Maxthon sends sensitive data back to China

[Ink]

Source: Maxthon Browser Sends Sensitive Data to China | SecurityWeek.Com

Researchers at Fidelis Cybersecurity and Poland-based Exatel recently found that Maxthon regularly sends a file named ueipdata.zip to a server in Beijing, China, via HTTP. Further analysis revealed that ueipdata.zip contains an encrypted file named dat.txt. This file stores information on the operating system, CPU, ad blocker status, homepage URL, websites visited by the user (including online searches), and installed applications and their version number.

While dat.txt is encrypted, experts easily found the key needed to decrypt it, giving them access to the information. Exatel researchers demonstrated how a man-in-the-middle (MitM) attacker could intercept the data as it travels from the client to the Maxthon server in China.

This is not the first time researchers have raised concerns about web browsers developed by Chinese companies. Experts at the University of Toronto’s Citizen Lab have identified security and privacy issues in several popular Chinese browsers, including QQ Browser, UC Browserand Baidu Browser.

 

[Noxx]

I used Maxthon very briefly, and the UI was ugly and it ran slow. This just reaffirms why I'll never touch it again.

 

[Exterminator]

Two security firms have confirmed that the Maxthon web browser collects sensitive user information and sends it to its servers, even if the users opts out of such behavior.

According to reports from Exatel and Fidelis Cybersecurity, the issue resides in the current implementation of User Experience Improvement Program (UEIP), a feature included with Maxthon browsers.

UEIP lets the browser manufacturer collect analytics information about how users utilize the browser. All browsers do it, including the big ones such as Firefox and Chrome, but to a certain extent.

Collecting more data than normally needed
Exatel and Fidelis claim that Maxthon is collecting more information that what would normally be considered acceptable.

The list includes OS version, screen resolution, CPU type, CPU speed, amount of memory installed, location of the Maxthon executable, ad blocker status, browser homepage URL, the user's entire browser history, all of his Google searches, and a list of other applications installed on his system, including their version numbers.

Exatel says it found all of this data inside a file called ueipdat.zip, sent regularly from the user's browser via HTTP to Maxthon's servers in China.

Inside this ZIP, researchers found an encrypted file called dat.txt. Exatel says it was able to crack the encryption, an AES-128-ECB cipher, using the passphrase eu3o4[r04cml4eir, found hard-coded inside the Maxthon browser's binary. Dat.txt contained all the data mentioned above.

A bug or an intentional design?
Maxthon did not directly reply to Exatel's inquiries, but users confronted the company on its forum. Here, a Maxthon rep responded by saying that when users opt in the UEIP program, the browser collects all the above sensitive data, but when they opt out, it only collects basic data regarding the browser's status, but not any user-specific information.

According to Exatel and Fidelis, this is not true, and in their tests, after opting out, the Maxthon browser kept sending the same data to the browser maker's servers.

Softpedia has reached out to Maxthon's representatives, extending them the courtesy of answering this criticism in the public forum.

Previously, security and privacy researchers from Citizen Lab have discovered a similar behavior in other Chinese browsers such as QQ Browser (March 2016), Baidu Browser (February 2016), and UC Browser (May 2015).

 

[jamescv7]

Maxthon being free is surely prone for possible privacy collection mechanism in order to have revenues.

+ Considering the location (China based) therefore the rest are already history.

 

[Aleeyen]

These kind of companies are bringing a bad name to Chinese software industry. It had become really difficult to differentiate good companies from the bad ones, so even if there is a good company it will be looked with a bad eye. Its high time that Chinese companies stop doing these kind of activities. Without that Chinese software companies will never be able to become world class companies.