As many of you probably know already, the Trump administration banned US companies from doing business with Huawei a few months ago. As a consequence, the Mate 30 Pro, Huawei’s latest flagship phone was launched without Google apps due to the import ban. The phone came with a basic, open-source Android instead of the advanced Google Mobile Service (e.g. Google Play Store, Gmail and Google Maps) we are accustomed to.
However, a few months ago an anonymous Chinese company called Lzplay came with a workaround. Through their website, you can easily download their app to gain access to Google services. Google apps should not be able to work on Mate 30 due to the lack of system-level permissions. However, Lzplay’s method managed to do so. Nonetheless, not without a price. According to John Wu, an Android security researcher, Lzplay used undocumented Huawei APIs inside the operating system that is used for device security to trick Google servers. What does this mean for your phone? After the installation of Lzplay, your Mate 30 Pro’s security is at risk since the application has administrator rights. That means that Lzplay can easily brick your phone or install ransomware without you noticing.
According to Huawei’s documentation for security authorization SDK, third party developers are required to sign legal agreements and let Huawei review it in order to gain access to the software development kit (SDK). Therefore, the developer of Lzplay was somehow aware of these undocumented APIs, signed the legal agreements, went through the reviews and eventually have the app signed by Huawei. It should also be noted that Lzplay was launched 3 days before the public launch of the Mate 30 Pro which means that Lzplay knew well about all of this before the launch and had the time to build an app, went through the review process, and launch a website. Wu suggested that Huawei is aware of the secret tools Lzplay used and explicitly allowed its existence since this will allow people to get Google Play onto the devices that would have been blocked otherwise.
Last week, Wu revealed the information regarding Lzplay and shortly after, the website of Lzplay was taken offline and the signature was remotely revoked by Huawei. Does this mean that Huawei played a part in this? It’s hard to say. According to a Huawei spokesperson, the multinational technology company has no involvement with Lzplay. It could be that Huawei created Lzplay to alleviate Google app anxiety for potential Mate 30’s customers. If this was the case, then it sure did backfire Huawei. Albeit, the backdoor may be shut for now but could be opened again through another method. Probably, a more solid one than the one Lzplay offered.
References:
Amadeo, R. (2019). ‘The Internet’s horrifying new method for installing Google apps on Huawei phones’. Accessed on 7 October 2019 on https://arstechnica.com/gadgets/2019/10/the-internets-horrifying-new-method-for-installing-google-apps-on-huawei-phones/2/
Cooper, D. (2019). ‘Huawei’s Mate 30 loses workaround for installing Google apps’. Accessed on 7 October 2019 on https://www.engadget.com/2019/10/02/huawei-mate-30-workaround-lzplay-shut-down/?guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAAF-jsfJEpD19GyD_nXAQn-U0-gpP1qukCY-g7MT-c7nx7eTOV_o2k3bTYi6CoLTeBDOS1_K3xhhys9OsnNdzjmrZrp7qcUacIYBP-q26AJX2LK8XiuegqjcUF0iudVPLpmCsC2Al37FZae8eKAlFkXE0UJEBUWYTcHe4npVX0gmw&guccounter=2
Huawei (n.d.) ‘安全类授权开放开发指南’. Accessed on 7 October 2019 on https://developer.huawei.com/consumer/cn/devservice/doc/30702
Phelan, D. (2019). ‘Huawei Shock: Mate 30 Pro’s Back Door To Google Apps Slams Shut’. Accessed on 7 October 2019 on https://www.forbes.com/sites/davidphelan/2019/10/01/huawei-mate-30-pro-has-the-back-door-to-loading-google-apps-just-slammed-shut/#c69d7dc76a82
Wu, J. (2019). ‘Huawei’s Undocumented APIs – A Backdoor to Reinstall Google Services’. Accessed on 7 October 2019 on https://medium.com/@topjohnwu/huaweis-undocumented-apis-a-backdoor-to-reinstall-google-services-c3a5dd71a7cd
