Police forcing me to install Jingwang spyware app, how to minimize impact?

Question

Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it.

Knowing that I may be forced to install it sooner or later, what are my options to prepare against it?

Ideally:

• Make it appear like the app is installed and working as intended,
• without having it actually spy on me.

The app is downloadable and documented. It basically sends the IMEI and other phone metadata, as well as file hashes, to a server. It also monitors messages sent via otherwise secure apps. I don't know whether it includes sophisticated anti-tempering features or not.

I can't afford two phones nor two contracts, so using a second phone is not a viable option for me.

Answer 1

This may not be the answer you will be happy with but how about abstaining from having any undesirable data inside your phone in the first place and instead using the right tool for the job?

According to Wikipedia:

The app records information about the device it is installed on, including its [...] IMEI, the phone's model and manufacturer, and the phone number. The app searches the phone for images, videos, audio recordings, and files [...]

So, instead of trying to tamper with this spyware in any way (which can get you in a much bigger trouble), simply don't do anything suspicious on this phone and let this app do its job. Prepare against it by not having any photos, videos, audios, file, etc., and instead use the right tool for the job. Use some other secure software/hardware to connect to internet, use encrypted email provider and do all of your communication through the computer where you can do communication safely, and store all of your files somehow in a safe place (encrypted, somewhere on computer or USB, etc). Pretend to be an obedient citizen and use the right tool for the job to do whatever it is you don't want your government to find out.

Some people may wonder why bother having a phone in the first place (and FYI, I asked the same question under OP's question, for clarification). My answer is:

1. to make phone calls (and have conversations which are not going to be considered by Chinese government suspicious, in case they are tracking that too)
2. to use it as a "red herring" - if police asks you to give them your phone you won't have to lie to them that you have no phone, or worry that they will find out that you tampered with app, or get in trouble if you don't have app, etc. You'll just confidently give them phone, with no "illegal" information on it, they will check it, and walk away. You may, actually, even have some "red herring" files: pictures of nature, shopping list (milk, eggs, etc.), etc., just so that they wouldn't suspect that you deliberately not using your phone for such purposes, and harass you farther.

I mean, not long ago mobile phones didn't even have the ability to store pictures, videos, files, etc.

Are you willing to put your life in danger simply because you want to have some files on your phone?

Tough times require tough decisions.

Answer 2

Get a phone which doesn't support Android apps.

Why are so many of the answers complex? And not just complex, fragile and suspicious and downright dangerous to the questioner?

You want to use your phone to send messages and make calls, right? You don't want this app installed, right?

Say hello to your new phone:

Good luck getting an Android app running on this.

It's probably not illegal to have an old phone.

Answer 3

This is a tricky one. It goes without saying, but it's also a dangerous one. Attempting to circumvent these restrictions and getting caught doing so will potentially cause a lot of legal trouble. If they throw people in jail for refusing to install the app, I wouldn't want to figure out what they do to people circumventing the app restrictions. It is especially relevant because even experts in tech security have gotten caught by their governments despite extensive safeguards (the founder of Silk Road is a great example and is now serving a life sentence). Granted, evading this app is most likely a much less serious "crime", but the Chinese government isn't exactly known for lenience here. So while I would like to answer your question, please don't take this as me suggesting that you actually do any of this. I consider myself a tech-expert, but I still wouldn't do it.

Still, to answer your question, you have a few options. I won't bother mentioning the "Get a second phone" option because you've already ruled that out.

1. Virtual Machine/Dual Boot

There are some options for "dual booting" android phones. I don't have any examples to immediately link to (software suggestions are off topic here anyway) but there are options. If you can get your phone to dual boot then you can install the tracking software on one ROM and then do all your personal stuff on the other. You may need to put some basic information on the ROM with the tracking app installed just so you don't raise too many flags.

Of course there are still risks here: risks that they might reboot your phone and notice, risks that they might realize you have a completely different system installed next to the tracked one, and the simple risk that you would go out and about and forget to reboot into the "tracked" system, allowing a police officer to find and install the tracking app on your actual system.

