Proprietary Insecurity

Nonfree (proprietary) software is very often malware (designed to mistreat the user). Nonfree software is controlled by its developers, which puts them in a position of power over the users; that is the basic injustice. The developers and manufacturers often exercise that power to the detriment of the users they ought to serve.

This typically takes the form of malicious functionalities.

This page lists clearly established cases of insecurity in proprietary software that has grave consequences or is otherwise noteworthy. Even though most of these security flaws are unintentional, thus are not malicious functionalities in a strict sense, we report them to show that proprietary software is not as secure as mainstream media may say.

This doesn't imply that free software is immune to bugs or insecurities. The difference between free and proprietary software in this respect is the handling of the bugs: free software users are able to study the program and/or fix the bugs they find, often in communities as they are able to share the program, while proprietary program users are forced to rely on the program's developer for fixes.

If the developer does not care to fix the problem — often the case for embedded software and old releases — the users are sunk. But if the developer does send a corrected version, it may contain new malicious functionalities as well as bug fixes.

If you know of an example that ought to be in this page but isn't here, please write to <[email protected]> to inform us. Please include the URL of a trustworthy reference or two to serve as specific substantiation.

2024-09
Kia cars were built with a back door that enabled the company's server to locate them and take control of them. The car owner had access to these controls through the Kia server. That the car owner had such control is not objectionable. However, that Kia itself had such control is Orwellian, and ought to be illegal. The icing on the Orwellian cake is that the server had a security fault which allowed absolutely anyone to activate those controls for any Kia car.

Many people will be outraged at that security bug, but this was presumably an accident. The fact that Kia had such control over cars after selling them to customers is what outrages us, and that must have been intentional on Kia's part.
2024-01
UHD Blu-ray disks are loaded with malware of the worst kinds. Among other things, playing them on a PC requires Intel SGX (Software Guard Extensions), which not only has numerous security vulnerabilities, but also was deprecated and removed from mainstream Intel CPUs in 2022.
2023-12
A back door in Apple devices, present and abused from at least 2019 until 2023, allowed crackers to have full control over them by sending iMessage texts that installed malware without any action on the user's part. Infections, among other things, gave the intruders access to owners' microphone recordings, photos, location and other personal data.
2023-11
x86 and ARM based computers shipped with UEFI are potentially vulnerable to a design omission called LogoFAIL. A cracker can replace the BIOS logo with a fake one that contains malicious code. Users can't fix this omission because it is in the nonfree UEFI firmware that users can't replace.
2022-11
Hackers discovered dozens of flaws in the security (in the usual narrow sense) of many brands of automobiles.

Security in the usual narrow sense means security against unknown third parties. We are more concerned with security in the broader sense—against the manufacturer as well as against unknown third parties. It is clear that each of these vulnerabilities can be exploited by the manufacturer too, and by any government that can threaten the manufacturer enough to compel the manufacturer's cooperation.
2022-10
The Microsoft Office encryption is weak, and susceptible to attack.

Encryption is a tricky field, and easy to mess up. It is wise to insist on encryption software that is (1) free software and (2) studied by experts.
2022-08
A security researcher found that the iOS in-app browser of TikTok injects keylogger-like JavaScript code into outside web pages. This code has the ability to track all users' activities, and to retrieve any personal data that is entered on the pages. We have no way of verifying TikTok's claim that the keylogger-like code only serves purely technical functions. Some of the accessed data could well be saved to the company's servers, and even sent to third parties. This would open the door to extensive surveillance, including by the Chinese government (to which TikTok has indirect ties). There is also a risk that the data would be stolen by crackers, and used to launch malware attacks.

The iOS in-app browsers of Instagram and Facebook behave essentially the same way as TikTok's. The main difference is that Instagram and Facebook allow users to access third-party sites with their default browser, whereas TikTok makes it nearly impossible.

The researcher didn't study the Android versions of in-app browsers, but we have no reason to assume they are safer than the iOS versions.

Please note that the article wrongly refers to crackers as “hackers.”
2022-07
A bug in Tesla cars software lets crackers install new car keys, unlock cars, start engines, and even prevent real owners from accessing their cars.

