to an APP then a bit despicable, really. But the substance of that, 25 minute program break is clearly relating to the old-school regulation of TV and RADIO media, maybe put in 1980 terms, where such a long stretch of ADs would get the attention of FCC (or Federal Communications Commission).Now, my speculation being, the advertiser has differing interests, from the casual user / (listener) and typically potentially could face some complaint process. I mean, a stretch of 25 minutes is obviously abusive.The regulatory environment is perhaps lacking in the older style monitoring, or maybe just lazy in contempory matters...I don't know what specific laws apply. But seemingly a 'bypass' of the spirit of regulation from a consumer standpoint.Plus, the audio result seems more like a 'chopped up' audio chunk of some program that, originally, had decent continuity. Right now (tonight's show) the audio streamed cuts into and out, mid-sentence often, which doesn't really reflect any decent quality, for the listener, without the APP loaded and running.The various screen items also, now, have inserts for various 'google play' offers, for purchase, very near and easily confused with the usual click-on targets on-screen.

author: amyk
author_rank: Super Contributor
timestamp: September 22, 2023, 02:47:08 am
content: Quote from: NiHaoMike on June 03, 2023, 03:10:22 amNull Islandhas a nonzero population from many who send fake tracking data.

author: soldar
author_rank: Super Contributor
timestamp: September 22, 2023, 08:33:47 am
content: This essay is well worth reading and pondering.Us vs. Them: Why Our Society and the World Are Becoming Increasingly Dividedhttps://www.juliakolodko.com/us-vs-themSummary: whoeverweare, it does not matter,weare good,theyare bad.= = = = = =All good people agree,And all good people say,All nice people, like Us, are WeAnd every one else is They:But if you cross over the sea,Instead of over the way,You may end by (think of it!) looking on WeAs only a sort of They !Rudyard Kiplinghttps://www.kiplingsociety.co.uk/poem/poems_wethey.htm

author: VK3DRB
author_rank: Super Contributor
timestamp: September 25, 2023, 12:09:47 am
content: Quote from: soldar on September 22, 2023, 08:33:47 amI observed an interesting phenomenon at IBM in the 90's. The day shift workers tending to blame the evening shift workers and vice versa when something wasn't quite right. Which was the "them and us" phenomena. This was not helped by the questionable leadership of IBM senior management creating an environment of distrust. In fact, they literally put up a wall between us office staff (mostly engineers) and the manufacturing staff. We had access to the manufacturing areas, but manufacturing staff could not access our office areas except for a few selected people.So it is with countries spying on each other, even so-called allies (eg: the CIA spying on Angela Merkel). The wall exists. Good dialogue and good ethical leadership will help remove it. Some Chinese companies and their government secretly collecting data on foreigners and stealing intellectual property does nothing to create trust. They need a paradigm shift if they are ever going to be trusted.