Skip to main content

Samsung’s Device Care app is sending data back to China — but it’s less scary than it sounds

Samsung’s Device Care app is sending data back to China — but it’s less scary than it sounds

/

A built-in app on Galaxy devices works with a Chinese security firm to find junk files

Share this story

If you buy something from a Verge link, Vox Media may earn a commission. See our ethics statement.

Photo by Amelia Holowaty Krales / The Verge

On January 6th, a post appeared on Reddit’s largest Android forum with alarming news: “Chinese spyware pre-installed on all Samsung phones.”

“I know the title is rather sensational,” the author explained, “however it couldn’t get any closer to the truth.”

The problem was a utility in Samsung’s Device Care application, a mandatory feature that comes preinstalled as part of Samsung’s Android implementation that cannot be removed. Using packet analysis tools on a Galaxy S10, the author discovered some strange traffic coming out of Device Care’s storage scanner, which looks for junk files that can be deleted to free up space. That scanner was sending data back to Chinese domains — and because storage scanners generally need access to all of the files on your computer, the data could include almost anything.

“The storage optimization process ... is fully managed by Samsung’s device care solution.”

There was an immediate explanation in the post, but it wasn’t entirely reassuring. The scanner utility was made in collaboration with Qihoo 360, a Chinese security company that has occasionally made headlines for complying with national censorship directives. But it wasn’t clear from the scan which data was being sent back to Qihoo and why, which led the Redditor to worry about spyware. And since the app was built into Samsung’s operating system, there is no way for concerned users to remove it.

According to Samsung, the truth is less alarming than it appears. The company says the only data sent back to Qihoo is generic information needed to optimize storage — specifically naming OS version, phone model, and storage capacity, among other data. Qihoo’s main contribution is a reference library for identifying junk files, but that library is stored locally in the utility, and Qihoo never receives data that would allow it to identify a particular file on a user’s device.

“Samsung takes the protection of our users’ data very seriously, and we design our products with privacy and security top-of-mind,” a company representative told The Verge. “The storage optimization process, including the scanning and removal of junk files, is fully managed by Samsung’s device care solution.”

Still, the fight is a reminder of the intense fears surrounding Chinese tech companies and the broader concerns around international antivirus firms, similar to the scandal that engulfed the Russia-based Kaspersky Labs in 2017. As concerns about Huawei and other Chinese hardware companies come to a peak in Washington, it’s only natural that Qihoo partnerships might turn a few heads. And while Samsung’s explanation checks out, it may not be enough to quiet all of the doubts on /r/Android.