A cracker even reported that he was able to disable security systems and take control of 25 cars.
Please note that these articles wrongly use the word “hacker” instead of cracker.
2022-02
A security failure in Microsoft's Windows is infecting people's computers with RedLine stealer malware using a fake Windows 11 upgrade installer.
2022-01
A critical bug in Apple's iOS makes it possible for attackers to alter a shutdown event, tricking the user into thinking that the phone has been powered off. But in fact, it's still running, and the user can't feel any difference between a real shutdown and the fake shutdown.
2021-11
Hundreds of Tesla drivers were locked out of their cars as a result of Tesla's app suffering from an outage, which happened because the app is tethered to the company's servers.
2021-11
Some researchers at Google found a zero-day vulnerability on MacOS, which crackers used to target people visiting the websites of a media outlet and a pro-democracy labor and political group in Hong Kong.

Please note that the article wrongly refers to crackers as “hackers”.
2021-08
Various models of security cameras, DVRs, and baby monitors that run proprietary software are affected by a security vulnerability that could give attackers access to live feeds.
2021-07
The pegasus spyware used vulnerabilities on proprietary smartphone operating systems to impose surveillance on people. It can record people's calls, copy their messages, and secretly film them, using a security vulnerability. There's also a technical analysis of this spyware available in PDF format.

A free operating system would've let people to fix the bugs for themselves but now infected people will be compelled to wait for corporations to fix the problems.

Please note that the article wrongly refers to crackers as “hackers”.
2021-07
A newly found Microsoft Windows vulnerability can allow crackers to remotely gain access to the operating system and install programs, view and delete data, or even create new user accounts with full user rights.

The security research firm accidentally leaked instructions on how the flaw could be exploited but Windows users should still wait for Microsoft to fix the flaw, if they fix it.

Please note that the article wrongly refers to crackers as “hackers”.
2021-06
TikTok apps collect biometric identifiers and biometric information from users' smartphones. The company behind it does whatever it wants and collects whatever data it can.
2021-05
Apple is moving its Chinese customers' iCloud data to a datacenter controlled by the Chinese government. Apple is already storing the encryption keys on these servers, obeying Chinese authority, making all Chinese user data available to the government.
2021-05
A motorcycle company named Klim is selling airbag vests with different payment methods, one of them is through a proprietary subscription-based option that will block the vest from inflating if the payments don't go through.

They say there is a 30-days grace period if you miss a payment but the grace period is no excuse to the insecurity.
2021-05
The United States' government is reportedly considering teaming up with private companies to monitor American citizens' private online activity and digital communications.

What creates the opportunity to try this is the fact that these companies are already snooping on users' private activities. That in turn is due to people's use of nonfree software which snoops, and online dis-services which snoop.
2021-04
A zero-day vulnerability in Zoom which can be used to launch remote code execution (RCE) attacks has been disclosed by researchers. The researchers demonstrated a three-bug attack chain that caused an RCE on a target machine, all this without any form of user interaction.
2021-03
Over 150 thousand security cameras that used Verkada company's proprietary software are cracked by a major security breach. Crackers have had access to security archives of various gyms, hospitals, jails, schools, and police stations that have used Verkada's cameras.

It is injustice to the public for gyms, stores, hospitals, jails, and schools to hand “security” footage to a company from which the government can collect it at any time, without even telling them.

Please note that the article wrongly refers to crackers as “hackers”.
2021-03
At least 30 thousand organizations in the United States are newly “cracked” via holes in Microsoft's proprietary email software, named Microsoft 365. It is unclear whether there are other holes and vulnerabilities in the program or not but history and experience tells us it wouldn't be the last disaster with proprietary programs.
2021-02
Researchers at the security firm SentinelOne discovered a security flaw in proprietary program Microsoft Windows Defender that lurked undetected for 12 years. If the program was free (as in freedom), more people would have had a chance to notice the problem, therefore, it could've been fixed a lot sooner.
2021-01
A cracker took control of people's internet-connected chastity cages and demanded ransom. The chastity cages are being controlled by a proprietary app (mobile program).

