<!--#include virtual="/server/header.html" -->
<!-- Parent-Version: 1.85 1.96 -->
<!--#set var="DISABLE_TOP_ADDENDUM" value="yes" -->
                  Please do not edit <ul class="blurbs">!
    Instead, edit /proprietary/workshop/mal.rec, then regenerate pages.
           See explanations in /proprietary/workshop/README.md.
<title>Proprietary Back Doors - GNU Project - Free Software Foundation</title>
<link rel="stylesheet" type="text/css" href="/side-menu.css" media="screen,print" />
 <!--#include virtual="/proprietary/po/proprietary-back-doors.translist" -->
<!--#include virtual="/server/banner.html" -->
<div class="nav">
<a id="side-menu-button" class="switch" href="#navlinks">
 <img id="side-menu-icon" height="32"
      title="Section contents"
      alt=" [Section contents] " />

<p class="breadcrumb">
 <a href="/"><img src="/graphics/icons/home.png" height="24"
    alt="GNU Home" title="GNU Home" /></a> /
 <a href="/proprietary/proprietary.html">Malware</a> /
 By type /
<!--#include virtual="/server/top-addendum.html" -->
<div style="clear: both"></div>
<div id="last-div" class="reduced-width">
<h2>Proprietary Back Doors</h2>

<p><a href="/proprietary/proprietary.html">Other examples of proprietary malware</a></p>

<div class="infobox">
<hr class="full-width" />
<p>Nonfree (proprietary) software is very often malware (designed to
mistreat the user). Nonfree software is controlled by its developers,
which puts them in a position of power over the users; <a
href="/philosophy/free-software-even-more-important.html">that is the
basic injustice</a>. The developers and manufacturers often exercise
that power to the detriment of the users they ought to serve.</p>


<p>This typically takes the form of malicious functionalities.</p>
<hr class="full-width" />

<div class="article">
<p>Some malicious functionalities are mediated by <a
href="/proprietary/proprietary.html#f1">back doors</a>.  Here are
examples of demonstrated back doors in proprietary software.
They are sorted out programs that contain one or several of those, classified
according to what they are the back door is known to allow. have the power to do.
Back doors that allow full control over the operating system programs which contain them
are said to be
“universal”.</p> “universal.”</p>

<div class="important">
<p>If you know of an example that ought to be in this page but isn't
here, please write
to <a href="mailto:webmasters@gnu.org"><webmasters@gnu.org></a>
to inform us. Please include the URL of a trustworthy reference or two
to present the specifics.</p>

<p class="c">
   <a href="#spy">Spying</a> |
   <a href="#alter-data">Altering user's data/settings</a> |
   <a href="#install-delete">Installing/deleting programs</a> |
   <a href="#universal">Full control</a> | serve as specific substantiation.</p>

<div id="TOC" class="toc-inline">
<h3>Back-door functionalities</h3>
  <li><a href="#spy">Spying</a></li>
  <li><a href="#alter-data">Altering user's data or settings</a></li>
  <li><a href="#install-delete">Installing, deleting or disabling programs</a></li>
  <li><a href="#universal">Full control</a></li>
  <li><a href="#other">Other/undefined</a></li>

<h3 id='spy'>Spying</h3>

<ul class="blurbs">
  <li id="M202008030">
    <!--#set var="DATE" value='<small class="date-tag">2020-08</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Google Nest <a href="#other">Other/undefined</a>

<!-- WEBMASTERS: make sure
    is taking over ADT</a>. Google sent out a software
    update to place new items its speaker devices using their back door <a
    href="https://www.protocol.com/google-smart-speaker-alarm-adt"> that
    listens for things like smoke alarms</a> and then notifies your phone
    that an alarm is happening. This means the devices now listen for more
    than just their wake words. Google says the software update was sent
    out prematurely and on top under each subsection accident and Google was planning on disclosing
    this new feature and offering it to customers who pay for it.</p>

  <li id="M201706200.2">
    <!--#set var="DATE" value='<small class="date-tag">2017-06</small>'
    --><!--#echo encoding="none" var="DATE" -->

<h3 id="spy">Spying</h3>

    <p id="InternetCameraBackDoor">Many models of Internet-connected
    cameras contain a glaring back door—they have login
    accounts with hard-coded passwords, which can't be changed, and <a
    there is no way to delete these accounts either</a>.</p>

