Connect with us

China Digital

Cybersecurity Researcher Discovers Unsecured Database with Millions of Chinese Social Media Chat Logs

Victor Gevers says it is his mission to “report vulnerable systems.”

Avatar

Published

on

Image by iFeng Games (games.ifeng.com)

First published

Victor Gevers, a Dutch researcher at the cyber-security NGO GDI Foundation, has discovered that a Chinese database containing 364 million records including personal identity data, images, and chat conversations of PRC citizens, was left open for anyone to see who searched for its IP address.

Some of the information records allegedly come from apps developed by Chinese tech giant Tencent, including WeChat (Weixin), WeChat Wallet and QQ, but also from Alibaba’s Wangwang Message (阿里旺旺), which is the main chat program used on China’s most popular e-commerce site Taobao.

Gevers tweeted about his findings earlier this week (@0xDUDE). Journalist Yuan Yang reported about the issue in the Financial Times on March 4, writing that a large number of the records had the names and addresses of Chinese internet cafes on them.

Chinese internet cafes are legally required to install monitoring software on their computers (Wǎngbā guǎnlǐ ruǎnjiàn 网吧管理软件 “Internet cafe management software”). Well-known examples of this software are PubWin, Sicent (万象), Zuolun (左轮), or Fangzhu (方竹).

Gevers extensively tweeted about the open database over the past few days. On March 2nd, Gevers wrote on Twitter:

So this social media surveillance program is retrieving (private) messages per province from 6 social platforms and extracts names, ID numbers, ID photos, GPS locations, network information, and all the conversations and file transfers get imported into a large online database.”

On Tuesday, March 5th, Gevers also spoke to the Dutch ‘Foreign Desk’ (Bureau Buitenland) Radio 1 program, saying:

We assume that these messenger services are being screened by Chinese authorities, and of which [the information] is collected in one place. What we saw is that the profiles connected to GPS locations, device use, which wifi networks were used, Chinese ID numbers, ID photos – basically the full profile relating to the conversations. And then these conversations were sent out to various provinces across seventeen servers.”

On Twitter, he further stated:

Around 364 million online profiles and their chats & file transfers get processed daily. Then these accounts get linked to a real ID/person. The data is then distributed over police stations per city/province to separate operators databases with the same surveillance network name.”

On March 4th, Gevers also wrote that “[Chinese internet] is a space filled with open databases,” later tweeting that the same holds true for other countries, including the US.

News of the online leak was also picked up by various Chinese media outlets, including tech news site Driver China (驱动中国). Chinese news sites Sina, Sohu, Phoenix News, Techcrunch.cn, IThome.com, and Q Daily also reported about the issue, but these news articles were all pulled offline at time of writing, coming up with a ‘404’ error message.

One Chinese blog reporting on the issue did not only highlight that the database discovered by Gevers was accessible for people who knew of its IP address, but, noteworthy enough, also reported that it was available for viewing “free of cost.”

The issue was discussed on Weibo, where hashtags such as “360 million records leaked” (#中国3.6亿份聊天记录被泄露#) popped up with hundreds of views, but comments were soon taken offline.

As the annual Two Sessions (两会), China’s most important political event of the year, are currently taking place, Chinese social media is seeing increased censorship and control.

One of the comments that did get through on Weibo noted that as long as news reports were being ‘harmonized,’ it would be difficult for people to tell if this is “fake news” or not.

The fact that Chinese authorities screen digital data is no secret. In 2016, China’s Ministry of Public Security announced that messages posted on social media platforms such as Weibo, Baidu Tieba, or WeChat, could be identified as legal evidence and that China’s public security organs have the right to access electronic information and collect user data.

As a hacker and researcher, Gevers says his mission is to “report vulnerable systems” and sometimes “share what we learn.”

By now, the internet service provider behind the server has been warned about the open database, and within two hours after receiving the warning, the database was no longer accessible.

But how is such a leak possible in the first place? According to Gevers, the answer is quite straightforward: “The problem here is a knowledge gap. And that [knowledge] problem is not just an issue in China, it’s a worldwide problem (…) among people who build these kinds of systems,” he said on Dutch Radio 1.

Gevers’ research also made headlines in February of this year, when the Dutch hacker revealed that millions of personal record information data stored by the Chinese AI-based security software company Sensenets were openly accessible.

For more about the Sensenets leak, check here. To follow Victor Gevers on Twitter see twitter.com/0xDUDE.

By Manya Koetse

Spotted a mistake or want to add something? Please email us.

