Software Sold to US Military Sending Chinese and Russian Code

Recent reviews Of the hundreds of mobile apps sold to the US military, one in eight apps were developed by companies China, Russiaor other foreign countries, raising new concerns that adversary governments may harvest information about where service members live, work, and are deployed.

According to researchers at Purdue University, the US Military Academy at West Point, and Florida International Universityone popular program used by service members to monitor the status of their installations includes code from Huawei, a Chinese telecom that the US administration has declared a national security threat in 2020. The other two were built by Russian companies and include the Russian advertising service Yandex.

Unregulated advertising companies which tracks Americans online they treat ordinary people and workers alike—unless there is profit by separating them-even though there is evidence that disclosure could reveal the deployment of military forces, the organization of the forces, and the behavior of the staff of the intelligence offices and the strong hideouts where nuclear weapons are believed to be stored.

A WIRED survey already showed that The data has been obtained from private programs that track US personnel in their homes, their children’s schools, and off-site locations where the military is prohibited from being viewed. Experts have warned that this could allow foreign spies to infiltrate identify employees who have access to critical sitesmap when the location is not protected, or show other things that might be confusing.

Which is no longer fiction. In April, US Central Command he admitted in a letter to Senator Ron Wyden that he has received several threatening reports about enemies using commercial intelligence to track or spy on Americans in the Middle East, where US forces remain trapped by Iranian forces on the Strait of Hormuz. Lawmakers called it the first confirmation that soldiers in the war zone are being hunted through the data economy—a threat that Pentagon contractors and researchers have warned about for nearly a decade.

The new study focuses for the first time on one aspect of this phenomenon: that which resides within software built and sold specifically for the military.

“We are grateful for the opportunity to bring more attention to these issues,” says Joshua Shinkle, PhD researcher at Purdue University and lead author of the study. “We hope this research will help military personnel, builders, and platforms make strategic decisions and stimulate discussion with builders, platforms, and policymakers about how to address these gaps.”

The researchers analyzed more than 220 such apps – from uniform guides and exam preparation to banking and dating apps – from the Google Play store and the military. About two-thirds—or 64 percent—had third-party code, called SDKs: built-in software tools, used for analytics and marketing, that can also track user behavior, including their location, and share that information with outside companies.

Forty percent of apps collected or shared more information than they disclosed in their Google or Apple Store listings, the researchers found.

The most popular SDKs came from Google and Facebook, the two companies that dominate digital advertising in the US. But 76 were found in total, including codes from China, Russia, Israel, India, Germany, and others. About 7 percent of the software contained third-party code from a country the Pentagon considers hostile.

Twelve of the apps included HMS Core, Huawei’s software that advertises the ability to capture user interfaces, send ads, and save photos and videos. Most were made for National Guard units.

The researchers observed that no data was going to Huawei’s servers. But the SDK can be updated remotely at any time. Code that is silent today may still be spyware tomorrow. In one case, identified by the investigation, a Huawei number arrived without the knowledge of the software developer, disguised as a reliance on a commercial notification tool.