Site icon Cybercory

Taiwan NSB Warns of Critical Cybersecurity Risks in China-Made Mobile Apps

Ouaissou DEMBELE

Taiwan’s National Security Bureau (NSB) has flagged five popular Chinese-made mobile apps-including TikTok, Weibo, WeChat, RedNote, and Baidu Cloud-as posing significant cybersecurity risks, citing excessive data collection, transmission to Chinese servers, and potential biometric harvesting. This alert, issued on 2 July 2025, follows a comprehensive evaluation by NSB, the Ministry of Justice Investigation Bureau (MJIB), and the Criminal Investigation Bureau (CIB), and mirrors global efforts to curb data privacy threats from foreign-controlled apps.

On 2 July 2025, Taiwan’s NSB published its findings under the National Intelligence Work Act, warning that the five China-developed apps violated data protection standards across 15 security indicators. The review, carried out with MJIB and CIB, uncovered severe breaches in data privacy-prompting public caution.

Inspection Parameters & Shocking Findings

Evaluation Framework

The apps were analyzed against Mobile Application Basic Information Testing Standard v4.0, which comprises five categories:

  1. Personal data collection
  2. Excess permission usage
  3. Data transmission & sharing
  4. System information extraction
  5. Biometric data access

App-by-App Violations

AppFailed Indicators
RedNote15/15
Weibo13/15
TikTok13/15
WeChat10/15
BaiduCloud9/15

Violations involved unauthorized collection of facial biometrics, screenshots, clipboard contents, location, app lists, and device data. Four of the five apps also gathered facial recognition information—a serious privacy breach.

Data Exfiltration & Legal Implications

All five apps transmitted user data to servers located in mainland China. Under China’s Cybersecurity Law and National Intelligence Law, companies operating in China must surrender personal data when requested by authorities a reality with serious implications under the lens of Taiwanese national security.

Regional (MEA) and Global Comparisons

Taiwan’s caution mirrors global moves:

MEA nations should note: apps transferring data to unfriendly jurisdictions can compromise regional privacy laws and critical infrastructure. Embedding rigorous mobile security services alongside training, awareness, and pentesting (linked to saintynet.com) is key.

Official Statements

Technical Insights (Optional)

MITRE ATT&CK Overview
Although no CVEs are listed, suspicious app behaviour may resemble:

No IOCs are public, but monitoring network destinations (Chinese server IPs) in mobile traffic is advised.

Actionable Takeaways for Security Leaders

  1. Enhance mobile app vetting processes for corporate deployments.
  2. Enforce whitelisting on government/mobile fleets.
  3. Deploy full-device encryption and execute application sandboxing.
  4. Integrate mobile device management (MDM) to limit unverified app installations.
  5. Monitor network communications for foreign server connections.
  6. Offer targeted security services, awareness, and training (via saintynet.com) on mobile threats.
  7. Regularly update app permissions and system patches.
  8. Dissuade staff from using non-approved apps—enforce policy.
  9. Assess third-party dependency risks in your software supply chain.
  10. Stay informed via global news, updates, alerts, best practices, and trends (linked to cybercory.com) on mobile and geopolitical cyber risks.

Conclusion

Taiwan’s NSB findings underscore the growing risks posed by foreign-controlled mobile applications. As they collect and exfiltrate sensitive user data, organizations globally-particularly within MEA-must elevate cybersecurity vigilance. Ensuring robust vetting, policy enforcement, and continuous monitoring will safeguard user privacy and national security. Expect intensified regulatory scrutiny worldwide and the need for enhanced security services to defend against app-sourced threats.

Sources

Exit mobile version