Chinese app Meitu which has gained extreme popularity worldwide allowing users to apply “beauty” filters and virtual makeup to their photos has been revealed to be phoning home to servers in China with plenty of data that raises severe privacy concern. Meitu is available for both Apple iOS and Android phones and the data being transmitted to untrusted remote servers even include the phone’s IMEI, mac address, resolution, OS version and more. As is typical with many photo editing apps, access to camera and photos are expected but access to many other information are quite suspect. The app even makes up to three different attempts to identify whether the phone is jailbroken on the iOS version, while on the Android version, it asks for up to 23 permissions.
Infosec expert Greg Linares points these permissions out on his Twitter account:
Let me get this straight…
All of you just installed a photo app from China that requires these permissions? Let me know how it works out. pic.twitter.com/wGDUYbRdSA— Greg Linares (Laughing Mantis) (@Laughing_Mantis) January 19, 2017
The app company itself, denies any allegations that the behaviour is suspicious in anyway. In a statement to CNET, a Meitu spokesperson explains that they are not after the data and are not selling it to 3rd parties. The data collection code, they say apparently was put in place to get around the fact that tracking services provided by Apple and Google are blocked in China. “To get around (the tracking), Meitu employs a combination of third-party and in-house data tracking systems to make sure the user data tracked is consistent, Furthermore, the data collected is sent securely, using multilayer encryption to servers equipped with advanced firewall, IDS and IPS protection to block external attacks.” said the Meitu spokesperson.
Meitu went public last month at the Hong Kong Stock Exchange with a $629 USD million initial public offering. The company itself is based out of Xiamen, China but has offices worldwide in Brazil, Hong Kong, India, Japan, Indonesia, Singapore and the United States. There are over 1.1 billion unique devices activated worldwide with the app and generates approximately 6 billion photos per month.