(Please note that the article wrongly refers to crackers as "hackers".)
2020-12
Commercial crackware can get passwords out of an iMonster, use the microphone and camera, and other things.
2020-12
A Zoom executive carried out snooping and censorship for the Chinese government.

This abuse of Zoom's power shows how dangerous that power is. The root problem is not the surveillance and censorship, but rather the power that Zoom has. It gets that power partly from the use of its server, but also partly from the nonfree client program.
2020-12
United States officials are facing one of biggest crackings against them in years, when malicious code was sneaked into SolarWinds' proprietary software named Orion. Crackers got access to networks when users downloaded a tainted software update. Crackers were able to monitor internal emails at some of the top agencies in the US.

(Please note that the article wrongly refers to crackers as "hackers".)
2020-12
Baidu apps were caught collecting sensitive personal data that can be used for lifetime tracking of users, and putting them in danger. More than 1.4 billion people worldwide are affected by these proprietary apps, and users' privacy is jeopardized by this surveillance tool. Data collected by Baidu may be handed over to the Chinese government, possibly putting Chinese people in danger.
2020-11
Some Wavelink and JetStream wifi routers have universal back doors that enable unauthenticated users to remotely control not only the routers, but also any devices connected to the network. There is evidence that this vulnerability is actively exploited.

If you consider buying a router, we encourage you to get one that runs on free software. Any attempts at introducing malicious functionalities in it (e.g., through a firmware update) will be detected by the community, and soon corrected.

If unfortunately you own a router that runs on proprietary software, don't panic! You may be able to replace its firmware with a free operating system such as libreCMC. If you don't know how, you can get help from a nearby GNU/Linux user group.
2020-11
Apple has implemented a malware in its computers that imposes surveillance on users and reports users' computing to Apple.

The reports are even unencrypted and they've been leaking this data for two years already. This malware is reporting to Apple what user opens what program at what time. It also gives Apple power to sabotage users' computing.
2020-10
Samsung is forcing its smartphone users in Hong Kong (and Macau) to use a public DNS in Mainland China, using software update released in September 2020, which causes many unease and privacy concerns.
2020-08
TikTok exploited an Android vulnerability to obtain user MAC addresses.
2020-06
A disasterous security bug touches millions of products in the Internet of Stings.

As a result, anyone can sting the user, not only the manufacturer.
2020-04
The proprietary program Microsoft Teams' insecurity could have let a malicious GIF steal user data from Microsoft Teams accounts, possibly across an entire company, and taken control of “an organization's entire roster of Teams accounts.”
2020-04
Riot Games' new anti-cheat is malware; runs on system boot at kernel level on Windows. It is insecure software that increases the attack surface of the operating system.
2019-11
Internet-tethered Amazon Ring had a security vulnerability that enabled attackers to access the user's wifi password, and snoop on the household through connected surveillance devices.

Knowledge of the wifi password would not be sufficient to carry out any significant surveillance if the devices implemented proper security, including encryption. But many devices with proprietary software lack this. Of course, they are also used by their manufacturers for snooping.
2019-08
A series of vulnerabilities found in iOS allowed attackers to gain access to sensitive information including private messages, passwords, photos and contacts stored on the user's iMonster.

The deep insecurity of iMonsters is even more pertinent given that Apple's proprietary software makes users totally dependent on Apple for even a modicum of security. It also means that the devices do not even try to offer security against Apple itself.
2019-08
Out of 21 gratis Android antivirus apps that were tested by security researchers, eight failed to detect a test virus. All of them asked for dangerous permissions or contained advertising trackers, with seven being more risky than the average of the 100 most popular Android apps.

(Note that the article refers to these proprietary apps as “free”. It should have said “gratis” instead.)
2019-07
Many Android apps can track users' movements even when the user says not to allow them access to locations.

This involves an apparently unintentional weakness in Android, exploited intentionally by malicious apps.
2019-05
Users caught in the jail of an iMonster are sitting ducks for other attackers, and the app censorship prevents security companies from figuring out how those attacks work.

