What is hwlbsservice huawei?

The device model and build fingerprint data was accessed by the HwLBSService service. Same way you do on standard Android phone navigate your settings menu until you find Application management than from there you can adjust or delete. if manually, still have google search,huawei home, whatsapp, but just.

One of the bigger issues that we ran into during our research was that we simply were not truly using the device as a standard user. So, we made the phone our daily driver, installed some apps, put it on our VPN, loaded a cert to intercept HTTPS traffic, and monitored permissions.

To drive traffic, we installed the following apps:

Some things were pre installed, such as Facebook, Facebook messenger, YouTube, GMail, a translator app, and Netflix.

During our monitoring process, we finally saw a connection to the HiCloud. In this case, it was to query.hicloud.com — an endpoint in Germany. The first service that performed the connection was com.huawei.ims. We assume that this is for IP multimedia subsystem (IMS). Huawei conveniently has an article about what IMS is for a product:

A more literal article on “what is IMS?”:

Aside from that, we observed three (3) types of information being accessed on the device:

The device model and build fingerprint data was accessed by the HwLBSService service. This sounds scary until you see where the data was sent. The following endpoints were contacted by HwLBSService:

It is worth noting that only the device’s build name/fingerprint was observed being sent out. Secondly, it was only sent to the two aforementioned google domains.

Facebook Messenger was the service that accessed the SIM Provider…cool.

We also wanted to note that the device did connect with query.hicloud.com to check for system updates. Thankfully, that was done so over HTTPS and not standard HTTP.