Huawei Mediapad M5 found to be snooping on engineer in Taiwan from China

Canadian IT engineer in Taiwan discovers Huawei Mediapad M5 is snooping on him from China

  30821
Stock photo of store in China.

Stock photo of store in China. (By Associated Press)

TAIPEI (Taiwan News) -- After news broke that a Huawei P30 Pro was apparently querying servers in China, a Canadian IT engineer who lives in Taiwan says he has discovered that his Huawei Mediapad M5 is spying on him through several apps.

The engineer, who is skilled in computers, cellphones, and data networks, told Taiwan News that whenever he buys a new cellphone, he always installs an app called NoRoot Firewall to block unwanted snooping. After installing the firewall program on his newly purchased Huawei Mediapad M5, he found that Huawei was using his device to snoop on his activities and will not allow him to disable the offending apps.

The man said that he purchased the Huawei Mediapad M5 tablet/smartphone about six months ago, and it is the 8.1" sized model. He said that he had mainly used the firewall program to identify apps that were running in the background so he could disable them to save battery power.

He soon discovered several applications running in the background on his Huawei device that are sending data to China, but he never authorized them to do so. Despite the fact that he opted to disable them, the apps are still running in the background and he says he no longer has access to them.


Huawei Mediapad M5 tablet.

The engineer said that many of the Huawei apps are recording activity and then sending it back to servers in China. He said the apps are sending information such as where he is browsing and login details, including usernames and passwords.

As he does not carry out internet banking on the device, he is not sure if the apps would monitor financial transactions. He claims that he never signed up for Huawei services and he deleted his account the first week he bought the tablet.

The engineer said that most of the software pre-installed on his Huawei device is sending data to an organization in China called Shanghai Dnion Information Technology Co, Ltd, which is located at Rm.531, Floor 5, North Third Ring Road, No.27, Shangfang Building, Beijing. He said that a lot of data often also passes through a cloud server Huawei uses in Singapore to bypass the Great Firewall of China.


HwIntelligentRec-System still running in background.

He said that the following applications are "running 100 percent of the time." Despite the fact that he keeps turning them off, they keep restarting by themselves, and some are even disabled, but still work hidden in the background.

- Captive Portal Login
- com.android.partnetbrowsercustomization.tmobile (T-Mobile won a case against Huawei for the use of the T-Mobile android scripts)
- com.huawei.hiviewtunnel
- Huawei.hiboard
- Huawei.hiview
- Huawei.hivoice
- Huawei.mobile.services
- Huawei share
- Huawei search index and services
- Huawei intelligent recording system
- Hwnearby
- hwsynergy
- Exchange Services
- Files
- Fused Location
- Google Backup Services
- Google Play Services
- Google Services Framework
- Package installer
- Print spooler (why is this running when not using any printer)
- Push services
- Shell
- System update

The following are IP addresses that the apps are sending queries to behind the scenes:

System (Most system apps are the above Huawei apps)
210.72.44.141:443 Hubei Bureau of Statistics
159.226.216.22:443 China Science and Technology Network
18.136.136.226:443 Amazon Data Services Singapore
52.76.118.162:443 Amazon Technologies Inc.
3.1.28.223:443 Amazon Data Services Singapore
13.251.217.196:443 Amazon Data Services Singapore
52.77.164.35:5222 Amazon Technologies Inc.
13.229.37.66:5222 Amazon Technologies Inc.
119.23.23.32 Alisoft Computing Co. Ltd.

Swiftkeyboard
54.171.19.142:443 Amazon Technologies Inc.
52.209.225.101:443 Amazon Data Services Ireland Limited

Huawei Mobile services
18.138.87.86:5222 Amazon Data Services Singapore
122.11.34.107:443 Shanghai Dnion Information Technology Co,Ltd
3.0.164.29:443 Amazon Data Services Singapore
18.136.88.112:443 Amazon Data Services Singapore
52.76.203.237:443 Amazon Data Services Singapore
31.13.87.1:443 Strangely, this one is going to Facebook

He said that whenever he starts any program or turns on the LTE data, the programs automatically send data to an Amazon server. The Huawei software update app keeps constantly trying to connect, but is blocked by his firewall.

Something that was confusing him is that the huawei.com domain goes to China, while www.huawei.com goes to the US. It made him suspect that the U.S. government and Huawei could be sharing information within themselves, and also sharing the data with Google and Facebook.

The following are the two IP addresses where Huawei is sending data to the U.S. and China:

23.218.59.243 - Huawei USA
45.249.212.0 - 45.249.215.255 - Huawei, Shenzhen China

He said that when he enables 4G in Taiwan, all the Huawei apps, including camera, gallery, and files send out data queries. Some apparently bypass Singapore and go straight to the Chinese IP addresses.

In addition to Huawei servers, he said that applications on his phone are also trying to send data to Google and Facebook. He said he always uses a browser to check emails and an encrypted password manager software.

Given the limited way he is using his phone, he says there should be no need to send data to Huawei, Google, or Facebook. Given all the applications secretly sending all sorts of data, he now thinks it might be a good idea to reset the cellphone and only use it for non-sensitive information use.


Screenshot showing HwIntelligentRec-System still running in background.


Screenshot showing hiview still running in background.