Apple's censorship of apps is fundamentally unjust, and would be inexcusable even if it didn't lead to security threats as well.
2019-03
The Medtronics Conexus Telemetry Protocol has two vulnerabilities that affect several models of implantable defibrillators and the devices they connect to.

This protocol has been around since 2006, and similar vulnerabilities were discovered in an earlier Medtronics communication protocol in 2008. Apparently, nothing was done by the company to correct them. This means you can't rely on proprietary software developers to fix bugs in their products.
2019-02
The Ring doorbell camera is designed so that the manufacturer (now Amazon) can watch all the time. Now it turns out that anyone else can also watch, and fake videos too.

The third party vulnerability is presumably unintentional and Amazon will probably fix it. However, we do not expect Amazon to change the design that allows Amazon to watch.
2018-09
Researchers have discovered how to hide voice commands in other audio, so that people cannot hear them, but Alexa and Siri can.
2018-08
Since the beginning of 2017, Android phones have been collecting the addresses of nearby cellular towers, even when location services are disabled, and sending that data back to Google.
2018-08
Crackers found a way to break the security of an Amazon device, and turn it into a listening device for them.

It was very difficult for them to do this. The job would be much easier for Amazon. And if some government such as China or the US told Amazon to do this, or cease to sell the product in that country, do you think Amazon would have the moral fiber to say no?

(These crackers are probably hackers too, but please don't use “hacking” to mean “breaking security”.)
2018-07
Siri, Alexa, and all the other voice-control systems can be hijacked by programs that play commands in ultrasound that humans can't hear.
2018-07
Some Samsung phones randomly send photos to people in the owner's contact list.
2017-12
One of the dangers of the “internet of stings” is that, if you lose your internet service, you also lose control of your house and appliances.

For your safety, don't use any appliance with a connection to the real internet.
2017-11
Intel's intentional “management engine” back door has unintended back doors too.
2017-11
Amazon recently invited consumers to be suckers and allow delivery staff to open their front doors. Wouldn't you know it, the system has a grave security flaw.
2017-09
Bad security in some cars makes it possible to remotely activate the airbags.
2017-09
A “smart” intravenous pump designed for hospitals is connected to the internet. Naturally its security has been cracked.

(Note that this article misuses the term “hackers” referring to crackers.)
2017-08
The bad security in many Internet of Stings devices allows ISPs to snoop on the people that use them.

Don't be a sucker—reject all the stings.

(It is unfortunate that the article uses the term “monetize”.)
2017-06
Many models of Internet-connected cameras have backdoors.

That is a malicious functionality, but in addition it is a gross insecurity since anyone, including malicious crackers, can find those accounts and use them to get into users' cameras.
2017-06
Many models of Internet-connected cameras are tremendously insecure. They have login accounts with hard-coded passwords, which can't be changed, and there is no way to delete these accounts either.
2017-06
Intel's CPU backdoor—the Intel Management Engine—had a major security vulnerability for 10 years.

The vulnerability allowed a cracker to access the computer's Intel Active Management Technology (AMT) web interface with an empty password and gave administrative access to access the computer's keyboard, mouse, monitor among other privileges.

It does not help that in newer Intel processors, it is impossible to turn off the Intel Management Engine. Thus, even users who are proactive about their security can do nothing to protect themselves besides using machines that don't come with the backdoor.
2017-05
The proprietary code that runs pacemakers, insulin pumps, and other medical devices is full of gross security faults.
2017-05
Conexant HD Audio Driver Package (version 1.0.0.46 and earlier) pre-installed on 28 models of HP laptops logged the user's keystroke to a file in the filesystem. Any process with access to the filesystem or the MapViewOfFile API could gain access to the log. Furthermore, according to modzero the “information-leak via Covert Storage Channel enables malware authors to capture keystrokes without taking the risk of being classified as malicious task by AV heuristics”.
2017-05
Exploits of bugs in Windows, which were developed by the NSA and then leaked by the Shadowbrokers group, are now being used to attack a great number of Windows computers with ransomware.
2017-04
Many Android devices can be hijacked through their Wi-Fi chips because of a bug in Broadcom's nonfree firmware.
2017-03
When Miele's Internet of Stings hospital disinfectant dishwasher is connected to the Internet, its security is crap.