2. App modification/interceptors

If this app creates enough bad press it is possible that anti-tracking apps or hacked versions of this app may start floating around that try to automatically protect you from it. I would not expect there to be any general tools already available that would protect you from this, so this is something that would simply take lots of googling or (perhaps) requests to the right people. This has a major downside that unless you are an expert at reverse engineering, there isn't much to do to make this happen. It's also hard to estimate what the risks of detection are. That will obviously vary wildly depending on the skill level of the person who put it together.

3. Server Spoofing

Depending on your level of technological know-how you might be able to put something together yourself (note: this is not for novices). Based on what I know and my experience in this area, I'm going to try to summarize some details about what a server-spoofing measure might look like. Again, I'm not summarizing this because I think you should do it, but because understanding how things like this operate can be generally informative and also help understand the risks there-in.

Built-in security

First, we need to understand how this spying app might secure itself. From all information available so-far, the answer is "it doesn't". This is a pretty simple conclusion to come to because the app communicates exclusively through http. It is very easy to intercept http requests, either from the device itself (if your phone is rooted) or with network sniffing tools on a computer attached to the same network as the device. Most likely it is also very possible to easily figure out how the app authenticates itself with the end-server and how the end-server authenticates itself with the app. In all likelihood there is no authentication in either direction, which means that spoofing requests in either direction is trivially easy. This might be hard to believe (given that a country like China sets aside lots of resources to invasive technology like this), but the reality is that if the people who developed this app wanted to secure it from outside tampering, using HTTPS for transit would be the very first step to perform. It is cheap, easy, and very effective. The lack of HTTPS means that it is very likely that there is no actual security in this ecosystem, which is a plus for anyone trying to evade it.

Sniff all traffic coming out of this app to determine what requests/responses it makes

This is the first step. By watching the traffic leaving this app (which can be easily intercepted in the network itself since there is no SSL encryption) you can figure out what requests it sends to the destination server and what responses it expects back. Understanding the underlying API is critical, but easy due to the lack of encryption. This will also let you know if there is any authentication happening in either direction. If there is, you can at least see the full request and responses, so you can most likely figure out how to spoof it. It is possible that there is some hard-to-reverse-engineer authentication going back and forth, but again, given the lack of basic encryption, I doubt there is any such thing built in.

Figure out if the app is talking to a domain name or IP address

The destination server the app is talking to is either found via a DNS lookup or has its IP address hard-coded in the app. In the event of the former you can edit the DNS for your android phone to repoint it to a different server, including one running on your phone. In the event of a hard-coded IP address you will similarly have to redirect all traffic to that IP address to your local android phone (presumably you can do this with Android - you can with other operating systems, but you would definitely have to root your phone).

Setup a replacement server

You then setup a local server that responds to all requests just like the server did in your initial spoofing. You would have to get this server to run on your phone itself, that way it is always available. This doesn't necessarily have to be complicated (although that depends on how detailed the actual server interaction is), as you don't actually care about keeping any data on hand. You just need to make sure that you provide valid responses to all requests.

Risks:

1. The app may auto-update itself (although your mock-server may make this impossible) and point to new domains/ip addresses, suddenly removing your protections
2. If there is an auto-update functionality and your end up unintentionally killing it (which would be good per point #1 above), a police officer may notice that it is not properly updated, flag you for "extra" checking, and discover what you are doing.
3. They may do server-side tracking and discover what you are doing because they don't find any data on their end for your particular IMEI (because your mock-server acts like a black-hole and sucks up everything). Even if you send spoofed requests there will be easy ways for them to determine that (imagine the police copy a blacklisted image to your phone and discover that the app doesn't block/report it)
4. They may have root-checking in the app itself, which will cause you problems

Actually, that's it

I was trying for a longer list but that is really what it all boils down to. Short of not carrying around a phone or purchasing a separate one, these are about your only options. For reference, I haven't gone into details about the server spoofing because I think you're necessarily going to go out and do it. If anything, I've gone through it because it gives opportunity to talk through the risks in more detail, and those should make it clear that there are a lot of risks. Even if you find a solution from someone, they have to deal with all of these same risks (or ones like it). Right now this app sounds like it is poorly executed and easily fooled, but depending on how much the Chinese government decides it cares, that could change very quickly. At that point in time not getting caught basically turns into a cat-and-mouse game with the Chinese government, and that isn't realistically something that someone can continue to win for an extended period of time. There are a lot of risks, so tread lightly.

