Spyware in firmware

[vcot]

Looks like the latest models and maybe also older models use a Linux, with changed kernel, which is not public.
I read that other products from China send data to specific ips.
How to prevent that, would rooting that device helpful to solve this issue?

[ottischwenk]

Originally Posted by vcot

Looks like the latest models and maybe also older models use a Linux, with changed kernel, which is not public.
I read that other products from China send data to specific ips.
How to prevent that, would rooting that device helpful to solve this issue?

Do you do bank business with this device?

[alovhaug]

Originally Posted by ottischwenk

Do you do bank business with this device?

I can't speak for the original poster, but it seems to me that bank information is not the only thing I worry about keeping private and secure. Login information for websites, personal data like tax IDs and account #s at places other than banks just to name a few. And some of that information would be highly convenient to store on an eInk reader, because I tend to carry that device with me everywhere.

About the only thing I can suggest is to keep WiFi disabled, which may or may not work for your use case.

--Avonelle

[diabl0w]

I agree, privacy is more than just protecting bank accounts. Passwords, documents, contacts, browsing habits etc is worth at least some concern. Depending on what device your talking about, for onyx, they mostly run some version of android. Your best bet for protecting data is to use an app like "NoRoot Firewall" and use strict firewall rules. How strict of rules depends on your paranoid level

Edit: or like above poster said, just disable wifi connectivity altogether

[ottischwenk]

Then I suggest not using any device, because there is hardly one that was not produced in China.
Even a battery-free smartphone does not make calls to China.

[diabl0w]

Originally Posted by ottischwenk

Then I suggest not using any device, because there is hardly one that was not produced in China.
Even a battery-free smartphone does not make calls to China.

Samsung is based out of South Korea so thats a pretty big list right there alone

[mr_sm1th]

I'd say it is very likely Onyx software contains spyware and backdoors.

Originally Posted by vcot

How to prevent that, would rooting that device helpful to solve this issue?

Simple: do not connect to the internet when using Onyx devices.

Rooting the device will not help unless you completely replace all software including bootloaders, which is currently not possible as far as I am aware.

[Question Mark]

Originally Posted by diabl0w

Samsung is based out of South Korea so thats a pretty big list right there alone

But that's not where they make the majority of their phones. Until last year, they did have a factory in China. However, it seems that the majority of their phones for the global market are made in Vietnam.

https://www.sammobile.com/where-are-samsung-phones-made

[ottischwenk]

I don't care whether they call China or the NSA - I don't particularly like either.
But NSA is closer and the danger is probably greater

[Ken Maltby]

There are a number of functions on my new Onyx Boox Note 2 (10.3") that won't work without phoning home. This includes the fingerprint detection, screensaver app. (still can add your own locally), and others.

Luck;
Ken

[Galunid]

I run it and monitored the traffic using Wireshark for a while, and there wasn't much really, just some analytics, but just in case I run it over wireguard connected to PiHole, with onyx domains blacklisted. Only when I update device do I whitelist them and block again after I'm done. Additionally network traffic is allowed only over VPN (wireguard) connection. Funny enough, google play services is much worse then Onyx.

[mitra1]

Boh, I think until own country or european union has an own Operating System, it's impossible block the stream of data to China or Usa. The hardware and Os aren't european....

[Markismus]

Hmmm. I still have to look into this further. For now I NetGuard will have to block unwanted information exchange.
It's not only my Onyx Note Pro that might call home, but also my Hisense A5 Pro cc eInk mobile. Interestingly, this phone manufactured by one of China's state-sponsored/-owned firms also includes an app PayGuard that keeps telling me if apps have a permission that might be damaging my privacy: Like apps that send my location information even when they are not being used.
For now, it seems that the Onyx Boox ereaders and the Hisense eInk mobiles are safer than Samsung's Google services based devices. You can disable Google on Onyx and can't even install them on Hisense.
However, I still have to check with the devices running over a proxy, whether I am blocking all that I want to.

[pazos]

Note that telemetry is not spyware. We could argue if it is somehow malware if there's no way to disable it, but not spyware if used to:

- report crashes
- collect and send anonymous reports, like usage patterns within an app

In that respect we (outside China) use google services to do that.
Chinese people use other service providers. Baidu push service is common to perform bug reports in mainland China.

The important stuff is what the program tracks, not which service is used to deliver what's tracked. One can use Firebase to report a bug or to report all installed applications in a device. In the same vein it can use baidu push service. In the case of google nobody will say "it's phoning china", but if used to steal user data it is the same spyware with or without pushing that data to chinese servers.

[diabl0w]

Originally Posted by Question Mark

But that's not where they make the majority of their phones. Until last year, they did have a factory in China. However, it seems that the majority of their phones for the global market are made in Vietnam.

https://www.sammobile.com/where-are-samsung-phones-made

okay, well as far as i know vietnam is not china