For example, a cracker can gain access to the dishwasher's filesystem, infect it with malware, and force the dishwasher to launch attacks on other devices in the network. Since these dishwashers are used in hospitals, such attacks could potentially put hundreds of lives at risk.
2017-03
The CIA exploited existing vulnerabilities in “smart” TVs and phones to design a malware that spies through their microphones and cameras while making them appear to be turned off. Since the spyware sniffs signals, it bypasses encryption.
2017-02
“CloudPets” toys with microphones leak childrens' conversations to the manufacturer. Guess what? Crackers found a way to access the data collected by the manufacturer's snooping.

That the manufacturer and the FBI could listen to these conversations was unacceptable by itself.
2017-02
If you buy a used “smart” car, house, TV, refrigerator, etc., usually the previous owners can still remotely control it.
2017-02
The mobile apps for communicating with a smart but foolish car have very bad security.

This is in addition to the fact that the car contains a cellular modem that tells big brother all the time where it is. If you own such a car, it would be wise to disconnect the modem so as to turn off the tracking.
2017-01
A cracker would be able to turn the Oculus Rift sensors into spy cameras after breaking into the computer they are connected to.

(Unfortunately, the article improperly refers to crackers as “hackers”.)
2017-01
Samsung phones have a security hole that allows an SMS message to install ransomware.
2017-01
WhatsApp has a feature that has been described as a “back door” because it would enable governments to nullify its encryption.

The developers say that it wasn't intended as a back door, and that may well be true. But that leaves the crucial question of whether it functions as one. Because the program is nonfree, we cannot check by studying it.
2016-12
The “smart” toys My Friend Cayla and i-Que can be remotely controlled with a mobile phone; physical access is not necessary. This would enable crackers to listen in on a child's conversations, and even speak into the toys themselves.

This means a burglar could speak into the toys and ask the child to unlock the front door while Mommy's not looking.
2016-10
4G LTE phone networks are drastically insecure. They can be taken over by third parties and used for man-in-the-middle attacks.
2016-08
Due to weak security, it is easy to open the doors of 100 million cars built by Volkswagen.
2016-08
Ransomware has been developed for a thermostat that uses proprietary software.
2016-08
A flaw in Internet Explorer and Edge allows an attacker to retrieve Microsoft account credentials, if the user is tricked into visiting a malicious link.
2016-07
“Deleted” WhatsApp messages are not entirely deleted. They can be recovered in various ways.
2016-07
A half-blind security critique of a tracking app: it found that blatant flaws allowed anyone to snoop on a user's personal data. The critique fails entirely to express concern that the app sends the personal data to a server, where the developer gets it all. This “service” is for suckers!

The server surely has a “privacy policy,” and surely it is worthless since nearly all of them are.
2016-07
A vulnerability in Apple's Image I/O API allowed an attacker to execute malicious code from any application which uses this API to render a certain kind of image file.
2016-07
A bug in a proprietary ASN.1 library, used in cell phone towers as well as cell phones and routers, allows taking control of those systems.
2016-06
Antivirus programs have so many errors that they may make security worse.

GNU/Linux does not need antivirus software.
2016-05
Samsung's “Smart Home” has a big security hole; unauthorized people can remotely control it.

Samsung claims that this is an “open” platform so the problem is partly the fault of app developers. That is clearly true if the apps are proprietary software.

Anything whose name is “Smart” is most likely going to screw you.
2016-04
A bug in the iThings Messages app allowed a malicious web site to extract all the user's messaging history.
2016-04
Malware was found on security cameras available through Amazon.

A camera that records locally on physical media, and has no network connection, does not threaten people with surveillance—neither by watching people through the camera, nor through malware in the camera.
2016-03
Over 70 brands of network-connected surveillance cameras have security bugs that allow anyone to watch through them.
2016-03
Many proprietary payment apps transmit personal data in an insecure way. However, the worse aspect of these apps is that payment is not anonymous.
2016-02
The Nissan Leaf has a built-in cell phone modem which allows effectively anyone to access its computers remotely and make changes in various settings.

