Phone Chip Provider Secretly Collected User Info
This post is also available in: 
עברית (Hebrew)
A US company specializing in manufacturing wireless telecommunications hardware has allegedly been collecting user data in secret. Chips produced by the Qualcomm company are used in approximately a third of all Android devices, as well as some Apple smartphones.
Research published by Nitrokey on April 27th claims that hardware produced by Qualcomm was uploading users’ private data, including IP addresses, to a cloud attributed to the company without their consent.
As data sharing with Qualcomm is not mentioned in Sony’s terms of service (the vendor of the device used by a researcher), Android, or /e/OS either, this might violate General Data Protection Regulation laws (GDPR).
Paul Privacy, the researcher behind the report, claims that on top of the concerns regarding consent, the data packages are sent via the HTTP protocol and are not encrypted using HTTPS, SSL, or TLS. This makes them vulnerable to attacks.
By collecting this data and creating record history using the phone’s unique ID and serial number, anyone on the network — including malicious actors, government agencies, network administrators, and telecom operators could easily spy on users.
According to the company, the collection of information was in accordance with their privacy policy that states the following: “Through these software applications, we may collect location data, unique identifiers (such as a chipset serial number or international subscriber ID), data about the applications installed and/or running on the device, configuration data such as the make, model, and wireless carrier, the operating system and version data, software build data, and data about the performance of the device such as performance of the chipset, battery use, and thermal data. We may also obtain personal data from third party sources such as data brokers, social networks, other partners, or public sources.”
As reported by cyber news.
