As live audio chat app Clubhouse ascends in popularity around the world, concerns about its data practices also grow.
The app is currently only available on iOS, so some developers set out in a race to create Android, Windows and Mac versions of the service. While these endeavors may not be ill-intentioned, the fact that it takes programmers little effort to reverse-engineer and fork Clubhouse — that is, when developers create new software based on its original code — is sounding an alarm about the app’s security.
The common goal of these unofficial apps, as of now, is to broadcast Clubhouse audio feeds in real time to users who cannot access the app otherwise because they don’t have an iPhone. One such effort is called Open Clubhouse, which describes itself as a “third-party web application based on flask to play Clubhouse audio.” The developer of Open Clubhouse confirmed to TechCrunch that Clubhouse blocked its service five days after its launch without providing an explanation.
“[Some companies] ask a lot of information from users, analyze those data and even abuse them. Meanwhile, they restrict how people use the apps and fail to give users the rights they deserve. To me, this constitutes monopoly or exploitation,” said Open Clubhouse’s developer nicknamed AiX.
Clubhouse said “recording or streaming without the explicit permission of the speakers is against the Clubhouse terms of service.”
“Over the weekend, an individual temporarily streamed multiple rooms from their own feed to a website,” a Clubhouse spokesperson told TechCrunch. “This individual’s account has been permanently banned from the service and we have added additional safeguards to prevent people from doing this in the future.”
AiX wrote the program “for fun” and wanted it to broaden Clubhouse’s access to more people. Another similar effort came from a developer named Zhuowei Zhang, who created Hipster House to let those without an invite browse rooms and users, and those with an invite to join rooms as a listener though they can’t speak — Clubhouse is invite-only at the moment. Zhang stopped developing the project, however, after noticing a better alternative.
These third-party services, despite their innocuous intentions, can be exploited for surveillance purposes, as Jane Manchun Wong, a researcher known for uncovering upcoming features in popular apps, noted in a tweet.
“I think the approaches of reverse engineering is neutral,” Wong told TechCrunch. “The ethical aspect depends on the intent. But anyone can take the source code, repurpose it, and use it in ways that leave certain groups of people vulnerable.”
Identity crisis
Clubhouse lets people create public chat rooms, which are available to any user who joins before a room reaches its maximum capacity, and private rooms, which are only accessible to room hosts and users authorized by the hosts.
But not all users are aware of the open nature of Clubhouse’s public rooms. During its brief window of availability in China, the app was flooded with mainland Chinese debating politically sensitive issues from Taiwan to Xinjiang, which are heavily censored in the Chinese cyberspace. Some vigilant Chinese users speculated the possibility of being questioned by the police for delivering sensitive remarks. While no such event has been publicly reported, the Chinese authorities have banned the app since February 8.
Clubhouse is now blocked in China after a brief uncensored period
Clubhouse’s design is by nature at odds with the state of communication it aims to achieve. The app encourages people to use their real identity — registration requires a phone number and an existing user’s invite. Inside a room, everyone can see who else is there. This setup instills trust and comfort in users when they speak as if speaking at a networking event.
But the third-party apps that are able to extract Clubhouse’s audio feeds show that the app isn’t even semi-public: It’s public.
“These third-party clients highlight the rooms of security and privacy improvements that Clubhouse can work on. If it is programmatically possible to broadcast audio out of the Clubhouse app, it means it could also be possible to automatically harvest audio data from Clubhouse rooms,” Wong observed.
“Clubhouse could mitigate this by ensuring users can only listen to one room at a time,” she added.
Backend mess
More troublesome is that users can “ghost listen,” as developer Zerforschung found. That is, users can hear a room’s conversation without having their profile displayed to the room participants. Eavesdropping is made possible by establishing communication directly with Agora, a service provider employed by Clubhouse. As multiple security researchers found, Clubhouse relies on Agora’s real-time audio communication technology. Sources have also confirmed the partnership with TechCrunch.
Some technical explanation is needed here. When a user joins a chatroom on Clubhouse, it makes a request to Agora’s infrastructure, as the Stanford Internet Observatory discovered. To make the request, the user’s phone contacts Clubhouse’s application programming interface (API), which then creates “tokens”, the basic building block in programming that authenticates an action, to establish a communication pathway for the app’s audio traffic.
Now, the problem is there can be a disconnect between Clubhouse and Agora, allowing the Clubhouse end, which manages user profiles, to be inactive while the Agora end, which transmits audio data, remains active, as technology analyst Daniel Sinclair noted. That’s why users can continue to eavesdrop on a room without having their profile displayed to the room’s participants.
The Agora partnership has sparked other forms of fear. The company, which operates mainly from the U.S. and China, disclosed in its IPO prospectus that its data may be subject to China’s cybersecurity law, which requires network operators in China to assist police investigations. That possibility, as the Stanford Internet Observatory points out, is contingent on whether Clubhouse stores its data in China.
While the Clubhouse API is banned in China, the Agora API appears unblocked. Tests by TechCrunch find that users currently need a VPN to join a room, an action managed by Clubhouse, but can listen to the room conversation, which is facilitated by Agora, without the VPN off. What’s the safest way for China-based users to access the app, given the official attitude is that it should not exist? It’s worth noting that the app was unavailable on the Chinese App Store even before its ban, and Chinese users needed to download it through workarounds.
The Clubhouse team may be overwhelmed by data questions in the past few days, but these early observations from researchers and hackers may urge it to fix its vulnerabilities sooner, paving its way to grow beyond its several million users and $1 billion valuation mark.
Updated the story on February 23, 2020, with comments from Clubhouse and experts.
Comment