German security firm Nitrokey recently released a report claiming that they have discovered an unrecorded feature in Qualcomm Snapdragon chips that collects and sends user information directly to Qualcomm's servers.
This feature is independent of the Android operating system, which means that data is transmitted even if the operating system is not involved. Nitrokey installed a Google-free version of Android on a Sony Xperia XA2 phone equipped with a Qualcomm Snapdragon 630 chip and found that data was being sent to Qualcomm's izatcloud.net server, as reported by Gizmochina, April 19, 2023.
According to the report, Qualcomm chips collect and transmit information to users, including a unique smartphone identifier, chip name, chip serial number, XTRA software version, mobile country code and mobile network code, carrier or operating system type and version, device manufacturer and model. , a list of programs on the device, IP addresses, and other data. The data is transmitted via the insecure HTTP protocol without additional encryption, so it is accessible to almost anyone who can read the unique identifier data sent to Izat Cloud.
This feature affects about 30 percent of mobile phones worldwide, including Android phones and iPhones that use Qualcomm communication modules. Nitrokey's conclusion in the blog post is that Qualcomm's customized AMSS firmware takes priority over any operating system and, because it uses the HTTP protocol, unique device signatures can be generated based on collected data, which can be accessed by third parties.
Qualcomm responded to the report stating that the data transmission complies with the XTRA service's privacy policy, which actually allows the company to collect such user data. However, the fact that data is transmitted via the insecure HTTP protocol has raised concerns about the privacy and security of user information.
This report is important to ensure that user data is transmitted safely and in accordance with the privacy policy. It also underscores the need for greater transparency from technology companies regarding the data they collect and how it is used.
With more devices connected and collecting more data, it's important that users know how the information they use and have the ability to control it. Google's latest update for developers mandates that all Android apps must now include a feature that allows users to delete their accounts and data, reflecting an increased focus on user privacy.
GIZMOCHINA
Source: https://tekno.tempo.co/
339