    <p>Since these accounts with hard-coded passwords are impossible
    to delete, this problem is not merely an insecurity; it amounts to
    a back door that can be used by the manufacturer (and
    government) to spy on users.</p>


  <li id="M201701130">
    <!--#set var="DATE" value='<small class="date-tag">2017-01</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>WhatsApp has a feature that <a
    has been described as a “back door”</a> because it would
    enable governments to nullify its encryption.</p>

    <p>The developers say that it wasn't intended as a back door door, and that
    may well be true. But that leaves the company can use to read the plaintext crucial question of messages</a>.</p>
    <p>This should not come whether it
    functions as a surprise. Nonfree software for
      encryption one. Because the program is never trustworthy.</p> nonfree, we cannot check by
    studying it.</p>

    <p><a href="https://theintercept.com/2015/12/28/recently-bought-a-windows-computer-microsoft-probably-has-your-encryption-key/">

  <li id="M201512280">
    <!--#set var="DATE" value='<small class="date-tag">2015-12</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Microsoft has already <a
    backdoored its disk encryption</a>.</p>


  <li id="M201409220">
    <!--#set var="DATE" value='<small class="date-tag">2014-09</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Apple can, and regularly does, <a
    remotely extract some data from iPhones for the state</a>.</p>

    <p>This may have improved with <a
    iOS 8 security improvements</a>; but <a
    not as much as Apple claims</a>.</p>

<h3 id="alter-data">Altering id='alter-data'>Altering user's data or settings</h3>

    <p>A pregnancy test controller application

<ul class="blurbs">
  <li id="M202109220">
    <!--#set var="DATE" value='<small class="date-tag">2021-09</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Some Xiaomi phones <a
    a malfeature to bleep out phrases that express political views
    China does not only like</a>. In phones sold in Europe, Xiaomi leaves
    this deactivated by default, but has a back door to activate the

    <p>This is the natural result of having nonfree software in a device
    that can communicate with the company that made it.</p>

  <li id="M201905060">
    <!--#set var="DATE" value='<small class="date-tag">2019-05</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>BlizzCon 2019 imposed a <a
    requirement to run a proprietary phone app</a> to be allowed into
    the event.</p>

    <p>This app is a spyware that can snoop on many sorts a lot of data in the phone,
    sensitive data, including user's location and in server accounts, contact list, and has <a
    near-complete control</a> over the phone.</p>

  <li id="M201809140">
    <!--#set var="DATE" value='<small class="date-tag">2018-09</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Android has a <a
    back door for remotely changing “user” settings</a>.</p>

    <p>The article suggests it
      can alter them too</a>.</p> might be a universal back door, but this
    isn't clear.</p>


  <li id="M201607284">
    <!--#set var="DATE" value='<small class="date-tag">2016-07</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>The Dropbox app for Macintosh <a
    takes control of user interface items after luring the user into
    entering an admin password</a>.</p>

    <p>Users reported that

  <li id="M201604250">
    <!--#set var="DATE" value='<small class="date-tag">2016-04</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>A pregnancy test controller application not only can <a 
      Microsoft was forcing them to replace Windows 7 and 8 with all-spying 
      Windows 10</a>.</p>
    <p>Microsoft was
    spy on many sorts of data in fact <a 
      attacking computers that run Windows 7 the phone, and 8</a>, switching on a flag 
      that said whether to “upgrade” to Windows 10 when users 
      had turned in server accounts,
    it off.</p>
    <p>Later on, Microsoft published instructions on <a 
      how to permanently reject the downgrade to Windows 10</a>.</p>
    <p>This seems to involve use of can alter them too</a>.</p>

  <li id="M201512074">
    <!--#set var="DATE" value='<small class="date-tag">2015-12</small>'
    --><!--#echo encoding="none" var="DATE" -->
    Some D-Link routers</a> have a back door for changing settings in Windows 7 and 8.</p> a
    dlink of an eye.</p>

    <p><a href="http://sekurak.pl/tp-link-httptftp-backdoor/"> The TP-Link
    router has a back door</a>.</p>

    <p><a href="https://github.com/elvanderb/TCP-32764">Many models of
    routers have back doors</a>.</p>


