Clubhouse, the popular app that allows people to create digital discussion groups, said that it is reviewing its data security practices after the Stanford Internet Observatory (SIO) found potential vulnerabilities in its infrastructure that could allow external access to users’ raw audio data.
The SIO confirmed that Agora Inc (聲網), a Shanghai-based start-up with offices in Silicon Valley, provides back-end infrastructure to Clubhouse and sells a “real-time voice and video engagement platform.”
User IDs are transmitted in plaintext over the Internet, making them “trivial to intercept,” it said.
Photo: Reuters
User IDs are like a serial number, not the username of the person. Agora would likely have access to users’ raw audio, potentially providing access to the Chinese government, it said.
“Any observer of Internet traffic could easily match IDs on shared chatrooms to see who is talking to whom,” the SIO said in its Twitter feed about its findings. “For mainland Chinese users, this is troubling.”
SIO, a program at Stanford University that studies disinformation on the Internet and social media platforms, said it observed metadata from a Clubhouse chatroom “being relayed to servers we believe to be hosted in” China.
Analysts also saw audio being relayed “to servers managed by Chinese entities and distributed around the world,” its report said.
As a Chinese firm, Agora is subject to China’s cybersecurity laws and would be “legally required to assist the government in locating and storing” audio messages authorities said jeopardized national security, SIO said.
Agora did not immediately respond to e-mails outside regular business hours seeking comment.
“Any unencrypted data that is transmitted via servers in the PRC [People’s Republic of China] would likely be accessible to the Chinese government,” it said.
Since SIO was able to observe the transmission of metadata between servers, it believes the Chinese government would be able to collect metadata without having to access Agora’s networks.
However, SIO said Agora claims not to store user audio or metadata “except to monitor network quality and bill its clients,” which means it would not have any records of user data if Beijing were to request it.
It also said that as long as audio was stored in the US, it was unlikely that the Chinese government would be able to access it.
SIO said it chose to disclose the security issues because they were easy to uncover and because of the risk they pose to Clubhouse’s millions of users.
“SIO has discovered other security flaws that we have privately disclosed to Clubhouse and will publicly disclose when they are fixed or after a set deadline,” it said.
In a statement included in the report, Clubhouse said it would roll out changes over 72 hours to add “additional encryption and blocks to prevent Clubhouse clients from ever transmitting pings to Chinese servers. We also plan to engage an external data security firm to review and validate these changes.”
SECURITY: As China is ‘reshaping’ Hong Kong’s population, Taiwan must raise the eligibility threshold for applications from Hong Kongers, Chiu Chui-cheng said When Hong Kong and Macau citizens apply for residency in Taiwan, it would be under a new category that includes a “national security observation period,” Mainland Affairs Council (MAC) Minister Chiu Chui-cheng (邱垂正) said yesterday. President William Lai (賴清德) on March 13 announced 17 strategies to counter China’s aggression toward Taiwan, including incorporating national security considerations into the review process for residency applications from Hong Kong and Macau citizens. The situation in Hong Kong is constantly changing, Chiu said to media yesterday on the sidelines of the Taipei Technology Run hosted by the Taipei Neihu Technology Park Development Association. With
A US Marine Corps regiment equipped with Naval Strike Missiles (NSM) is set to participate in the upcoming Balikatan 25 exercise in the Luzon Strait, marking the system’s first-ever deployment in the Philippines. US and Philippine officials have separately confirmed that the Navy Marine Expeditionary Ship Interdiction System (NMESIS) — the mobile launch platform for the Naval Strike Missile — would take part in the joint exercise. The missiles are being deployed to “a strategic first island chain chokepoint” in the waters between Taiwan proper and the Philippines, US-based Naval News reported. “The Luzon Strait and Bashi Channel represent a critical access
‘FORM OF PROTEST’: The German Institute Taipei said it was ‘shocked’ to see Nazi symbolism used in connection with political aims as it condemned the incident Sung Chien-liang (宋建樑), who led efforts to recall Democratic Progressive Party (DPP) Legislator Lee Kun-cheng (李坤城), was released on bail of NT$80,000 yesterday amid an outcry over a Nazi armband he wore to questioning the night before. Sung arrived at the New Taipei City District Prosecutors’ Office for questioning in a recall petition forgery case on Tuesday night wearing a red armband bearing a swastika, carrying a copy of Adolf Hitler’s Mein Kampf and giving a Nazi salute. Sung left the building at 1:15am without the armband and apparently covering the book with a coat. This is a serious international scandal and Chinese
COUNTERINTELLIGENCE TRAINING: The ministry said 87.5 percent of the apprehended Chinese agents were reported by service members they tried to lure into becoming spies Taiwanese organized crime, illegal money lenders, temples and civic groups are complicit in Beijing’s infiltration of the armed forces, the Ministry of National Defense (MND) said in a report yesterday. Retired service members who had been turned to Beijing’s cause mainly relied on those channels to infiltrate the Taiwanese military, according to the report to be submitted to lawmakers ahead of tomorrow’s hearing on Chinese espionage in the military. Chinese intelligence typically used blackmail, Internet-based communications, bribery or debts to loan sharks to leverage active service personnel to do its bidding, it said. China’s main goals are to collect intelligence, and develop a
RSS