In this report, we examine cloud-based pinyin keyboard apps from nine vendors (Baidu, Honor, Huawei, iFlyTek, OPPO, Samsung, Tencent, Vivo, and Xiaomi) for vulnerabilities in how the apps transmit user keystrokes. Our analysis found that eight of the nine apps identified contained vulnerabilities that could be exploited to completely reveal the contents of users’ keystrokes in transit. We estimate that up to one billion users could be vulnerable to having all of their keystrokes intercepted, constituting a tremendous risk to user security.
  • @GenderNeutralBroEnglish
    7•24 days ago

    Naomi Wu, AKA Sexy Cyborg, talked about how this vulnerability could leak chats in secure messaging apps last year. It got her a visit by the Chinese police and she can no longer post videos online.

    See: https://www.hackingbutlegal.com/p/naomi-wu-and-the-silence-that-speaks-volumes

    “Ok for those of you that haven’t figured it out I got my wings clipped and they weren’t gentle about it- so there’s not going to be much posting on social media anymore and only on very specific subjects. I can leave but Kaidi can’t so we’re just going to follow the new rules and that’s that. Nothing personal if I don’t like and reply like I used to. I’ll be focusing on the store and the occasional video. Thanks for understanding, it was fun while it lasted.” –@RealSexyCyborg, July 7, 2023