Alibaba’s UC Browser found leaking users’ data

A mobile browser owned by China’s Alibaba Group contained privacy risks that could have exposed users’ personal data, according to a security group.

The flaws were found in UC Browser, a third-party app that’s been expanding in popularity across the globe, and has over 100 million daily active users. Last year, Chinese e-commerce giant Alibaba Group acquired UC Browser’s parent company.

The Citizen Lab at the University of Toronto’s Munk School of Global Affairs investigated the mobile browser, and found that it was sending user data unencrypted, or with not enough encryption. This included transmitting phone numbers and device serial numbers, in addition to user search queries and geolocation data.

The lack of encryption would let anyone with access to the data traffic to identify a user’s phone number, the device, and the person’s location, Citizen Lab said in its report released Thursday.

Both UC Browser’s Chinese language and English language versions contained the reported flaws. On Friday, Alibaba said it investigated the issues and has fixed the problem with a version update users can now download. “We have no evidence that any user information has been taken,” the company said in an email.

The privacy risk is that governments such as China and India often require telecommunication providers to hand over their data traffic, Citizen Lab said. Any personal data leaked through UC Browser could be used by governments or other third parties, it added.

Citizen Lab investigated the UC Browser after a leak of a 2012 document by Edward Snowden, disclosed by Canada’s CBC News, showed that Canada’s intelligence agency and its partners were allegedly aware of security flaws in UC Browser, and wished to exploit them for electronic surveillance.

Although Citizen Lab found problems with UC Browser’s software, the group could not confirm if they were the same vulnerabilities detailed in the document disclosed by the former National Security Agency contractor.uc-browser_500

Advertisements

Google is developing new Android-based Brillo OS for Internet of Things: Report

Looks like Google is shifting focus to those low-end power devices such as smart light bulbs or security cameras which come with as little as 64MB or 32MB worth of RAM. The company is reportedly working on a new software, under the Android brand, as the group developing the software is linked to the company’s Android unit.

According to a report by The Information, Google is developing a new OS nicknamed Brillo which will specially be for low-power devices aka Internet of Things (IoT) devices. As there has been an increase in the number of smart-household technology, this move by Google could prove beneficial. The report pointed out that this technology from Google could make it easier for the companies to manufacture smart home appliances such as smart fridges, light bulbs and more.

Another reason why the new Brillo OS makes sense for Google is the fact that it owns NestLabs, the company that makes smart thermostats, smoke alarms and security cameras for the home, which are all at the end of the day, ‘smart’ home appliances. If most smart home devices run on the Brillo OS, this would give a gateway to Google to a large number of information about a user’s daily routine as the time they go to sleep, or use their oven as well.

A report by Engadget points out that the new OS will not only free OEMs from having to design their own IoT communications schemes but it will also position Google as the ‘invisible backbone of tomorrow’s smart home’. Google could introduce the new Brillo OS at the I/O developers conference which starts in San Francisco on May 28.Google-logo1-624x351