  <li id="M201511244">
    <!--#set var="DATE" value='<small class="date-tag">2015-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Google has long had <a
    back door to remotely unlock an Android device</a>, unless its disk
    is encrypted (possible since Android 5.0 Lollipop, but still not
    quite the default).</p>

  <li id="M201511194">
    <!--#set var="DATE" value='<small class="date-tag">2015-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Caterpillar vehicles come with <a
    a back door to shutoff the engine</a> remotely.</p>


  <li id="M201509160">
    <!--#set var="DATE" value='<small class="date-tag">2015-09</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Modern gratis game cr…apps <a
    collect a wide range of data about their users and their users'
    friends and associates</a>.</p>

    <p>Even nastier, they do it through ad networks that merge the data
    collected by various cr…apps and sites made by different

    <p>They use this data to manipulate people to buy things, and hunt for
    “whales” who can be led to spend a lot of money. They also
    use a back door to manipulate the game play for specific players.</p>

    <p>While the article describes gratis games, games that cost money
    can use the same tactics.</p>

    <p><a id="samsung"

  <li id="M201403120.1">
    <!--#set var="DATE" value='<small class="date-tag">2014-03</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p id="samsung"><a
    Samsung Galaxy devices running proprietary Android versions come with
    a back door</a> that provides remote access to the files stored on
    the device.</p>

    <p><a href="http://www.itworld.com/article/2705284/data-protection/backdoor-found-in-d-link-router-firmware-code.html">
      Some D-Link routers</a> have a back door for changing settings in a
      dlink of an eye.</p>
    <p><a href="http://sekurak.pl/tp-link-httptftp-backdoor/">
      The TP-Link router has a back door</a>.</p>
    <p><a href="https://github.com/elvanderb/TCP-32764">Many models of routers
      have back doors</a>.</p>

  <li id="swindle-eraser">
    <p>The id="M201210220">
    <!--#set var="DATE" value='<small class="date-tag">2012-10</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p id="swindle-eraser">The Amazon
    Kindle-Swindle has a back door that has been used to <a
    remotely erase books</a>.  One of the books erased was 1984,
    <cite>1984</cite>, by George Orwell.</p>

    <p>Amazon responded to criticism by saying it
    would delete books only following orders from the
    state.  However, that policy didn't last.  In 2012 it <a
    wiped a user's Kindle-Swindle and deleted her account</a>, then
    offered her kafkaesque “explanations.”</p>

    <p>Do other ebook readers have back doors in their nonfree software? We
    don't know, and we have no way to find out.  There is no reason to
    assume that they don't.</p>


  <li id="M201011220">
    <!--#set var="DATE" value='<small class="date-tag">2010-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>The iPhone has a back door for <a
    remote wipe</a>.  It's not always enabled, but users are led into
    enabling it without understanding.</p>

<h3 id="install-delete">Installing or id='install-delete'>Installing, deleting or disabling programs</h3>

<ul class="blurbs">
  <li id="M202110130">
    <!--#set var="DATE" value='<small class="date-tag">2021-10</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Adobe <a
    licensed its Flash Player to China's Zhong Cheng Network</a> who is
    offering the program bundled with spyware and a back door that can
    remotely deactivate it.</p>

    <p>Adobe is responsible for this since they gave Zhong Cheng
    Network permission to do this.  This injustice involves “misuse” of
    the DMCA, but “proper,” intended use of the DMCA is a much bigger
    injustice.  There is <a href="/philosophy/right-to-read.html">a series
    of errors related to DMCA</a>.</p>

  <li id="M202108240">
    <!--#set var="DATE" value='<small class="date-tag">2021-08</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Recent Samsung TVs have a back door with which Samsung can <a
    brick them remotely</a>.</p>

  <li id="M202106190">
    <!--#set var="DATE" value='<small class="date-tag">2021-06</small>'
    --><!--#echo encoding="none" var="DATE" -->
    automatically installed an app on many proprietary Android phones</a>. The app
    might or might not do malicious things but the power Google has over proprietary
    Android phones is dangerous.</p>

  <li id="M202012020">
    <!--#set var="DATE" value='<small class="date-tag">2020-12</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Adobe Flash Player <a
    has a universal back door</a> which lets Adobe control
    the software and, for example, disable it whenever it
    wants. Adobe will block Flash content from running in Flash Player
    beginning January 12, 2021, which indicates that they have access to
    every Flash Player through a back door.</p>

