US Senator Chris Van Hollen told the US Department of Commerce that cybersecurity experts have identified a vulnerability in the landline phones of the Chinese firm Yealink, Defense One reported, citing a letter and report from Chain Security. We are talking about the ability of some of the company’s phones to be controlled via a PC. Chain Security revealed that the function allows organizing surveillance of the user, and in the terms of use of the service, the ability to monitor users for the purpose of national security of the PRC is clearly spelled out.
The report, sent to the Ministry of Commerce back in September 2021, highlights a specific model of office phones – Yealink T54W. “We found that when a phone is connected to the device’s control platform and connected to a PC to access the local network, it collects information about the sites visited,” Chain Security CEO Jeff Stern told the publication. He noted that this feature, as well as remote call recording, is usually used by employers. However, Yealink phones do not close such an opportunity for the platform system administrator, who is located in China.
The company’s report states that the Yealink service use agreement obliges users to follow PRC laws, and “an associated set of provisions allows active monitoring of users in the event of ‘national interest’.” Mr. Van Hollen told the Department of Commerce that the document “raises serious concerns about the safety of audiovisual equipment produced and supplied in the United States by Chinese firms.”
Note that in December 2021, the US Treasury imposed restrictions on eight Chinese companies, including the drone manufacturer DJI. The company’s products had previously been declared a national security threat by the US Department of Defense. As Axios reported, the US Secret Service acquired DJI drones three days later; the documentation noted that they “will complement the existing fleet of small unmanned aerial vehicles.”
.