Answer 4

They can execute code on your device while they have physical access to it. And you can't refuse it. I'm sorry to say that but you are basically doomed. There's no way to trust this device anymore. That's part of the 10 immutable laws of security. In your case the rules #1, #2, #3, #6 and #10 are applicable.

But when you act like you don't trust the device you could raise their suspicion. Maybe. Because nobody knows what they are actually doing with the collected data. Maybe nothing at all. In the "best" case it's primary for spreading FUD.

But when they are actually using the data it's easy for them to spot burner phones and all kind of tampering. As far as I know you only get a SIM card by identifying with your ID. Since the spyware reads identifying information like IMEI and IMSI they can simple compare the collected data from the phones with the purchase records. They can combine this with behavior tracking based on metadata collected on the phone (Which apps are used and how often, how long the screen is on etc.) and the mobile network (usage of data, location based on cell tower etc). Since they can do that on a large scale, they can spot strange usage patterns by your usage history or how a "average" user is behaving. Of course there's a vast amount of ambiguity and such in this data but they have the ultimate interpretational sovereignty.

You must also keep in mind that you need to keep your measures working all of the time because it could always happen that you get stopped on the street again.

I'd like to emphasize on rule #10. You are basically trying to solve a social problem with technology - just as your government does.

Answer 5

Use a custom ROM (two, to be correct).

Android phones can have more than one ROM installed, and you choose one or the other. So install two copies.

On the clean ROM you install the spyware, anything not dangerous, games, whatever you feel clean. On the secure ROM you install things you don't want anyone to know about.

Keep the clean ROM running almost all the time, specially when you are out of home. Boot on the secure ROM only when you really need.

You will need to keep a secure mindset too, to have awareness of what ROM you are using and what content you can create or access. That is the main point of failure. Using a different keyboard on each ROM, or different OS languages can help: Chinese on the clean, English on the secure, for example.

But first you must weight the risk/reward of doing so. If the risk of getting caught plus the mental effort to keep activities and files containerized is worth the benefits of bypassing the spyware, do it. Don't do otherwise.

Answer 6

I'd recommend you just go with it. The Chinese police doesn't just stop any random person in the street and asks for their phone. They stop Uyghur.

This happens for reasons which are somewhere in between "mitigate a real threat" and "Woah, no go, dude", but whatever it is, it's what the government does, so it's legal and "right". No benefit of doubt, and no assumption of innocence, no Sir. By Western standards, it's kind of unthinkable, but you cannot draw to the same standards there.

So the situation is that you are easily identified as Uyghur, both from looking at your face, and from the fact that police knows. They know who you are and where you live. And sure they know whether you've been stopped before. Again, you're not being stopped at random. You're stopped because you are already a well-identified target, on their screen.

It isn't even unreasonable to expect that your Internet traffic is monitored (targetted) and even asking about how to circumvent the measures may move your name onto a different, more high priority list.

You can bet that police keeps a list of people where the spyware has been installed (with device IDs), too. If no data comes in from your device, well, guess what. You'll be stopped again by police, and they will look very carefully why this isn't working.

Insofar, it is kind of unwise to try and circumvent (and risking being caught) what police wants. From their point of view, you are a possible criminal, and a possible terrorist. By trying to circumvent the measures you prove that you are a criminal.

The surveillance happens on the base that if you have nothing to hide, then you need not bother if they're watching you. Again, by Western standards, this stance would in no way be acceptable. But whatever, in China it's perfectly acceptable.

I wouldn't want to risk disappearing in a detention camp if I was you. Rather, let them have their spyware, and simply don't do anything that isn't opportune to the system.

Answer 7

First of all, I think you should search for solutions that are already implemented by other people. For instance, what do other people in your case do to prevent the spying activities?

One possible solution would be to have a man-in-the-middle implementation analyzing the information that is being sent, altering it, and sending it to the same server and port the spyware is trying to connect to.

I read a bit about the functionality of the app, and the information it gathers is, and I quote from the Wikipedia source you provided:

sent in plaintext

Hence, after doing some tests with a packet sniffer tool and clearly understanding how the spyware and server exchanges made using the HTTP protocol work, you could, if you have root access to your Android phone, redirect the traffic of the spyware app to a process that is running on the background of your Android OS. This process would change the data that is going to be sent to the server the spyware is trying to connect to. That way, you can send data that matches another cellphone (maybe, literally faking the data is a bad idea, because that can trigger alarms).

