No, Samsung phones aren't really sending your personal files to China

Last updated: January 29th, 2020 at 11:29 UTC+01:00

A bit of fuss was caused recently by a post on Reddit which claimed that Chinese spyware was present on all Samsung smartphones and tablets. The insinuation wasn't that this was due to some security vulnerability, rather that it was by design.

The sensationalist championship of the Reddit mail aside, its author explained that Samsung has partnered with a Chinese antivirus company of questionable reputation for the storage scanner feature in the Device Care department. When it's run, the feature pulls some data from your device and sends it to Chinese servers. There'south more here than meets the eye, though, and Samsung has now set the record direct.

Samsung phones aren't sending your files to China

It'due south important to understand what this feature is first. Device Care is part of Samsung'south custom Android experience and it can't be removed, as such, all of the utilities it offers can't be removed as well. The storage scanner looks for junk files that can be removed to complimentary upwards infinite on your device. It'south a useful characteristic as yous can often gratis up several GBs worth of infinite that was taken upwards unnecessarily.

The Chinese company that Samsung has teamed up with for storage scanner is called Qihoo 360. Its reputation is far from perfect equally it has been involved in several controversies. In 2012, a whistleblower had claimed that the company'south 360 Secure Browser had a hidden backdoor. Information technology's likewise known for complying with the Chinese government'south censorship directives and may presumably turn over information to information technology when asked to do and then.

The conclusion drawn was that since storage scanners need access to all files on a device to do what they do and that the one in Device Care was communicating with Chinese servers, it could be sending users' files to China without their noesis. The redditor conducted packet testing to see which domains his Milky way S10 was communicating with.

Upon tapping on the selection to manually update the database, he noticed that the phone started communicating with Chinese servers. While this did establish that the utility was communicating with Chinese servers, information technology didn't reveal exactly what was being sent, as the author himself pointed out. In no way did this confirm that a partner that Samsung had allowed access to was abusing that to lift your files.

Clarifying the matter to The Verge, Samsung says that the just information that'southward sent to Qihoo 360 is not-specific information like the model of your phone, Os version, total storage chapters and other generic information used to optimize storage. Qihoo doesn't become any data that would enable it to locate a particular file on a user's device.

What the Chinese visitor does is simply provide a reference library of unnecessary/junk files that tin be deleted to free up infinite. That library is too stored on the device itself. Device Intendance's storage scanner simply uses the library to find out which files should be deleted. The deletion process is carried out by Samsung's own software, Qihoo plays no role in that. "The storage optimization process, including the scanning and removal of junk files, is fully managed past Samsung'southward device care solution," a Samsung representative confirmed.

Instead of diverting its own resource to maintain a library of junk files that its storage scanner could use, Samsung has just outsourced that task to Qihoo. The Chinese company's role in this doesn't extend across that. It'southward understandable that the words China and spyware in a judgement are enough to cause suspicion just Samsung deserves the benefit of the doubt. You can't expect a company with the size and experience that Samsung has to make a rookie fault.