    <p>The back door won't be dangerous in the future, as it'll disable
    a proprietary program and make users delete the software, but it
    was an injustice for many years. Users should have deleted Flash Player
    even before its end of life.</p>

  <li id="M202007020">
    <!--#set var="DATE" value='<small class="date-tag">2020-07</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>BMW is trying to <a
    certain features of its cars, and force people to pay to use part of
    the car they already bought</a>. This is done through forced update
    of the car software via a radio-operated back door.</p>

  <li id="M201908270">
    <!--#set var="DATE" value='<small class="date-tag">2019-08</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>A very popular app found in the
    Google Play store contained a module that was designed to <a
    install malware on the user's computer</a>. The app developers
    regularly used it to make the computer download and execute any code
    they wanted.</p>

    <p>This is a concrete example of what users are exposed to when they
    run nonfree apps. They can never be completely sure that a nonfree
    app is safe.</p>

  <li id="M201907100">
    <!--#set var="DATE" value='<small class="date-tag">2019-07</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Apple appears to say that <a
    there is a back door in MacOS</a> for automatically updating some
    (all?) apps.</p>

    <p>The specific change described in the article was not
    malicious—it protected users from surveillance by third
    parties—but that is a separate question.</p>

  <li id="M201811100">
    <!--#set var="DATE" value='<small class="date-tag">2018-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Corel Paintshop Pro has a <a
    back door that can make it cease to function</a>.</p>

    <p>The article is full of confusions, errors and biases that we have
    an obligation to expose, given that we are making a link to them.</p>

    <li>Getting a patent does not “enable” a company to do
    any particular thing in its products. What it does enable the company
    to do is sue other companies if they do some particular thing in
    their products.</li>

    <li>A company's policies about when to attack users through a back
    door are beside the point. Inserting the back door is wrong in the
    first place, and using the back door is always wrong too. No software
    developer should have that power over users.</li>

    href="/philosophy/words-to-avoid.html#Piracy">Piracy</a>” means
    attacking ships. Using that word to refer to sharing copies is a smear;
    please don't smear sharing.</li>

    <li><p>The idea of “protecting our IP” is
    total confusion. The term “IP” itself is a <a
    href="/philosophy/not-ipr.html">bogus generalization about things
    that have nothing in common</a>.</p>

    <p>In addition, to speak of “protecting” that bogus
    generalization is a separate absurdity. It's like calling the cops
    because neighbors' kids are playing on your front yard, and saying
    that you're “protecting the boundary line”. The kids can't do harm
    to the boundary line, not even with a jackhammer, because it is an
    abstraction and can't be affected by physical action.</p></li>

  <li id="M201804010">
    <!--#set var="DATE" value='<small class="date-tag">2018-04</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Some “Smart” TVs automatically <a href="https://news.ycombinator.com/item?id=16727319">load
    load downgrades that install a surveillance app</a>.</p>

    <p>We link to the article for the facts it presents. It
    is too bad that the article finishes by advocating the
    moral weakness of surrendering to Netflix. The Netflix app <a
    malware too</a>.</p>


  <li id="M201511090">
    <!--#set var="DATE" value='<small class="date-tag">2015-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Baidu's proprietary Android library, Moplus, has a back door that <a
    can “upload files” as well as forcibly install

    <p>It is used by 14,000 Android applications.</p>

  <li id="M201112080">
    <!--#set var="DATE" value='<small class="date-tag">2011-12</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p> In addition to its <a href="#windows-update">universal back
    door</a>, Windows 8 has a back door for <a
    remotely deleting apps</a>.</p>

    <p>You might well decide to let a security service that you trust
    remotely <em>deactivate</em> programs that it considers malicious.
    But there is no excuse for <em>deleting</em> the programs, and you
    should have the right to decide whom (if anyone) to trust in this

  <li id="M201103070">
    <!--#set var="DATE" value='<small class="date-tag">2011-03</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>In Android, <a
    Google has a back door to remotely delete apps.</a> apps</a>. (It was in a
    program called GTalkService, which seems since then to have been
    merged into Google Play.)</p>

    <p>Google can also <a
    forcibly and remotely install apps</a> through GTalkService.  This is
    not equivalent to a universal back door, but permits various dirty

