Alibaba’s UC Browser Could Be Leaking Million Of Users Data

Plain text is not a way to go.

Just over a year ago, Alibaba has acquired UCWeb, a company behind UC Browser, which has a mind boggling user base of 500 million and more than 100 million active daily users.

However, as it turns out, there is a pretty serious “flaw” (or lazy design), which would allow anyone to identify your phone number, search queries, location and the device itself. What do we mean by saying lazy design? Well, it’s not exactly a security vulnerability as the only issue with UC Browser is that it does not encrypt traffic, which could allow your network operator or in-path actor on the network to access your data.

The report comes from CitizenLab, which tested UC Browser for Android in both English (10.4.1.565) and Chinese (10.2.1.161) versions of the said software.

Data sent in plain text

Data obtained about the user using UC Browser

For a bunch of creepy screenshots, head over to the source below.

[Via: CitizenLab]