Maxthon Browser Sends Sensitive Data to China (!)

SecurityWeek ^ | July 14, 2016 | Eduard Kovacs

[Utilizer]

...

Developed by China-based Maxthon International, the browser is available for all major platforms in more than 50 languages. In 2013, after the NSA surveillance scandal broke, the company boasted about its focus on privacy and security, and the use of strong encryption.

Researchers at Fidelis Cybersecurity and Poland-based Exatel recently found that Maxthon regularly sends a file named ueipdata.zip to a server in Beijing, China, via HTTP. Further analysis revealed that ueipdata.zip contains an encrypted file named dat.txt. This file stores information on the operating system, CPU, ad blocker status, homepage URL, websites visited by the user (including online searches), and installed applications and their version number.

While dat.txt is encrypted, experts easily found the key needed to decrypt it, giving them access to the information. Exatel researchers demonstrated how a man-in-the-middle (MitM) attacker could intercept the data as it travels from the client to the Maxthon server in China.

The ueipdata.zip file is created and sent to Maxthon servers as part of the company’s User Experience Improvement Program (UEIP). The role of the program is to help the developer understand its users’ needs and deliver better products and services. The vendor claims the program is voluntary and “totally anonymous.”

...

[Utilizer]

Never heard of this browser, but others might have and the methods utilized (!) therein might well be better scrutinized by the coding populace out there to determine if any of the problems discovered thus far might be affecting other browsers as well.

NEVER trust the ChiComs!!!

[TigerClaws]

China makes a ton of the processors The processors are hard wired to hack.

They are playing chess; we are playing checkers.

[Utilizer]

And, it would appear, Chinese Checkers at that!

[wideminded]

All browsers send some data back to headquarters to identify the cause of crashes, etc. Google is definitely developing profiles of people through Chrome and with all their other applications. The question is what is the motivation of the people providing these types of free software and how much can you trust them. With google it is probably mostly about money. With the Chinese, maybe some other things too.

That said, just yesterday I was looking at buying a new router when I noticed a prior owner complaining that his router had been sending a lot of encrypted data to somewhere in Asia.

[Tolerance Sucks Rocks]

PING!

[John Robinson]

Google, Microsoft, etc, are almost certainly sending legit dump files, at user discretion, for the purpose of debugging. The browser in this article has no business sending that type of data, it is spyware.

[Utilizer]

I use Opera, or occasionally Firefox. Both browsers display a pop-up window when they crash (Opera rarely, Firefox repeatedly) and notify you that an error has occurred then ask if you wish to send info about it back to the designers.

Rarely do I click on “Yes”.

The browser noted above appears to be sending info on a continual basis and unrelated to crashes. Thus the concern.

[minnesota_bound]

I use to use the Maxthon browser about a dozen years ago as they had tabbed browsing when IE and Firefox did not.
Now I use Firefox. I wonder who they are sending the data to?

[Utilizer]

Chinese hackers. No matter who, though, no one should be sending any info from your machine(s) unless it is you doing the selecting and sending.

[wildbill]

I have been using Maxthon for years, even back when it had another name. I think it was created by some Chinese IT people back in the day as a competitor to Netscape. (Anyone remember Netscape?)

It developed a lot of very functional and even revolutionary user friendly features that other browsers later added to their platforms.

I’ll take this info to the user group and see what’s what.