    <p>Although Google's <em>exercise</em> of this power has not been
    malicious so far, the point is that nobody should have such power,
    which could also be used maliciously.  You might well decide to
    let a security service remotely <em>deactivate</em> programs that
    it considers malicious.  But there is no excuse for allowing it to
    <em>delete</em> the programs, and you should have the right to decide
    who (if anyone) to trust in this way.</p>

    <p><a href="http://www.computerworld.com/article/2500036/desktop-apps/microsoft--we-can-remotely-delete-windows-8-apps.html">
      Windows 8 also has a back door for remotely deleting apps</a>.</p>
    <p>You might well decide to let a security service that you trust
      remotely <em>deactivate</em> programs that it considers malicious.
      But there is no excuse for <em>deleting</em> the programs, and you
      should have the right to decide whom (if anyone) to trust in this


  <li id="M200808110">
    <!--#set var="DATE" value='<small class="date-tag">2008-08</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>The iPhone has a back door <a
    that allows Apple to remotely delete apps</a> which Apple considers
    “inappropriate”.  Jobs said it's OK for Apple to have
    this power because of course we can trust Apple.</p>

<h3 id="universal">Full id='universal'>Full control</h3>

    <p>ChromeOS has

<ul class="blurbs">
  <li id="M202106220">
    <!--#set var="DATE" value='<small class="date-tag">2021-06</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Peloton company which produces treadmills recently <a
    people out of basic features of people's treadmills by a software
    update</a>. The company now asks people for a membership/subscription
    for what people already paid for.</p>

    <p>The software used in the treadmill is proprietary and probably
    includes back doors to force software updates. It teaches the lesson
    that if a product talks to external networks, you must expect it to
    take in new malware.</p>

    <p>Please note that the company behind this product said they
    are working to reverse the changes so people will no longer need
    subscription to use the locked feature.</p>

    <p>Apparently public anger made the company back down. If we want that
    to be our safety, we need to build up the anger against malicious
    features (and the proprietary software that is their entry path)
    to the point that even the most powerful companies don't dare.</p>

  <li id="M202102180">
    <!--#set var="DATE" value='<small class="date-tag">2021-02</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Microsoft is <a
    removing the Flash player from computers running Windows 10</a>, using
    <a href="/proprietary/proprietary-back-doors.html#windows-update">a
    universal backdoor in Windows</a>.</p>

    <p>The fact that Flash has been <a
    by Adobe</a> is no excuse for this abuse of power. The nature of
    proprietary software, such as Microsoft Windows, gives the developers
    power to impose their decisions on users. Free software on the other
    hand empowers users to make their own decisions.</p>

  <li id="M202011230">
    <!--#set var="DATE" value='<small class="date-tag">2020-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Some Wavelink and JetStream wifi routers have
    universal back door. At least, doors that enable unauthenticated
    users to remotely control not only the routers, but
    also any devices connected to the network. There is evidence that <a
    this vulnerability is actively exploited</a>.</p>

    <p>If you consider buying a router, we encourage you to get one
    that <a href="https://ryf.fsf.org/categories/routers">runs on free
    software</a>. Any attempts at introducing malicious functionalities in
    it (e.g., through a firmware update) will be detected by the community,
    and soon corrected.</p>

    <p>If unfortunately you own a router that runs on
    proprietary software, don't panic! You may be able to
    replace its firmware with a free operating system such as <a
    href="https://librecmc.org">libreCMC</a>. If you don't know how,
    you can get help from a nearby GNU/Linux user group.</p>

  <li id="M202011060">
    <!--#set var="DATE" value='<small class="date-tag">2020-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>A new app published by Google says <a
    banks and creditors deactivate people's Android devices</a> if they
    fail to make payments. If someone's device gets deactivated, it does—in will
    be limited to basic functionality, such as emergency calling and
    access to settings.</p>

  <li id="M202007010">
    <!--#set var="DATE" value='<small class="date-tag">2020-07</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>BMW will remotely <a
      section 4
    enable and disable functionality in cars</a> through a universal
    back door.</p>

  <li id="M202004130">
    <!--#set var="DATE" value='<small class="date-tag">2020-04</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>The <a href="https://www.google.com/mobile/android/market-tos.html">
    Google Play Terms of Service</a> insist that the EULA</a>.</p> user of Android accept
    the presence of universal back doors in apps released by Google.</p>

