Radioddity App Caught Sending Unencrypted Personal Data to China
If you own a Baofeng or Radioddity radio and use their companion app to program your device, you’ll want to pay close attention to this one. During some routine testing and network traffic analysis, I discovered that the app associated with these radios is exposing a surprising amount of personal data — and sending it to servers located in China. This isn’t a theoretical vulnerability or a “maybe this could happen” scenario. This is real, observable data leakage happening right now, every time you use the app.
In this post, I’ll break down exactly what data is being exposed, why it matters, and why I think the entire practice of requiring app registration just to program a handheld radio needs to end.
Let’s get into the specifics of what I found when digging into this app’s network traffic. Using basic packet capture and inspection tools, I was able to see exactly what information the app was transmitting, where it was going, and — critically — whether it was encrypted along the way. Spoiler: a lot of it wasn’t.
What Data Is Being Exposed
Here’s a rundown of everything I found being sent by the app, much of it without proper encryption:
- Your email address — sent in plain text.
- Your password in the clear — this happens specifically during the registration process. That means if someone were intercepting traffic at the time you create your account, they could potentially capture your actual plain-text password.
- Your hashed password — this occurs during normal login. For those unfamiliar, “hashing” is a one-way cryptographic process that’s supposed to scramble your password into a fixed string of characters so it can’t easily be reversed back into the original password. Hashing itself isn’t necessarily bad — it’s a standard security practice — but combined with everything else going on here, it’s part of a bigger pattern of sloppy data handling.
- GPS coordinates (latitude and longitude) — the app is sending your location telemetry on a regular, ongoing basis while you use it. This isn’t a one-time location check; it’s continuous tracking.
- Other users’ email addresses — this is by far the most alarming discovery. The app appears to leak email addresses belonging to other users, not just your own account information. There is no legitimate reason a radio-programming app should ever expose data belonging to other people.
Why This Matters
To be clear, there is no valid technical reason for any of this. A simple firmware-programming app for a handheld radio doesn’t need to know your GPS location on an ongoing basis. It doesn’t need to store or transmit your password in plain text. And it absolutely should never be leaking other users’ personal information.
The fact that this telemetry is being routed to servers based in China raises additional questions about data handling, storage practices, and who ultimately has access to this information once it leaves your device. Regardless of where the servers are located, sending passwords unencrypted and leaking other people’s email addresses is a serious security failure on its own.
Why Does a Radio Programming App Even Need an Account?
This is really the core issue. These are handheld radios — devices used for GMRS (General Mobile Radio Service), ham radio, and similar communications. Programming them should be a straightforward, local process: plug in the radio, load your frequencies and settings, and you’re done. There is no reason this process should require creating an account, logging into a cloud service, or connecting to anything resembling a social media platform.
Requiring registration just to configure a radio needlessly expands the amount of personal data being collected and, as we’ve seen here, exposes users to real security risks in the process.
My Takeaway Going Forward
Going forward, my personal policy is simple: if an app requires me to register an account or log in just to program my radio, I’m not going to use it. It’s not worth the risk, and frankly, it shouldn’t be a requirement in the first place. Local, offline programming should always be an option, and manufacturers need to be held accountable when their apps handle user data this carelessly.
I’ll continue digging into this issue and will share updates as I learn more. Thanks for reading, and I’ll see you in the next one.