You should also take into consideration any kind of validation processes that the spyware has implemented so you do not alter them. More specifically, the data that is in the HTTP packets’ headers and that is sent from the spyware app to the server to gracefully initiate an upload.

Of course this is theoretical, but it is a realistic thing to do. Also, you probably will require knowledge of Android programming (mostly in C or Java) and IT.

This approach is stealthy and will not require an uninstall of the spyware app. There is always a risk, but in this case, depending on the data that is actually spoofed, the risk is minimal.

Answer 8

Due to the nature of the spyware, they will be able to detect any mitigation techniques which will make you a person of interest to them.

I know you said you can't afford two phones but it really is the best advice - why not clean and refurb an older phone if you have one around?

A burner phone doesn't need to be anything special and even better if it isn't a smartphone.

Answer 9

One idea is to think of your phone as a networking device and nothing more. If you carry a secondary "tablet", that is NOT a phone, you can tether through your phone, and use a VPN on the tablet to protect your data. Now you can hand out your phone to be inspected as all of your actual important data and work is on your tablet which is clearly not a cellphone. If traditional hotspotting is too dangerous, you may want to consider alternative methods such as using a USB2Go cable or bluetooth pairing. If hotspotting is detected or blocked, you might also be able to use an app like PDANet to bypass those restrictions.

Answer 10

Disclaimer: I live in North America.

Knowing that I may be forced to install it sooner or later, what are my options to prepare against it?

Remove illegal items and anything else that you think that the government wouldn't approve of from your property - your clothing, phone, desk at work, home, etc.

If the government can't find you doing anything wrong then you only have to worry about someone planting false evidence on you - you need to search your own stuff from time to time.

When I go through Customs I've made absolutely certain that I have checked everything for anything I shouldn't have, because you know that they will likely check when you go through the port of entry.

As a result of my efforts they've not found anything to object to and have even simply waved me through a few times. Nothing to see here, move along.

Ideally:

• Make it appear like the app is installed and working as intended, without having it actually spy on me.

We have different ideas of what's ideal.

Ideally I'd prefer to be paid millions of dollars per hour.

• I don't know whether it includes sophisticated anti-tampering features or not. I can't afford two phones nor two contracts, so using a second phone is not a viable option for me.

1. It wouldn't make any sense for it not to detect tampering.

2. The APP is probably an excuse.

   If they obtain the information by another means (like monitoring the cell phone towers and WiFi, along with all Internet traffic, and then there's your neighbors whom earn a healthy living turning people in) they can say in Court that they obtained the information from the spyware - that way you don't know how the information was actually obtained.

3. This happens in more places than just where you are, it's different where you are in that roving gangs force you to install the APP. In other places (including North America) they get by without using an APO and rely on other techniques.

   Proof: In the last few months people whom have a lot of contact with children (Coaches, High School Principals, etc.) have had their work, home and computers searched for possession of inappropriate images. This appears in the news monthly.

Moral of the story: If you are poor and unsophisticated don't fight the rich, powerful, intelligent army trying to do something that they can find someone to back their actions to prevent you from doing it.

If you can't afford a second phone and contract that's a hint that you couldn't afford trouble in the first place, and the fine.

In your country they are upfront about it and demanding because objections fall on deaf ears. It's not much different in North America, just that they are sneaky to avoid complaints and only focus on major infractions so people don't suspect that they can see the lessor consequential things just as easily.

Answer 11

For a rooted phone (without you will have a hard time to stop the app from doing what it is doing), you can use AFWall+ to prevent the app from phoning home and XPrivacy.

XPrivacy on Android up to 6 is better than XPrivacyLua (Android 6 and newer), because the old version can block more different things.

This setup works best, if you can install the app voluntary at a time nobody is watching you configuring the security solutions. If you can only get the app when a policeman stops you, it is a bit harder to hide the security apps.

Answer 12

I wouldn't be shocked if there isn't a fake version somewhere--looks exactly real but doesn't actually spy. Unless the police are actually checking functionality in some fashion this would stop them.

As others have said, though, getting caught fooling the cops would not be a good thing!

