The 4th largest mobile browser exfiltrates users’ data even in Incognito mode
Executive summary
UCWeb, a Chineses mobile internet company owned by Alibaba Group is exfiltrating user browsing and search history from its products distributed on mobile devices around the world even when the browser is used in incognito mode. This behavior is consistent on both Android and iOS devices.
UCWeb advertises the product incognito mode to be a private & secure way of browsing the internet. However, they are exfiltrating the users activity to UCWeb’s servers.
UC Browser, the company’s main product, is the 4th largest browser on the mobile market.
However, upon a closer scrutiny by me and fellow researcher Nicolas Agnese we found… well… this:
Setup
- iOS/Android device with MITM proxy TLS certificate installed
- Latest versions of UCWeb on both iOS and Android
- MITM proxy capturing HTTP+HTTPS traffic
- VPN with different exit points
Note: You need a transparent proxying system for Android as no data will be sent if a proxy is detected.
General findings
The behavior is a bit different across platforms. While for iOS the sensitive data is just gzipped, on Android additional care against snooping is taken with traffic being AES encrypted after its compression.
While the format differs, the overall behavior is the same. The browser will send to UCWeb’s servers data usage logs including detailed information of browsed URLs and searched terms, device details and other sensitive information.
iOS
The requests are made over HTTPS connections, and contain binary data, which is gzip compressed data with no password nor additional encryption. Once we decompressed the data we observed the sensitive information.
This behavior was observed regardless of the IP our device was browsing from, including US, Europe and India. Details about browsing activity in incognito mode were also exfiltrated with the same level of detail.
Upon launching an incognito tab the user would expect to not have any of the metadata sent outside of its device, just as modern browsers minding users privacy behave, and as advertised on the UC Browser’s website (https://www.ucweb.com/).
However, only a few seconds after visiting the website the team discovered that the whole browsing history (even while in incognito mode) is sent to the UCWeb servers. Just by leveraging a MITM proxy and Gunzipping the traffic any researcher can duplicate these findings:
The request is easy to decode, we can just Gunzip it and get to the decoded data:
In addition to that, the data is annotated with the following:
- Unique serial number of the device (internal to UCWeb)
- Exact timestamp of when the navigation event happened
- Complex geolocation data such as neighbourhood and town
- IMEI and MAC of the device (seems to be left blank for the moment though)
Device details are sent in lines starting with: lt=uc:
Browsing details are sent in lines starting with lt=ev and ct=eagle_eye:
Other values in ct are: normal, infrastructure, int_news_flow, cards_flow, video, develop and monitor.
Search queries are logged with: […]`ev_na=search`[…]`from=private:
These also contain the searched query and the UI source, indicating where it originated. Either in an incognito mode tab (private) or some other tab (home_l).
Android
After installing the UC browser we noticed a lot of pingbacks to their servers even when the browser was used in incognito mode.
By manually inspecting the bodies of the request we can already see that they are sending the domains visited to their servers:
However, this is not enough as I want to get conclusive proof on the amount of data being exfiltrated from my device.
After firing up an AES interceptor we managed to inspect some of the strings being encrypted by the app:
{“w_tm”:”1621365464",”w_bid”:”u4_default”,”w_url”:”http:\/\/www.winnie-pooh.org\/pooh-stories.htm","ps":"com.UCMobile.intl","pid":"22318","stime":"1623345420651","type":"pvuv","fr":"android","mcc":"denied","pkg":"com.UCMobile.intl","vcode":"50186","dsp_w":"1080","rom":"10","dsp_d":"300","wid":"76b24e88-a1dd-4256-a4dc-1c99be62ff74","tmem":"7659","sdkver":"1.0.0.8","ctime":"1621365464","model":"RMX1971","lang":"en","dsp_dpi":"480","net":"wifi","brand":"realme","dsp_h":"2132","ver":"13.4.0.1306","product":"UCMobile","mnc":"denied","ip":"185.226.144.94","bsver":"inapppatch64","bver":"13.4.0.1306","bserial":"210428170421","appid":"UCMobileIntl","amem":"3424","sdk":"29","tzone":"Asia\/Jayapura","crver":"4.1.1.0","crserial":"210426141251"}
The data exfiltration happened in incognito mode:
In order to validate that the data encrypted is the one that’s actually sent over the wire we dived deep into the code so we can find a way to decrypt the live traffic. By hooking all the AES calls and manually checking each of them we discovered a stack trace of the request that produced the JSON above:
By reversing the APK using JADX we can find the code snippet ingesting the above ciphertext.
Data encrypted before being sent over the wire
The Cipher object above is instantiated with a hardcoded IV of 0x0 and the bytes contained in the key string QcBe1t#jvn9$ea8f
The function above is fed a gzip of the JSON which is then pushed to px-intl.ucweb[.]com/v1/raw/upload
By leveraging the decryption key above we can decode the ciphertext and inspect the payload sent over the wire (CyberChef link):
Seen above can be a visit to a website just opened in the browser as per the iOS example. In addition to the visited URL the browser sends the IP of the user and a proprietary ID which seems to have been the same over the duration of the analysis. This could easily fingerprint users and tie them back to their real personas.
To reiterate, as it can be seen below, the website was opened in incognito mode:
It’s not consistent with the privacy representation UCWeb made for the browser to send anything to any logging server while the incognito mode is on. However, this is not the case. In addition, the domain where the data is sent is listed under a Chinese registrar but has US IPs:
This is not the first time UCWeb had privacy issues. While the findings are no longer applicable (the exfiltration mechanism/endpoints were changed), the problem remains nonetheless. At the time of the writing these issues have not been fixed even after contacting Alibaba, with user browsing/location data being sent to UCWeb’s servers in real time.
Domains of interest
Domain
gjapplog[.]uc[.]cn
Registrar
China Internet Network Information Center (CNNIC
Creation Date
2003–03–17
Expiration Date
2022–03–17
IP Address
168.235.204[.]12
157.185.133[.]31
157.185.133[.]129
8.37.236[.]197
Country
CN
Domain
px-intl[.]ucweb[.]com
Registrar
Alibaba Cloud Computing (Beijing) Co., Ltd.
Creation Date
2003–05–20
Expiration Date
2023–05–20
IP Address
157.185.188[.]1
157.185.128[.]218
157.185.128[.]213
Country
CN
