QQ Internet Browser

QQ Browser collects and transmits large amounts of data on both the user, device and sites visited to several URLs. On mobile devices it will collect:

• Both the International Mobile Equipment Identifier (IMEI) and the International Mobile Subscriber Identifier (IMSI)
• Android device ID
• Device WiFi MAC address
• All in-range WiFi access point names and MAC addresses

On Windows devices it will collect:

• A hardware fingerprint of the network MAC address and hard drive serial, model and controller version numbers.
• Windows version and build
• Windows user security identifier
• Internet Explorer version

Both versions collect the IP address, device hostname, full URL name, search history and Q-GUID unique user string.

This data is either unencrypted or is encrypted using hard-coded keys and as such is easily decrypted; it is also sent using HTTP. The ease with which an attacker could obtain the information poses a significant threat to any user, with both man-in-the-middle attacks and data theft easily achievable.

Several vulnerabilities also exist in the update process used by QQ Browser, two of which could allow a remote attacker to execute arbitrary code on the affected device.