    <p>This does not tell us whether any of Google's apps currently
    contains a universal back door, but that is a secondary question.
    In moral terms, demanding that people accept in advance certain bad
    treatment is equivalent to actually doing it.  Whatever condemnation
    the latter deserves, the former deserves the same.</p>

  <li id="M202001090">
    <!--#set var="DATE" value='<small class="date-tag">2020-01</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Android phones subsidized by the US government come with <a
    preinstalled adware and a back door for forcing installation of

    <p>The adware is in a modified version of an
    essential system configuration app. The back door is a
    surreptitious addition to a program whose stated purpose is to be a <a
    universal back door for firmware</a>.</p>

    <p>In other words, a program whose raison d'ĂȘtre is malicious has
    a secret secondary malicious purpose. All this is in addition to the
    malware of Android itself.</p>


  <li id="M201910130.1">
    <!--#set var="DATE" value='<small class="date-tag">2019-10</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>The Chinese Communist Party's <a
    “Study the Great Nation” app</a> was found to contain <a
    a back-door allowing developers to run any code they wish</a> in the
    users' phone, as “superusers.”</p>

    <p>Note: The <a
    Washington Post version of the article</a> (partly obfuscated, but
    readable after copy-pasting in a text editor) includes a clarification
    saying that the tests were only performed on the Android version
    of the app, and that, according to Apple, “this kind of
    ‘superuser’ surveillance could not be conducted on
    Apple's operating system.”</p>

  <li id="M201908220">
    <!--#set var="DATE" value='<small class="date-tag">2019-08</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>ChromeBooks are programmed for obsolescence:
    ChromeOS has a universal back door that is used for updates and <a
    ceases to operate at a predefined date</a>. From then on, there
    appears to be no support whatsoever for the computer.</p>

    <p>In other words, when you stop getting screwed by the back door,
    you start getting screwed by the obsolescence.</p>

  <li id="M201902011">
    <!--#set var="DATE" value='<small class="date-tag">2019-02</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>The FordPass Connect feature of some Ford vehicles has <a
    near-complete access to the internal car network</a>. It is constantly
    connected to the cellular phone network and sends Ford a lot of data,
    including car location. This feature operates even when the ignition
    key is removed, and users report that they can't disable it.</p>

    <p>If you own one of these cars, have you succeeded in breaking the
    connectivity by disconnecting the cellular modem, or wrapping the
    antenna in aluminum foil?</p>

  <li id="M201812300">
    <!--#set var="DATE" value='<small class="date-tag">2018-12</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>New GM cars <a
    offer the feature of a universal back door</a>.</p>

    <p>Every nonfree program offers the user zero security against its
    developer. With this malfeature, GM has explicitly made things even

  <li id="M201711244">
    <!--#set var="DATE" value='<small class="date-tag">2017-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>The Furby Connect has a <a
    universal back door</a>. If the product as shipped doesn't act as a
    listening device, remote changes to the code could surely convert it
    into one.</p>


  <li id="M201711010">
    <!--#set var="DATE" value='<small class="date-tag">2017-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Sony has brought back its robotic pet Aibo, this time <a
    with a universal back door, and tethered to a server that requires
    a subscription</a>.</p>


  <li id="M201709090.1">
    <!--#set var="DATE" value='<small class="date-tag">2017-09</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Tesla cars have a used software to limit the part of the battery
    that was available to customers in some cars, and <a
    a universal back door</a>.</p> door in the software</a> to temporarily increase
    this limit.</p>

    <p>While remotely allowing car “owners” to use the
    whole battery capacity did not do them any harm, the same back
    door would permit Tesla (perhaps under the command of some
    government) to remotely order the car to use none of its battery. Or
    perhaps to drive its passenger to a torture prison.</p>


  <li id="M201702060.1">
    <!--#set var="DATE" value='<small class="date-tag">2017-02</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Vizio “smart” TVs <a
    have a universal back door</a>.</p>

    <p>The Amazon Echo appears to have a universal back door, since <a
      it installs “updates” automatically</a>.</p>
    <p>We have found nothing explicitly documenting the lack of any way to
      disable remote changes to the software, so we are not completely sure
      there isn't one, but it seems pretty clear.</p>