©2019 Whatsonweibo. All rights reserved. Do not reproduce our content without permission – you can contact us at info@whatsonweibo.com.

image_print

Manya Koetse is the editor-in-chief of www.whatsonweibo.com. She is a writer and consultant (Sinologist, MPhil) on social trends in China, with a focus on social media and digital developments, popular culture, and gender issues. Contact at manya@whatsonweibo.com, or follow on Twitter.

Advertisement
1 Comment

1 Comment

  1. Avatar

    Joey

    March 5, 2019 at 10:45 pm

    Lovely, Dutch researcher working to improve the security of China’s surveillance systems. Too young, too simple, sometimes naive…

Leave a Reply

Your email address will not be published. Required fields are marked *

Backgrounder

What Are Weibo’s “Super Topics”?

Explaining Weibo’s “Super Topics”

Avatar

Published

on

What are Weibo’s “Super Topics” (超级话题) and what makes them different from normal hashtags?

Over the past year, Weibo’s so-called “Super Topics” (超级话题) have become more popular on the social media platform as online spaces for people to connect and share information.

Weibo’s “super topic” function has been around since 2016. The function allows Weibo users to create and join interest-based content community pages that are online groups separated from the main Weibo space. One could perhaps compare these Weibo Super Groups to ‘mega-threads’ or ‘subreddits’ on Reddit.

These are the most important things to know about Weibo’s Super Topics:

 

#1 A Super Topic is Not the Same as a Hashtag

Similar to Twitter, hashtags make it possible for Weibo users to tag a topic they are addressing in their post so that their content pops up whenever other people search for that hashtag.

Different from Twitter, Weibo hashtags also have their own page where the hashtag is displayed on top, displaying how many people have viewed the hashtag, how many comments the hashtag is tagged in, and allowing users to share the hashtag page with others.

A Super Topic goes beyond the hashtag. It basically is a community account where all sort of information is shared and organized. People can ‘follow’ (关注) a Super Topic and can also ‘sign in’ (签到).

On the main page of every Super Topic page, the main subject or purpose of the super topic is briefly explained, and the number of views, followers, and posts are displayed.

A super topic-page can be created by any Weibo user and can have up to three major hosts, and ten sub-hosts. The main host(s) can decide which content will be featured as essential, they can place sticky notes, and post links to suggested topics.

 

#2 A Super Topic Is a Way to Organize Content

Super Topic pages allow hosts to organize relevant content in the way they want. Besides the comment area, the page consists of multiple tabs.

A tab right underneath the main featured information on the page, for example, shows the “sticky posts” (置顶帖) that the host(s) of the page have placed there, linking to relevant information or trending hashtag pages. Below the sticky notes, all the posts posted in the Super Topic community are displayed.

One of the most important tabs within the Super Topic page is called “essential content” (精花), which only shows the content that is manually selected by the host(s). This is often where opinion pieces, articles, official news, or photos, etc. are collected and separated from all the other posts.

Another tab is the “Hall of Fame” (名人堂), which mainly functions as a reference page. It features links to the personal Weibo pages of the super topic page host(s), links to the Weibo pages of top contributors, and shows a list of the biggest fans of the Super Topic. Who the biggest fan of the page is, is decided by the number of consecutive days a person has “checked-in” on the page.

 

#3 Super Topics Are a Place for Fans to Gather

Although a Super Topic could basically be about anything, from cities to products or hobbies, Super Topics are often created for Chinese celebrities, video games, football clubs, or TV dramas.

Through Super Topic pages, a sense of community can be created. People can be ranked for being the most contributive or for checking in daily, and comment on each other’s posts, making it a home base for many fan clubs across China.

The host(s) can also help somebody’s page (e.g. a celebrity account) grow by proposing them to others within the group.

Super Groups are ranked on Weibo based on their popularity. This also gives fans more reason to stay active in the group, making their Super Topic top ranking within their specific category (TV drama, food, photography, sports, games, etc).

What makes the Super Topic group more ‘private’ than the common Weibo area, is that people posting within the Super Topic can decide whether or not they also want their comment shared on their own Weibo page or not. If they choose not to, their comments or posts will only be visible within the Super Topic community.

 

By Manya KoetseGabi Verberg, with contributions from Boyu Xiao

Spotted a mistake or want to add something? Please let us know in comments below or email us.

