Investigation into a Chinese spy app
Fraunhofer SIT researcher assists with file association
After crossing the border into China, a journalist discovered an unfamiliar app on his smartphone. He suspected that border officials had installed it. To find out more about the app, a group of journalists (including those from the Süddeutsche Zeitung) teamed up with IT security researchers to examine it more closely. Fraunhofer SIT scientist York Yannikos, an expert in IT forensics, was also involved.
What exactly did you investigate for the Süddeutsche Zeitung?
The investigative team asked me to help match a list of approximately 73,000 cryptographic hashes (see box) with their corresponding files. The team had found this list in the app under investigation.
The hashes alone are initially useless; unfortunately, they don’t reveal anything about the type of files or their contents. However, you can search hash databases online and compare them with the hash list from the Chinese app. Accordingly, I queried all 73,000 hashes against various hash databases to determine whether the hashes were already known and could thus be matched to specific known files.
Why was the hash list stored in the app?
The Chinese app compared its hash list with the hashes of the files stored on the spied-on smartphone. In this way, it essentially searched for content that the Chinese government considers suspicious.
What kind of content does the app look for?
We didn’t find nearly all the hashes in the hash databases. But the ones we were able to identify were mostly harmless material related to Islam, such as MP3 files with recitations of the Quran, as well as obviously Islamist material, such as PDFs from the Islamic State. The hash of a text by the Dalai Lama was also included in the list.
How else can the Media Security and IT Forensics department support journalists?
We offer authenticity checks for audio, video, and image material—in other words, we look for signs of manipulation in multimedia data. We also examine data storage devices, for example, for hidden or deleted files, which we then recover, and we analyze smartphones, etc. The requests are very individual and varied.
More info on Media Security and IT Forensics
What is a hash?
A cryptographic hash of a file functions like a kind of electronic fingerprint. A specific hash can be assigned to a file using a hash algorithm—of which there are many different types. A hash is very easy to calculate from a file and is uniquely linked to it. However, no conclusions about the type or content of the file can be drawn based on the hash alone.