In this report, we examine cloud-based pinyin keyboard apps from nine vendors (Baidu, Honor, Huawei, iFlyTek, OPPO, Samsung, Tencent, Vivo, and Xiaomi) for vulnerabilities in how the apps transmit user keystrokes. Our analysis found that eight of the nine apps identified contained vulnerabilities that could be exploited to completely reveal the contents of users’ keystrokes in transit. We estimate that up to one billion users could be vulnerable to having all of their keystrokes intercepted, constituting a tremendous risk to user security.
  • sawa
    39•2 months ago

    TLDR:

    This study mainly targets Pinyin input, the most popular Chinese input method (hence 1bn potentially affected).

    Vulnerabilities were due to the keyboards’ use of the cloud for dictionaries used in IMEs (essentially a conversion engine). Such IMEs are must-haves for certain languages and converts A-Zs to other scripts. Lack of E2EE resulted in exposed keystrokes.

    Personally I would recommend switching to something which uses a local dictionary. RIME is a good FOSS alternative and can be configured to work on Android via fcitx.

    While the study doesn’t cover English keyboards, this is as good a reminder as any not to use in-built dictionaries in general unless you have to.

    • Possibly linuxEnglish
      4•2 months ago

      If you are in China you also have to be very worried about the Chinese government. This is just one out of hundreds of other tools they have to detect disloyalty

  • moon
    21•2 months ago

    A billion vulnerable users is wild. I’m sure there are government entities taking advantage of this already

      • StellarExtract
        10•2 months ago

        Damn, I didn’t know what had happened to her. I really liked her content.

      • delirious_owl
        5•2 months ago2 months ago

        Yeah and didn’t she work with Citizen Lab in the past about this? I’m wondering what’s new here.

        • Aatube
          2•2 months ago

          What’s new is that apparently “We reported these vulnerabilities to all nine vendors. Most vendors responded, took the issue seriously, and fixed the reported vulnerabilities, although some keyboard apps remain vulnerable.”

  • delirious_owl
    10•2 months ago

    This report is not about how operators of cloud-based IMEs read users’ keystrokes, which is a phenomenon that has already been extensively studied and documented. This report is primarily concerned with the issue of protecting this sensitive data from network eavesdroppers.

    So basically, even after these vulns are fixed, the attacker can just NSL the cloud providers and, boom, surveillance slurping continues.

  • I_Miss_DanielEnglish
    5•2 months ago

    Swype is not listed in this document.

    I didn’t read far enough to see if it only affected pinyin (Chinese) cloud features or all languages.