That's easy to do because the system has no authentication when accessed through the modem. However, even if it asked for authentication, you couldn't be confident that Nissan has no access. The software in the car is proprietary, which means it demands blind faith from its users.

Even if no one connects to the car remotely, the cell phone modem enables the phone company to track the car's movements all the time; it is possible to physically remove the cell phone modem, though.
2016-02
A pacemaker running proprietary code was misconfigured and could have killed the implanted person. In order to find out what was wrong and get it fixed, the person needed to break into the remote device that sets parameters in the pacemaker (possibly infringing upon manufacturer's rights under the DMCA). If this system had run free software, it could have been fixed much sooner.
2015-10
FitBit fitness trackers have a Bluetooth vulnerability that allows attackers to send malware to the devices, which can subsequently spread to computers and other FitBit trackers that interact with them.
2015-10
“Self-encrypting” disk drives do the encryption with proprietary firmware so you can't trust it. Western Digital's “My Passport” drives have a back door.
2015-08
Security researchers discovered a vulnerability in diagnostic dongles used for vehicle tracking and insurance that let them take remote control of a car or lorry using an SMS.
2015-07
Crackers were able to take remote control of the Jeep “connected car”. They could track the car, start or stop the engine, and activate or deactivate the brakes, and more.

We expect that Chrysler and the NSA can do this too.

If you own a car that contains a phone modem, it would be a good idea to deactivate this.
2015-06
Due to bad security in a drug pump, crackers could use it to kill patients.
2015-05
Many smartphone apps use insecure authentication methods when storing your personal data on remote servers. This leaves personal information like email addresses, passwords, and health information vulnerable. Because many of these apps are proprietary it makes it hard to impossible to know which apps are at risk.
2015-05
Hospira infusion pumps, which are used to administer drugs to a patient, were rated “least secure IP device I've ever seen” by a security researcher.

Depending on what drug is being infused, the insecurity could open the door to murder.
2015-04
Mac OS X had an intentional local back door for 4 years, which could be exploited by attackers to gain root privileges.
2014-05
An app to prevent “identity theft” (access to personal data) by storing users' data on a special server was deactivated by its developer which had discovered a security flaw.

That developer seems to be conscientious about protecting personal data from third parties in general, but it can't protect that data from the state. Quite the contrary: confiding your data to someone else's server, if not first encrypted by you with free software, undermines your rights.
2014-04
Lots of hospital equipment has lousy security, and it can be fatal.
2014-02
The insecurity of WhatsApp makes eavesdropping a snap.
2013-12
Some flash memories have modifiable software, which makes them vulnerable to viruses.

We don't call this a “back door” because it is normal that you can install a new system in a computer, given physical access to it. However, memory sticks and cards should not be modifiable in this way.
2013-12
Point-of-sale terminals running Windows were taken over and turned into a botnet for the purpose of collecting customers' credit card numbers.
2013-11
The NSA can tap data in smart phones, including iPhones, Android, and BlackBerry. While there is not much detail here, it seems that this does not operate via the universal back door that we know nearly all portable phones have. It may involve exploiting various bugs. There are lots of bugs in the phones' radio software.
2013-09
The NSA has put back doors into nonfree encryption software. We don't know which ones they are, but we can be sure they include some widely used systems. This reinforces the point that you can never trust the security of nonfree software.
2013-09
The FTC punished a company for making webcams with bad security so that it was easy for anyone to watch through them.
2013-08
Replaceable nonfree software in disk drives can be written by a nonfree program. This makes any system vulnerable to persistent attacks that normal forensics won't detect.
2013-07
It is possible to kill people by taking control of medical implants by radio. More information in BBC News and IOActive Labs Research blog.
2013-07
“Smart homes” turn out to be stupidly vulnerable to intrusion.
2012-12
Crackers found a way to break security on a “smart” TV and use its camera to watch the people who are watching TV.
2011-03
It is possible to take control of some car computers through malware in music files. Also by radio. More information in Automotive Security And Privacy Center.

Proprietary malware

By type

By product

By company

Articles

UHD Blu-ray Denies Your Freedom