Answer 13

While other answers do provide useful insights, my alternative would be to use the phone as you normally would but isolate the app access to data

One method has been suggested by rooting the device, installing Xposed and corresponding modules of Xprivacy / XPrivacyLua. While I personally use this, rooting the device, managing additional risks due to unlocked bootloader and malicious apps gaining root access is yet another challenge - IMO beyond the scope of average user and hence easy alternative approach below

There is an open source app called Shelter that does two things

• Use the "Work Profile" available in Android from version 5.0 (Lollipop) onwards

• It allows you to install the app of your choice, in this case, your spy app in the work profile. Once it is installed on the work profile (by cloning) , it essentially is on an island and can't access any data that is outside your work profile (your photos, emails, SMS or any other app information). You can safely uninstall the original app and if police check, show them your app, which has a padlock icon indicating it is on your work profile. You can keep the app always in your recents or Overview and pull from there so that they don't even see the icon

In simple terms, the spy app has nothing to spy on!

Download Shelter - an open source app from F-droid or GitHub. Quoting the developer, relevant use case

Run “Big Brother” apps inside the isolated profile so they cannot access your data outside the profile

(Emphasis supplied)

I am currently using this, in addition to XprivacyLua. For more details see WhatsApp: How to isolate contacts and photos - Privacy concerns

Answer 14

There are a lot of great answers, but most of them give solutions that are beyond the ability of the average Android user.

I would like to offer a compromise between absolute privacy and getting spied upon.

I assume that your government has other means of acquiring the IMEI and phone metadata. You can stop the app from acquiring other information by denying it permission for:

• Body sensors
• Calendar
• Camera
• Contacts
• Location
• Microphone
• Phone
• SMS
• Storage

Here are instructions on how to do it.

(I am not sure of your Android OS version, but the steps should be similar.)

This way the spyware would not be able to collect information about you, and therefore I assume that it will either not try to send information to servers, or it will send empty information.

However, this means that you install the app before police stops you and makes you install it. You can let the app download, kill the network connection while it's installing, and then remove permissions before it starts.

Risks

You should be aware that if the police does a deeper investigation, turned off permissions would be evidence that you have willfully tampered with the spyware. You should calculate if this risk is worthy.

This will also be a useful method of stopping other spyware (such as your flashlight app that requires contact information) from breaching your privacy.

Answer 15

You can simply resolve the servers it attempts to connect to back to localhost.

This can be accomplished by modifying the /etc/hosts file on your device if you have root.

Alternatively, you can use a local VPN which doesn't require root, such as this.

Answer 16

Based on your question I cannot be sure whether you are a Chinese resident, or someon who is planning to visit (for instance a tourist).

It was already mentioned earlier that so far it seems that only certain minority citizens people are targeted (and if they were to start targeting foreigners that news is sure to spread very quickly).

Regardless of what I think about that, the following bit may actually help most tourists:

The google play store is currently blocked in China, so though it is easy to overcome, this likely means that you will not be able to get the app through the standard procedure.

Answer 17

(radically edited)

I had proposed that one idea to consider was that

Playing dumb can be a good strategy.

For example, ask the phone vendor, :"Hi. My phone is working really slow and keeps crashing. Can you show me how to do a factory reset?"

However, I've been informed (see comments below) that even if this led to it being documented that someone else had removed the spyware, the person would likely still get in deep trouble when it was noticed that the spyware was no longer installed. It sounds like the answer to the question, "Is there any excuse for not having the spyware installed that would be considered valid?" is 'NO!' So it wouldn't matter whether the factory reset is more effective at wiping the system than the spyware is at staying installed. I would say don't risk it, especially if you think you'd make a high-value target.

Sadly, the software is effective at repressing dissidents and dissent even if technically it is 100% defective.

So my answer is that secretly helping to evangelize, build or crowdfund efforts to make it not work or prove it doesn't work well or to break it or make the phone to appear broken when spies try to install spyware would be better than a more direct approach, which would paint a target on your back. Good luck, and may the force be with you.

Answer 18

I agree with Doomgoose. Get a burner phone for this. Alternatively, get an app called Orbot (it's Tor for Android) which can get you a bit of the privacy you so desire by encrypting your online activities. Another alternative is adding a VPN on top of the equation.