Thread by @0xDUDE

Can anyone (from China) identify these Messaging services?

imsg <--...
qg <--...
qqmesg. <-- imqq.com
wwmsg <--...
wxmsg <--...
yymsg <--...

In China, they have a surveillance program on social networks which looks like a jerry-rigged PRISM clone of the NSA.

So this social media surveillance program is retrieving (private) messages per province from 6 social platforms and extracts named, ID numbers, ID photos, GPS locations, network information, and all the conversations and file transfers get imported into a large online database.

Around 364 million online profiles and their chats & file transfers get processed daily. Then these accounts get linked to a real ID/person. The data is then distributed over police stations per city/province to separate operators databases with the same surveillance network name

With these "operator databases" the local law enforcement investigate 2600 to 2900 messages and profiles. The name new table per day to keep track of the progress. So they manually review the social media communication (public/private messages).

And the most remarkable part is that this network syncs all this data to open MongoDBs in 18 locations.

"r_Capture_Time" : "2019-03-03 02:58:08.0",
"r_QQMsg" : "2019-03-03 02:58:08 \"ζ°? 、XXX丶ζ说:!收【【【46--48道士号】】】卖的微信XXXXXXXXXXXぁ"
}

The most dialogs which are being monitored are typical teenager conversations. Which conversations need to be reviewed by a human based on "trigger words" is at this moment still not entirely clear.

One of the multiple intelligence feeds showing the distribution of triggered events routed to the police stations identified by numbers. It's a very effective way of spreading the workload from a single source to multiple operators. It will require tremendous work ethics as well

How many gamers live in China and who many of them are using an internet cafe (or internet bars / netbars) as they are being called there?

It is most likely that this system is only for tracking gamers as most of the sample dialogs appears to be about this subject.

”Most of the internet cafes use management softwares called "网吧管理软件", there are only a few companies develop such software， this is a gray area, the management softwares contains advertising, push notifications, even with ability to push executables to a client.”

The internet cafe management software named "网吧管理软件"

source: lygg.gov.cn/jyxx/003002/00…

Daily roughly 1 billion private messages get selected & routed to the closest "operator" based on geolocation. It's fascinating how quickly new monitoring solutions are deployed in the same way as the old ones were discovered & taken down. Country-based filtering for "protection"

From 240 million messages to over 1 billion private messages per day.
The biggest issue is that this not only for ordering pizza. It is completely hardwired into our lives. Doing "monitoring in a safe way" still appears to be a challenge.

https://twitter.com/InkstoneNews/status/1110328761256275968

What we have learned from 1.081.231.257 "captured" WeChat dialogues ( 3,784,309,399 messages) made on the 18 March 2019 is that were automatically selected for "reviewing" based on a "keyword" trigger.

Not all the dialogues were in Chinese or only had GPS coordinates in China.

From 3.784.309.399 messages, 3.698.798.784 were written in Chinese.
59.378.236 in English and 26.132.379 in another language. 98% of the Chinese messages had a GPS location in China. 68% of the English messages were sent in China. More than 19 million were sent from outside 🇨🇳

We were able to detect a patron of a little bit more than 800 Chinese keywords (combinations) which would be the selection criteria for having the entire WeChat dialogue being stored in this database for further "analysis" by most likely a law enforcement.

We could build a "dictionary" of 829 keywords (combinations) based on the intercepted WeChat messages which were written in English. I was a bit surprised to see my full name "Victor Gevers" in this generated English list. 维克多 葛弗斯 was not in the Chinese keyword list.

Using these keywords will not get your account locked. But I you try to send your contact a few messages contains a few hundred of these words then you need to “unblock” your account after a few minutes.

Based on the 3,784,309,399 WeChat messages we tried to build a "keyword trigger list" with NLP tools which possibly triggered the automatic selection criteria for having the entire conversation being stored for review.

Image: i.imgur.com/PWNQEpe.png
Text: pastebin.com/raw/LCPyenzC