©2019 Whatsonweibo. All rights reserved. Do not reproduce our content without permission – you can contact us at info@whatsonweibo.com

image_print
Continue Reading

China Digital

Online Controversy over Mandatory GPS Tracking Smartwatches for Chinese Street Cleaners

Being a street cleaner in 2019 China now involves wearing a mandatory smartwatch with GPS tracking.

Gabi Verberg

Published

on

Image via Sina.com

The times of chatting with the neighbors, taking a break, or doing some shopping during work hours are seemingly over for Nanjing’s street cleaners now that their every move is monitored through a special smartwatch. News of the mandatory GPS tracking bracelets for sanitary workers triggered public outcry earlier this month. But it’s not just Nanjing street cleaners that are subjected to this policy.

Earlier this month, the introduction of smartwatches tracking the movements of street cleaners in Nanjing attracted the attention of Chinese netizens and international media after the new policy was made public on April 3rd.

In March of this year, the sanitation department in the Hexi area of Nanjing, Jiangsu, started a pilot with a smartwatch that sanitation workers are obliged to wear. The watch has a built-in real-time GPS tracking system, allowing the Nanjing Hexi Smart Sanitation Center to monitor workers’ movements.

In a short video published by Toutiao News, a spokesperson of the Smart Sanitation Command Center* explained that the smartwatch currently allows the company to assess the workers in three ways: they can register workers’ attendance, collect statistics of workers leaving their designated work area, and report on workers that remain in the same position exceeding the allowed amount of time.

Sanitation workers also commented on their new working system. One person interviewed said: “Why wouldn’t I be allowed to have a half-an-hour break? Look, the street is all clean, there is nothing to be cleaned up. They are crazy for making us move up and down the street for no reason.”

Street cleaners also said that the system would automatically report them if they had been in the same spot for more than twenty minutes. The smartwatch would then subsequently encourage them to move, calling out “Jiayou! Jiayou!” (“Come on! Come on!”).

That particular function was reportedly removed shortly after public outcry on the policy.

On Weibo, the hashtag “Smartwatch Automatically Yells ‘Jiayou'” (#智能手表自动喊加油#) received over 2,5 million views, with the majority of commenters strongly rejecting the new approach.

Most commenters on this issue argued that the implementation of the smartwatch is “immoral” and that the Nanjing workers are “treated as criminals.” Many others also pointed out that the workers, often senior citizens, should be able to rest for more than 20 minutes.

In light of the new policy, many people on social media also referred to the infamous fictional character Zhou “Bapi” (周扒皮). In the novel The Killing Wind, this landlord Zhou would stick his head into the henhouse stirring up the roosters to wake his laborers up earlier, so they would start working.

Some netizens came with an alternative solution, suggesting that the leaders of the company should wear the smartwatches themselves instead.

While the controversial function was eliminated, the GPS tracking function still stands.

Nanjing is not the first city to introduce GPS tracking smartwatches for its sanitary workers. Other cities where the same policy has been introduced are, for example, Chengdu, Hangzhou, Guangzhou, and Qingdao, according to Chinese media outlet Global Times.

In the summer of 2018, various Chinese media outlets already reported about the introduction of smartwatches for street cleaners in Guangzhou. At the time, the smartwatch policy was described as an innovative way to solve staff deployment and management problems, giving team leaders more insights into the real-time position of the street cleaners.

Whether or not the smartwatches do indeed improve work efficiency of street cleaners is still unclear, but there are no indications that the smartwatch policy will be changed at this point.

The tough work conditions of Chinese street cleaners, who work long hours and receive minimal pay, regularly become an issue of debate on Chinese social media. Besides praising the hard work of China’s public cleaners, Chinese netizens often express their sympathy for the bad circumstances under which street sweepers have to work.

By Gabi Verberg

* (南京河西建环”智能环卫”综合调度监控指挥中心 Nanjing Hexi Jianhuan “Intelligent Sanitation” Integrated Dispatching Monitoring Command Center)

Spotted a mistake or want to add something? Please let us know in comments below or email us.

©2019 Whatsonweibo. All rights reserved. Do not reproduce our content without permission – you can contact us at info@whatsonweibo.com

image_print
Continue Reading
Advertisement

Facebook

Advertisement

Follow on Twitter

Advertisement

About

What’s on Weibo provides social, cultural & historical insights into an ever-changing China. What’s on Weibo sheds light on China’s digital media landscape and brings the story behind the hashtag. This independent news site is managed by sinologist Manya Koetse. Contact info@whatsonweibo.com. ©2014-2018

Contribute

Got any tips? Or want to become a contributor? Email us as at info@whatsonweibo.com.
Advertisement

Popular Reads