All Your MMS Are Belong To China

A warning about the GO SMS Pro messaging app in Android Market.

I have discovered that when used in a particular way the app uploads your private MMS image attachments to a public web server in China (gosms.en.3g.cn)

For example, here’s one I sent earlier -

http://gosms.en.3g.cn/D?f=NPQRRMAE200dI_ViaGoSMS

It doesn’t tell you that it’s doing this and the client settings aren’t obvious. Worst of all there is no way to delete images once they have been posted.

Try it for yourself:

  • Open GO SMS Pro and start composing a new message
  • Add some text and then tap on the paperclip icon to add an attachment
  • In the GO tab, tap Pictures and select an image to attach, then tap Send

You’ll see that instead of a true MMS with an embedded image attachment being sent, your image has been uploaded to a Chinese web server and your message now contains a link to it.

If you are using this app in place of your stock messaging client and want to be sure that your images are sent only to the intended recipient, then I strongly urge you to uninstall immediately.