QQ以及微信内藏危险的木马软件 难清除

Safeguard Defenders, September 10, 2017

A new report by a Lookout, a Cybersecurity company, has generated renewed interest in the security, or lack thereof, of WeChat and QQ (https://blog.lookout.com/xrat-mobile-threat). Despite this, there has been limited attention paid to this explosive new revelation.

It has long been known that due to WeChat keeping its servers inside China, the lack of legal protection of privacy data, and the control over companies by police, that WeChat data is not safe, and can, without protection, be accessed by police or other state actors more or less at will. This has naturally made people shy away from using WeChat for any more serious or political discussions. More and more court cases of people being prosecuted simply based on private chat messages to friends have further illustration this. At the same time, at the time of the Occupy Central movement in Hong Kong, it was shown that a ‘Trojan’ virus was being employed to surveil users remotely.

xRAT. That’s the name of the new discovery. Like the earlier virus found, it’s a ‘Trojan’ virus, meaning it masks itself as something else, for example a PDF file, and you will be unaware of if you have it on your phone by now. It specifically targets you through your WeChat or QQ account.

So what’s the big deal?

The ‘Trojan’ operates with administrator privileges. It means it can access and control any and all aspects of your phone. It also means it can do so without you noticing. In fact, it can remotely get ‘full control’. If you want to understand what this means it is this: it has as much access to your phone as if you were to give it to someone, and then tell them your PIN code. Full control.

This means that not only your WeChat or QQ use is exposed. All of your phone is exposed. Photos stored, downloads, documents, any Apps to other services installed, chat logs, phone records, contact lists, and of course, your browser and its entire browsing history, which may include credit card and password and login information to other service, for example encrypted emailing you use.

In short, any phone that has WeChat on it, and is also used to access work emails, or secure chat programs like Telegram or Signal, can now be in the hands of Chinese police or state security. For the community of supporters of human rights in China it moves from bad to terrible. You can now, if you communicate with human rights defenders in China through secure Apps or emailing on a phone that has WeChat or QQ installed, inadvertently be giving the Chinese police material that will incriminate those human rights defenders and land them in prison.

To make matters worse, administrator privilege means you microphone can be turned on, and stream whatever is heard to the Chinese police. Same with video camera and camera. It is a most sophisticated spying tool with far-reaching consequences. It can, it goes without saying, read you location, as well as the specific meta-data of your phone.

If that wasn’t enough, there is one last thing, which makes it such a sophisticated virus. It can auto destruct itself. And when doing so, it can not only delete itself from your phone, but wipe much of your phone log data, making it hard even for technically skilled people to know that the virus was ever there. In short, you might never know if your phone, your use, is the reason someone has landed in prison.

A number of control centers in China has been identified to where such data and traffic goes. The code is such that there is little doubt that this ‘Trojan’ comes from the same people behind the earlier ‘Trojan’ targeting Hong Kong Occupy Central people, just much more sophisticated.

Should I worry? What to do?

First off, there is still some lack of understanding how the infection spreads to your phone. At the same time, there is little reason to think resources would be spent to develop such a tool, and then not try to use it. An earlier, much less sophisticated version, was used extensively during the Occupy Central movement. Why would the police and state security organs not use a tool if it’s already been developed, and if it’s this powerful? It should go without saying that you need to operate as if it’s being used widely, and as if you were a target.

Most people with risk awareness will already have made sure to not use WeChat or QQ, or if they felt a strong need to have it, have it installed on a second phone which is not used for anything else. If you need WeChat, like many unfortunately feel they do, at the very least, install it on a blank, factory-reset second phone, like a super cheap android phone. Due to microphone remote control, make sure to never have it in your office or at any discussions.

Secondly, your current phone, if infected, will not be secure just by uninstalling WeChat and QQ. You will have no choice but to do a factory reset. This may be an inconvenience, but it is the only way. It goes without saying that any existing PIN codes, passwords to work emails, etc., will need be changed after you have done this factory reset.

info@safeguarddefenders.org

From the editors:

Since this post was launched, we have heard several complaints such as this one: “the article misrepresents the malware report, which does not mention WeChat or QQ as delivery method, but instead as targeted data.” It is true that the threat is posed by a ‘Trojan’ virus, an external program designed to utilize weaknesses through WeChat and QQ. The vulnerability begins when the xRAT “Trojan” has infected your phone, and the “Trojan” aims at infecting those using WeChat or QQ. The WeChat and QQ programs themselves do not contain the “Trojan.” The silent mode in which it can operate nonetheless makes it hard to know if your phone has been infected. The mode of infection, for example through having downloaded and opened a PDF or other type of file, continues to be studied and the mode of infection is not yet clear.