  <li id="M201609130">
    <!--#set var="DATE" value='<small class="date-tag">2016-09</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Xiaomi phones come with <a
    a universal back door in the application processor, for Xiaomi's

    <p>This is separate from <a href="#universal-back-door-phone-modem">the
    universal back door in the modem processor that the local phone
    company can use</a>.</p>


  <li id="M201608171">
    <!--#set var="DATE" value='<small class="date-tag">2016-08</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p id="windows-update">Microsoft
    Windows has a universal back door through which <a
    any change whatsoever can be imposed on the users</a>.</p>
    <p>More information on when <a

    <p>This was used</a>.</p> <a
    reported in 2007</a> for XP and Vista, and it seems
    that Microsoft used the same method to push the <a
    Windows 10 downgrade</a> to computers running Windows 7 and 8.</p>

    <p>In Windows 10, the universal back door
    is no longer hidden; all “upgrades” will be <a
    forcibly and immediately imposed</a>.</p>


  <li id="M201606060">
    <!--#set var="DATE" value='<small class="date-tag">2016-06</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>The Amazon Echo appears to have a universal back door, since <a
    it installs “updates” automatically</a>.</p>

    <p>We have found nothing explicitly documenting the lack of any way
    to disable remote changes to the software, so we are not completely
    sure there isn't one, but this seems pretty clear.</p>

  <li id="M201412180">
    <!--#set var="DATE" value='<small class="date-tag">2014-12</small>'
    --><!--#echo encoding="none" var="DATE" -->
    A Chinese version of Android has a universal back door</a>. Nearly
    all models of mobile phones have a <a href="#universal-back-door"> href="#universal-back-door-phone-modem">
    universal back door in the modem chip</a>. So why did Coolpad bother
    to introduce another? Because this one is controlled by Coolpad.</p>


  <li id="M201311300">
    <!--#set var="DATE" value='<small class="date-tag">2013-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    Some applications come with MyFreeProxy, which is a universal back door
    door</a> that can download programs and run them.</a></p> them.</p>


  <li id="M201202280">
    <!--#set var="DATE" value='<small class="date-tag">2012-02</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>ChromeOS has a universal back
    door. At least, Google says it does—in <a
    section 4 of the EULA</a>.</p>

  <li id="M200700000.1">
    <!--#set var="DATE" value='<small class="date-tag">[2007]</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>In addition to its <a href="#swindle-eraser">book
    eraser</a>, the Kindle-Swindle has a <a
    universal back door</a>.</p>

  <li id="M200612050">
    <!--#set var="DATE" value='<small class="date-tag">2006-12</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p id="universal-back-door">Almost id="universal-back-door-phone-modem">Almost every phone's communication
    processor has a universal back door which is <a
    often used to make a phone transmit all conversations it hears</a>.</p>
    <p>The back door hears</a>. See
      may take the form of bugs that have gone 20 years unfixed</a>.
      The choice to leave the security holes in place is morally
      equivalent to writing a back door.</p>
    <p>The back door is href="/proprietary/malware-mobiles.html#universal-back-door-phone-modem">Malware
    in the “modem processor”, whose
      job is to communicate with the radio network.  In most phones,
      the modem processor controls the microphone.  In most phones it
      has the power to rewrite the software Mobile Devices</a> for the main processor
    <p>A few phone models are specially designed so that the modem
      processor does not control the microphone, and so that it can't
      change the software in the main processor.  They still have the
      back door, but at least it is unable to turn the phone unto a
      listening device.</p>
    <p>The universal more info.</p>

<h3 id='other'>Other or undefined</h3>

<ul class="blurbs">
  <li id="M201711204">
    <!--#set var="DATE" value='<small class="date-tag">2017-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Intel's intentional “management engine” back door is apparently also used to make phones <a
      transmit even when they are turned off</a>.  This means their
      movements are tracked, and may also make the listening feature

    <p>In addition to its <a href="#swindle-eraser">book eraser</a>, the
      Kindle-Swindle has a <a
    unintended back door</a>.</p> doors</a> too.</p>

<h3 id="other">Other or undefined</h3>


  <li id="M201609240">
    <!--#set var="DATE" value='<small class="date-tag">2016-09</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>A Capcom's Street Fighter V update <a
    installed a driver that could be used as a back door by
    any application installed on a Windows computer</a>, but was <a
    immediately rolled back</a> in response to public outcry.</p>

