We use the phrase “easily decryptable encryption” to refer to the improper implementation of encryption algorithms. This analysis reveals that both versions of QQ Browser transmit a number of personally identifiable user data points either with no encryption or with easily decryptable encryption. This report provides a detailed analysis of how the Windows and Android versions of QQ Browser transmit user data during their operation. The application offers a number of features beyond those offered by built-in browsers, such as tabbed windows and integration with other chat platforms. QQ Browser (QQ浏览器) is a free web browser for the Android, Windows, Mac, and iOS platforms, developed by Chinese Internet giant Tencent.
Please see the “ Update: Analysis of updated versions of QQ Browser” section at the end of this report for our analysis of the latest versions (Windows version and Android version 6.4.2) released prior to publication, following our disclosure to the vender.The software updating processes of both the Android and Windows version of QQ Browser have vulnerabilities that leave them susceptible to an attacker executing arbitrary code.The Windows version of QQ Browser transmits personally identifiable data, including the URLs of visited websites, hard drive serial number, MAC address, and machine hostname, without encryption or with easily decryptable encryption.
The Android version of QQ Browser transmits personally identifiable data, including a user’s IMEI, IMSI, nearby WiFi access points, search queries entered into the address bar, URLs of pages visited, and Android ID, without encryption or with easily decryptable encryption.Both Windows (v) and Android (v6.) versions of web browser QQ Browser transmit personal user data to QQ servers without encryption or with easily decryptable encryption, and are vulnerable to arbitrary code execution during software updates.
0 kommentar(er)