网络安全公司Lookout在对微信和QQ的安全性（或者缺乏安全性）进行了研究后，最近发布了一份新的报告(https://blog.lookout.com/xrat-mobile-threat)。尽管研究结论十分惊人，但却没有能够引起足够的注意。

微信的服务器在中国大陆，那里缺少对私人数据的法律保障，公司处于公安的控制下，所以微信的数据没有安全保障，随时可以被警方或其他政府部门监控以及浏览。这是早已为人所知的事实。因此很多人在进行政治或比较严肃的讨论时都不再使用微信。在越来越多的法庭案件中，一个人被起诉仅仅是基于和朋友的私密聊天记录，这也证实了微信是不安全的。与此同时，在香港占中运动期间，一种 “特洛伊”木马病毒被用来远程监视用户。

这次研究发现的新病毒名叫xRAT。和早期发现的病毒一样，这也是一个特洛伊病毒，这意味着它会伪装成别的软件，比如一个PDF文档，就算你的手机内现在已经有了这个病毒，你也无从得知。这个病毒通过你的微信和QQ账户而将你作为目标。

它的威胁是什么?

特洛伊病毒具有管理员的运行权限，也就是说它可以进入和控制手机内的方方面面，而且能在你不知情的情况下操作。实际上它还可以远程对你的手机实行“完全监控”。简单来说，它所具有的权限就好比你直接将手机交给某人，然后告诉他你的手机密码。那人想干什么干什么。

也就是说不仅仅是你的微信和QQ的信息被曝光，手机所有的操作都会被曝光。存储的照片、下载的东西、文档、已安装的应用和服务、聊天记录、手机历史记录、通讯录，当然，还包括你的浏览器和整个浏览器历史记录，这可能包括你的信用卡号和密码以及任何其他服务的登录信息，比如你使用的加密邮箱。

换句话说就是任何手机只要是有安装了微信，同时也在用这个手机登录工作邮箱，或是安全的聊天软件比如Telegram或Signal，就很有可能已经被中国警方或国安掌控了。对于中国的人权支持者群体来说，这比糟糕还要糟糕。如果你用已安装了微信和QQ的手机与其他的中国维权人士用安全软件沟通或发邮件，相当于无意间给警方提供了将那些人权捍卫者送进监狱的支持材料。

更糟糕的是，病毒拥有管理员权限意味着你的麦克风可以被启用，你发出的任何声音都可能流向监视中的中国警方，被他们听到。这同样地适用于照相机和摄像机。这是一个能造成巨大后果的最先进间谍工具，它根本不需要读取你的地理位置，也不需要你手机的具体元数据就能照常工作。

如果这些还不够，再列出一件事，也是为什么它是如此先进的病毒的原因。那就是它可以自动销毁。当它自动销毁的时候，不仅仅是将自己从你的手机中删除，并且会尽可能的删除你手机内的脚本信息，这令很多的技术高超的人都无从得知这个病毒曾经在手机内存在过。也就是说，你也许永远不会知道你的手机和你操作手机的方式是将其他人权捍卫者送去监狱的原因。

在中国大陆，这些数据最终所流向的控制中心已经被识别出好几个，而且毫无疑问这个“特洛伊”与早前攻击香港占中人群的背后是同一批人，只不过这一次的要更先进得多。

我应该担心吗? 我该怎么做?

首先，我们还不太明白这种病毒是如何传染到你的手机的。同时，他们既然开发了这么高端的软件，就不可能不派上用场。早前，一个更简单的版本广泛地用到了占中运动的人群身上。警方和国安机关有什么理由不使用这个他们已经开发好的、如此强大的软件呢？所以几乎毫无疑问的是，你需要假设他们已经广泛的使用上了，并且你自己已经成为目标之一。

很多有风险意识的人都已经放弃了微信和QQ的使用，就算如果他们实在有使用的必要，也会用另一个什么都不用的手机专门安装微信使用，如果你很不幸的与其他很多人一样在使用微信，请至少安装到了一个有进行了出厂设置的备用手机，比如一个超级便宜的安卓手机。关于避免麦克风远程控制的问题，要确保不要将备用（安装了微信的手机）手机带到办公室或在进行任何谈话的时候。

其次，如果你目前的手机被感染了，仅仅卸载掉微信或QQ并不能解决问题，你别无选择，只能进行出厂设置。也许这样并不是很方便，但这是仅有的办法。另外，毫无疑问的是之前工作邮箱所用到的密码等等，在完成出厂设置后都需要被更换。

原文连接 https://chinachange.org/2017/09/10/what-to-make-of-the-explosive-new-wechat-and-qq-spying-revelations/