    <p>ARRIS cable modem has a <a
      back door in the back door</a>.</p>


  <li id="M201511260">
    <!--#set var="DATE" value='<small class="date-tag">2015-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Dell computers, shipped with
    Windows, had a bogus root certificate that <a
    allowed anyone (not just Dell) to remotely authorize any software to
    run</a> on the computer.</p>


  <li id="M201511198">
    <!--#set var="DATE" value='<small class="date-tag">2015-11</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>ARRIS cable modem has a <a
    back door in the back door</a>.</p>

  <li id="M201510200">
    <!--#set var="DATE" value='<small class="date-tag">2015-10</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>“Self-encrypting” disk drives
    do the encryption with proprietary firmware so you
    can't trust it.  Western Digital's “My Passport” drives <a
    have a back door</a>.</p>

  <li id="M201504090">
    <!--#set var="DATE" value='<small class="date-tag">2015-04</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Mac OS X had an <a
    intentional local back door for 4 years</a>.</p> years</a>, which could be exploited
    by attackers to gain root privileges.</p>


  <li id="M201309110">
    <!--#set var="DATE" value='<small class="date-tag">2013-09</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Here is a big problem whose details are still secret: <a
    The FBI asks lots of companies to put back doors in proprietary
    programs</a>. We don't know of specific cases where this was done,
    but every proprietary program for encryption is a possibility.</p>


  <li id="M201308230">
    <!--#set var="DATE" value='<small class="date-tag">2013-08</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>The German government <a
    away from Windows 8 computers with TPM 2.0 2.0</a> (<a
    article in German</a>), due to potential back
    door capabilities of the TPM 2.0 chip</a>.</p> chip.</p>


  <li id="M201307300">
    <!--#set var="DATE" value='<small class="date-tag">2013-07</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>Here is a suspicion that
    we can't prove, but is worth thinking about: <a
    Writable microcode for Intel and AMD microprocessors</a> may be a
    vehicle for the NSA to invade computers, with the help of Microsoft,
    say respected security experts.</p>


  <li id="M201307114">
    <!--#set var="DATE" value='<small class="date-tag">2013-07</small>'
    --><!--#echo encoding="none" var="DATE" -->
    <p>HP “storage appliances” that
    use the proprietary “Left Hand”
    operating system have back doors that give HP <a
    remote login access</a> to them.  HP claims that this does not
    give HP access to the customer's data, but if the back door allows
    installation of software changes, a change could be installed that
    would give access to the customer's data.</p>

<div class="column-limit"></div>

<p>The EFF has other examples of the <a
use of back doors</a>.</p>

</div><!-- for id="content", starts in the include above

<!--#include virtual="/proprietary/proprietary-menu.html" -->
<!--#include virtual="/server/footer.html" -->
<div id="footer"> id="footer" role="contentinfo">
<div class="unprintable">

<p>Please send general FSF & GNU inquiries to
<a href="mailto:gnu@gnu.org"><gnu@gnu.org></a>.
There are also <a href="/contact/">other ways to contact</a>
the FSF.  Broken links and other corrections or suggestions can be sent
to <a href="mailto:webmasters@gnu.org"><webmasters@gnu.org></a>.</p>

<p><!-- TRANSLATORS: Ignore the original text in this paragraph,
        replace it with the translation of these two:

        We work hard and do our best to provide accurate, good quality
        translations.  However, we are not exempt from imperfection.
        Please send your comments and general suggestions in this regard
        to <a href="mailto:web-translators@gnu.org">

        <p>For information on coordinating and submitting contributing translations of
        our web pages, see <a
        README</a>. -->
Please see the <a
README</a> for information on coordinating and submitting contributing translations
of this article.</p>

<p>Copyright © 2014-2018 2014-2021 Free Software Foundation, Inc.</p>

<p>This page is licensed under a <a rel="license"
Commons Attribution 4.0 International License</a>.</p>

<!--#include virtual="/server/bottom-notes.html" -->

<p class="unprintable">Updated:
<!-- timestamp start -->
$Date: 2021/11/05 06:13:27 $
<!-- timestamp end -->
</div><!-- for class="inner", starts in the banner include -->