Qualcomm smartphone chips exposed for unauthorized data collection

Recently, German security company Nitrokey found that smartphones equipped with Qualcomm Snapdragon chips sent some data directly to Qualcomm servers without the participation of the Android system. The issue has raised consumer concerns about privacy and data security.

Nitrokey experimented on a Sony Xperia XA2 phone. The phone is powered by a Qualcomm Snapdragon 630 chip and runs Android without Google services. The researchers used the Wireshark tool to conduct packet analysis and found that the phone would transmit data to an izatcloud.net server belonging to Qualcomm. It is worth mentioning that, including Android phones and iPhones using Qualcomm communication modules, about 30% of the world's mobile phones use Qualcomm chips.

Worryingly, the data was sent over the insecure HTTP protocol without additional encryption. This means that anyone can access and read the unique identification data sent to Izat Cloud.

In response to this issue, Qualcomm responded that data transmission follows the privacy policy of the XTRA service. However, according to Nitrokey's investigation, Qualcomm's custom AMSS firmware takes precedence over any operating system and uses the insecure HTTP protocol. This could allow third parties to create unique device signatures based on the collected data, further violating user privacy.

As the world's leading smartphone chip manufacturer, Qualcomm's products have extensive influence in the market. The incident has raised public concerns about data security and privacy on smartphones. In the current environment where the world is increasingly emphasizing privacy protection, whether this issue will have a negative impact on Qualcomm's reputation and market position deserves continued attention.

For a detailed report on this issue, visit Smartphones With Popular Qualcomm Chip Secretly Share Private Information With US Chip-Maker.