An American researcher has discovered a spy code in the code of the mandatory application for participants in the Beijing Winter Olympics, which is wiretapping around the clock and sending everything to Chinese servers. Previously, The New York Times warned about the potential danger of the service, but it is still used by both athletes and the entire staff of the upcoming Olympics.
Big Brother
Intelligence researcher Jonathan Scott has discovered that the must-have app for Beijing Olympics participants for iOS and Android is spying on Games participants. He posted his findings on Twitter after researching the My 2022 app, which turns out to spy on users by recording audio and sending it to Chinese servers for transcription.My 2022 is an application that requires athletes, coaches, journalists, management and all staff of the Beijing 2022 Winter Olympics to provide their health information to the Chinese authorities. It is designed to track the spread of COVID-19 and also serves as a clearinghouse for information about events, weather, and places of interest. Users will also be required to enter their passport details, arrival and departure information from China into the apps.
The description in the App Store states that
The app collects only "anonymous" data, like any modern app - contact information, location, and so on. There is no information indicating that My 2022 is wiretapping and directing the recording to Chinese servers.
Scott, in turn, proved that the application is indeed spyware. To do this, My 2022 does not use any exploits or security holes in smartphones - it just actively listens. The only way to stop eavesdropping is to uninstall the app, as closing it doesn't help. The application itself gives permission to work and record everything that happens in the background.
It also became known that My 2022 uses the artificial intelligence technology of the Chinese startup iFlytek, which was previously blacklisted by the United States due to its alleged connection with the "Uyghur genocide" in China.
In mid-January, The New York Times, citing a Citizen Lab study, warned that My 2022 had serious flaws in data encryption. This, according to the publication, puts thousands of participants at risk and "raises questions" about the security of COVID-19 outbreak tracking systems.
The report notes that My 2022 does not encrypt data sent to the server in any way, which makes it easy for hackers to intercept it. In addition, the built-in messaging service does not encrypt metadata, allowing attackers or administrators of public Wi-Fi hotspots to determine who sent messages and when.
"Any information you transmit can be intercepted, especially if you are on an untrusted network such as Wi-Fi in a cafe or hotel",
- said Jeffrey Nokel, researcher at Citizen Lab and one of the authors of the study. He believes that confidential information obtained in this way can be used for identity theft.
The head of the B-152 personal data protection department, a certified information privacy professional (CIPP / E) Maxim Zinoviev, in an interview with, said that the My 2022 application clearly violates the rights of its users.
“The My 2022 app is a violation of the fundamental rights of Beijing 2022 Olympic Games guests, athletes and other users. Since November 2021, China has introduced a new Personal Information Protection Law of the People's Republic of China (PIPL), which is designed to protect the rights of personal data subjects in China. PIPL is one of the laws adopted after the GDPR, and in many respects borrows the principles of the EU Regulation. It is obvious that the developer of the My 2022 application violates the basic PIPL standards on data processing transparency and risk assessment when implementing technologies such as voice recording,” Zinoviev believes.
Previously, the UK, Germany, Australia, the US and many other countries advised their athletes not to take personal gadgets to the Olympics due to the possibility of espionage by China. Instead, they were offered to give out disposable phones.
bbabo.Net