What's all the hype about Chinese phones?
Chinese phones have received a lot of hype lately. Whether it's a news article explaining the surprising number of Chinese phones in a certain area, or the earnings report of Mediatek, the fabless semiconductor giant that began and continues to lead the Chinese chipset industry, or the sudden industry focus on solutions that can handle analysis of these devices, it seems we are being confronted with Chinese phones like never before. Our experience up until this point has shown us that quite a few examiners are scratching their heads and wondering, "why"?
If I just described you, my assumption is that you live in a non-coastal US or non-international border state or possibly in an international region that isn't experiencing high infiltration of Chinese phones. And to be fair, examiners in states like California are also scratching their heads at the topic. But, ask our soldiers in theater about it and chances are they will have seen quite a few of these phones. Ask the police in Indonesia if they see much else besides these phones. Chinese phones show up primarily in specific regions located closer to Asia where income levels are significantly lower and where features that are specific to those devices are commonplace and expected.
The term "Chinese cell phone" relates to a number of categories of cell phones, all of which are built upon Chinese chipsets. Many people are familiar with San Diego based Qualcomm, the largest cell phone chip providor in the world, but not too many are familiar with Mediatek, the Taiwanese company that is the second largest of the class. Mediatek chipsets find their way into roughly one fourth of cell phones worldwide, with the largest category of those being "white-box" phones or "clone" phones. These phones are cheap compared to Western phones and often tout features that can't be found in other types of handsets. When consumable income isn't available to purchase a genuine Nokia or iPhone, a clone phone becomes an attractive option.
Another reason why Chinese cell phones, and white-box phones in particular, are showing up in such great quantities in specific regions relates to their "dream" features. One feature in particular, multiple SIM cards, has become very popular. Certain countries in the Middle East, and elsewhere I'm sure, provide cheaper calling rates for the first few minutes used per day. 30 minutes of calling might be offered at a rate one half the price of any minutes used after that. When monetary incentives like these exist, the solution is simply to purchase as many phone numbers, or SIM cards, as will allow me the cheaper per-day rate for all of the minutes I need. Of course I need to have a phone that supports this many SIMs, which is why triple, quadruple, and even more SIM cards are being supported in white-box phones. Other features like antennas for watching television, full media support, Internet capability, interesting aesthetics (ex: car-shaped phones) can make these devices even more attractive than the genuine phones they imitate.
The Chinese cell phone industry has been developing for over ten years, evolving into a market that has no simple description. For other reasons which go beyond the scope of this post, "Chinese phones" is not a term anymore that relates to just grey market phones, or low quality phones, or many of the other descriptions we might have used in the past. Because of this, we are now seeing variations of Chinese phones entering Western markets. A Chinese phone may now take the form of a genuine Motorola phone, an LG, an Andriod-based or even Windows Mobile-based device. It's hard to tell what a "Chinese phone" is, and it's getting increasingly harder. This year is proving to be a monumental one for Chinese chipset manufacturers, something that we will be discussing in different forums over the coming months.
So to the question of what to do if you encounter a Chinese phone. If you know it's a Chinese phone, great, you're ready to try some options. If you are not sure, but simply know it's not supported by other standard forensics tools, statistics tell us it's a Chinese phone. As far as analysis, simply put, there are three "mainstream" options. Your first option, which really isn't that mainstream, is to try and use a flasher box like the Avator box to extract a binary file from the phone. These devices have been around since the beginning of cell phones and have traditionally been difficult to use. Some of the new boxes are a bit simpler but they still suffer a number of shortcomings when utliized for forensic examinations, which was never their intended use. In the future we anticipate seeing these flasher boxes becoming part of the product line of standard mobile forensics companies such as Cellebrite, which might prove to make them even easier to use, but for now we are stuck with what we've had for a while. They are difficult to use, not supported, not designed for forensics, and downright dangerous unless you know what you're doing. Even if you have the knowledge and expertise to successfully use a flasher box, that will only take you as far as ending up with a binary file that needs to be manually carved through to find SMS, contacts, call log, and other user information.
Your second option is our product, Tarantula, the first tool that supports comprehensive analysis of Chinese phones. We developed Tarantula to support our customers in China who weren't finding success analyzing local phones using standard mobile forensics tools. Tarantula has been sold in China for a year now but we are excited to have just released the product for the US and other international markets. Tarantula is meant to reduce time (and frustration) when analyzing Chinese phones, and automatically decodes SMS, contacts, call log, and more. A full physical examination of most Chinese phones, including decoding, can generally be accomplished in less than 10 minutes. Our goal was simply to make Chinese cell phone analysis possible for every examiner, and we believe we are on our way to doing that. Of course, there will always be room for improvement and we don't claim to have the perfect tool, but we are working as hard as we can to reach that goal. For more information on Tarantula please see our product page
Oh right, and option number three. Throw it in a box and forget about it, which is what most examiners have done until now.
