Google’s latest flagship smartphone raises concerns about user privacy and security. It frequently transmits private user data to the tech giant before any app is installed. Moreover, the Cybernews research team has discovered that it potentially has remote management capabilities without user awareness or approval.
Cybernews researchers analyzed the new Pixel 9 Pro XL smartphone’s web traffic, focusing on what a new smartphone sends to Google.
“Every 15 minutes, Google Pixel 9 Pro XL sends a data packet to Google. The device shares location, email address, phone number, network status, and other telemetry. Even more concerning, the phone periodically attempts to download and run new code, potentially opening up security risks,” said Aras Nazarovas, a security researcher at Cybernews…
… “The amount of data transmitted and the potential for remote management casts doubt on who truly owns the device. Users may have paid for it, but the deep integration of surveillance systems in the ecosystem may leave users vulnerable to privacy violations,” Nazarovas said…
This argument assumes that they’d only do something if they could get perfect coverage, which isn’t very compelling for me. IMO the question should be “would it give enough access to more information to be worth it”, not “it’s only worth it if it gives access to all information”.
And, as the other commenter mentioned, it is difficult to get some Chinese phones, though not impossible and if this whole line of thought plays into that, the reasoning is probably as much about cutting off their access to this kind of thing as it would be about making it harder to avoid western agencies doing this. They’ve said the first one out loud (they being politicians justifying blocking Huawei), and wouldn’t have said the second part either way.
Doing this and not covering like half of the phones out there would be even dumber, and way too risky. It’s not just about Chinese phones, the most popular smartphone vendor, Samsung, is from South Korea. Yeah, South Korea is a US ally, and the NSA might have some kind of crazy deal in place with them to backdoor their phones, but that would exponentially increase the risk, as not only would the NSA and all the US phone manufacturers have to keep this a secret, the South Korean government as well as Samsung, which is a massive corporation with hundreds of thousands of employees, would also have to make sure that none of this gets leaked to the public. This is way too unrealistic, and can easily be dismissed as a conspiracy theory.
I think you’re greatly overestimating the number of people who would need to be involved. It could be done by one person in the right RTL design position. ASIC validation doesn’t involve exhaustively searching for any backdoors that bridge between something accessible with low privileges to something that is supposed to require higher privileges.
And if someone else did notice that, there’s a good chance it would just be a “thanks for reporting that, I’ll fix it” without a root cause investigation about how it got there, especially if it gets reported to the one who put it there in the first place.