THREAD: I'm looking at a Huawei P20 from China, let see what can I found
-
-
Look at the name of the files contains in the assets folder: - airport_china.txt - city_china.txt - cityinfo.db - parkinglot_china.txt - railwayinfo.db - trainInfo.db - trainstation.db Interesting, no?pic.twitter.com/64UGD7X02B
Show this thread -
For example, the trainstation database contains: - address - name - latitude - longitude - citypic.twitter.com/dlfQ7t7WqI
Show this thread -
In the manifest of this application, there is a GeoReceiverpic.twitter.com/laRXO1hXun
Show this thread -
This receiver is receiving an UUID and will lookup an known fence idpic.twitter.com/pyjctOWe42
Show this thread -
I'm a stupid security researcher. For the moment, the keywords are: train, airport, city, geo fence... Do you see where we are going?
Show this thread -
In the data folder, there is a file called CalcMain. Here some of the methods of this class: - callGetBusTime - callGetTaxiTime - isTrafficBusy - callGetHomeCity - callHasHotelTicket - callGetAirportMultiPoi - callHasGroupBuyingTicket - ...pic.twitter.com/mXiG02fFxF
Show this thread -
-
To be clear, this app is composed of 3 background services and 2 services. There is NO UI in this app.
Show this thread -
-
-
This app doesn't seems to send the data BUT they communicate with another service called HiActionService which is coming from an Huawei app called HiActionpic.twitter.com/PJTD3FyzBk
Show this thread -
The previous screenshot is from the class called ActionCommonUtil. We can easily that Decision is sending all his events to this service through the methods in this class.
Show this thread -
I will study the app HiAction another time but what you have to know is that this app is sending the data to hicloud[.]com, "the Huawei Cloud"pic.twitter.com/b5EeaSCUHV
Show this thread -
In order to be more discreet, the OEM dispatch the responsibilities to multiple apps. In this case: 1. An app or the modified Android is getting your location regularly. It will trigger a GEO_ALARM_TRIGGERED to the Decision app
Show this thread -
2. Decision app is getting this location and check with his internal databases. If there is a match, it will generate an event 3. Decision will send this event to HiAction 4. HiAction will upload the data to the Huawei cloud
Show this thread -
-
Ofc, this is the big picture, I need more time to get all the details.
Show this thread -
I started this thread 2 hours ago. Decision app was the first app I checked. I still have a lot of Huawei apps to check
Show this thread -
-
If it was not clear enough: DO NOT buy
@Huawei phones. NEVER.Show this thread -
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.
