By Shelley Shan / Staff reporter
Amap (高德地圖), iQIYI (愛奇藝) and two other Chinese apps requested access to sensitive information unrelated to their core functions when installed on devices, with the mapping app posing more potential security risks than the others, the Ministry of Digital Affairs said yesterday.
The ministry released the results of cybersecurity tests of four Chinese apps after reports that Amap can display countdown timers for traffic lights on some roads in Taiwan, raising concerns over potential cybersecurity risks.
Amap is a digital map developed by Beijing-based AutoNavi Software Co (高德軟件), which is part of Alibaba Group Holding Ltd (阿里巴巴), while iQIYI is a streaming service owned by Baidu Inc (百度), an Internet search firm.
Photo courtesy of the Ministry of Digital Affairs
The other two apps were Bilibili (嗶哩嗶哩), a Shanghai-based streaming platform, and BimoBimo (比萌比萌) a chat app that facilitates interactions with artificial intelligence-generated characters.
The ministry conducted tests of the four apps’ Android and iOS versions, Administration for Cybersecurity Director Lee Yu-wei (李昱緯) said.
The cybersecurity agency ran tests on the four apps using 15 indicators across four categories: reading data from other apps, collecting and sharing user data, accessing users’ device information and reading users’ activity, Lee said.
Of the four apps, Amap had the highest number of risk behaviors, with 11 detected on Android devices and eight on iOS devices, he said.
Amap requested permissions to access sensitive personal data, including accessing clipboard and calendar information, transmitting data externally while inactive and transferring data to servers in China, he said.
People who use Amap risk having their credit card information, personal activities and other sensitive data leaked to unrelated third parties, he said.
Amap accessed audio, video, live image and microphone permissions in the background, Lee said, adding that it was also able to access contact lists, storage space, health-related records and device IDs.
“In that case, personal privacy or commercial confidential information could be compromised, while social networks could be exploited for unauthorized marketing purposes,” Lee said. “Files and data stored on personal mobile devices, such as daily habits, could be collected and analyzed. If audio or video data are improperly obtained or leaked, they could potentially be used for fraudulent or other illegal purposes.”
The tests showed that Amap was capable of continuously tracking and recording the movements of device owners, which can help establish a digital footprint, he said.
China-based apps in general would transmit data to servers in China, he said, adding that China’s cybersecurity and national intelligence laws require app operators to provide user data to Chinese national security, public safety and intelligence agencies.
Exploitation of digital footprints for precise geolocation poses a risk to personal safety, while user data could be accessed via legal provisions or transferred across borders, with potential risks of misuse, Lee said.
Amap’s traffic light countdown timers and 3D street view functions can be cross-referenced to track specific individuals, he said.
If long-term data of individuals are compiled, they could be used by hostile regimes to facilitate espionage activities, surveillance of sensitive crucial infrastructure and infiltrate national security systems, Lee said.
Bilibili, iQIYI and BimoBimo were also found to have accessed calendars, to-do lists and storage, as well as allowing other suspect operations, he said.
If people grant permission to apps to access information, their personal data and device information could be collected, profiled, reused or stored in other countries, he said.
The information could also be used by scammers to facilitate fraud operations, he added.
“Even if people do not grant apps authorizations to access their data, some apps can collect personal data in the background,” Lee said.
People should read the privacy policy of apps and ascertain the legitimacy of their permission requests before downloading them, Lee said, adding that cybersecurity protection software can boost data defenses.
Asked whether malware and other cybersecurity risks can be eliminated by deleting an app, Administration for Cybersecurity Director-General Tsai Fu-longe (蔡福隆) said that apps should be downloaded via well-established channels.
“People should restart their devices after deleting an unwanted app and regularly use cybersecurity protection software to scan for potential risks,” Tsai said.
Additional reporting by CNA