miui ROM: xiaomi security

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Data security firm Bluebox has discovered preinstalled malware and a host of other issues with a Xiaomi Mi 4 device the company tested. Scarier still, the phone seems to have been tampered with by an unidentified third party.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSpNmHZJRrSF-K3CdFbVWo0ZWLYiujFv4t_L5euauHmP14X1YNRe6OBcmHUQH-HzhXWz5FfrKGVnDE3IP5QSSHdltex_CS0tjbTwVav3XmFDi7ZPClaCXWzJ3acU3yhuIir4t3tzXtdyE/s1600/mi4.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSpNmHZJRrSF-K3CdFbVWo0ZWLYiujFv4t_L5euauHmP14X1YNRe6OBcmHUQH-HzhXWz5FfrKGVnDE3IP5QSSHdltex_CS0tjbTwVav3XmFDi7ZPClaCXWzJ3acU3yhuIir4t3tzXtdyE/s1600/mi4.jpg" width="640" /></a></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;"><br /></span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Bluebox first </span><span style="color: #444444;"><span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; box-sizing: border-box; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline-width: medium;">issued a report on Thursday</span></span><span style="color: #444444;">, after reaching out to Xiaomi and not getting a response.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">When the researchers first received the phone, they made sure it was legitimately a Xiaomi device using Xiaomi’s “Mi Identification” app. Upon further testing, security researchers found that there were several malicious applications preloaded onto the smartphone, including adware that disguises itself as a verified Google application; trojans, which allow hackers to gain control of the phone; and other high-risk software.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Furthermore, the device was “vulnerable to every vulnerability we scanned for,” wrote Andrew Blaich, Bluebox’s lead security analyst, in a blog post.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Blaich also said that Mi 4’s operating system is a non-certified version of Android and is therefore subject to a number of flaws. Some of the bugs and security holes his researchers discovered were specific to old Android software, not its current release, leading them to believe that the OS was a mashup between the new KitKat 4.4.4. and an older form of Android. Other issues within the API build made the researchers unsure whether the device was meant for testing or consumer use.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">There was also suspicion that the device may have been tampered with, because some of the apps held signatures that differed from the manufacturer’s signing key.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">On Friday, the firm finally heard back from Xiaomi.</span></div><blockquote style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; font-style: italic; line-height: 1.4444444444; margin: 0px 46px 2em; outline: none medium; padding: 11px 22px; quotes: none; vertical-align: baseline;"><div style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">“We are certain the device that Bluebox tested is not using a standard MIUI ROM, as our factory ROM and OTA ROM builds are never rooted and we don’t pre-install services such as YT Service, PhoneGuardService, AppStats etc. Bluebox could have purchased a phone that has been tampered with, as they bought it via a physical retailer in China. Xiaomi does not sell phones via third-party retailers in China, only via our official online channels and selected carrier stores.” — Hugo Barra, VP International</span></div></blockquote><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Barra went on to say that the company was investigating why it took Xiaomi so long to respond to Bluebox’s initial message. He also said that customers should only purchase Xiaomi products from Mi.com and the select verified stores that the company works with. However, Blaich seemed unimpressed by the response.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">“If it’s this easy to modify the device in the retail chain, it could also be modified in transit, even when purchased from mi.com,” he wrote, and then referenced a <span style="font-family: inherit;"><span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; box-sizing: border-box; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline-width: medium;">recent article from Der Spiegel</span></span> that demonstrated how U.S. intelligence officials are able to intercept computers before they reach their destination and load them with malware — a more modern form of wiretapping. The thought being, if Xiaomi smartphones are already getting hacked at the retail level, they may be vulnerable to more complex attacks.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Within the report, Blaich notes that the more popular a device is, the more frequently it’s attacked. Xiaomi already has <span style="font-family: inherit;"><span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; box-sizing: border-box; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline-width: medium;">100 million people on its MIUI platform</span></span> and has <span style="font-family: inherit;"><span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; box-sizing: border-box; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline-width: medium;">plans to launch in the U.S. this year</span></span>, which means the number of Xiaomi users is only going up.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">source: <a href="http://venturebeat.com/2015/03/07/security-firm-finds-pre-installed-malware-on-xiaomi-mi-4-smartphone/">VB</a></span></div></div>

According to Bluebox , Xiaomi MI 4 may have preinstalled malware

Data security firm Bluebox has discovered preinstalled malware and a host of other issues with a Xiaomi Mi 4 device the company tested. Scar...

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="background-color: white; color: #444444; font-size: 14px; line-height: 24px; padding: 0px; word-wrap: break-word;"><span style="color: dimgrey; word-wrap: break-word;"><span style="word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif; font-size: 16px; word-wrap: break-word;">Xiaomi has obtained a permanent injunction against Indian InfoSec Consortium and Taiwan based security expert Mr. Chen Huang that restrains them from disclosing any information in regards to Xiaomi user accounts that they may possess.</span></span></span></div><div style="background-color: white; color: #444444; font-size: 14px; line-height: 24px; padding: 0px; word-wrap: break-word;"><span style="color: dimgrey; word-wrap: break-word;"><span style="word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif; font-size: 16px; word-wrap: break-word;">Here is the entire story.</span></span></span></div><div style="background-color: white; color: #444444; font-size: 14px; line-height: 24px; padding: 0px; word-wrap: break-word;"><span style="color: dimgrey; word-wrap: break-word;"><span style="word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif; font-size: 16px; word-wrap: break-word;">Taiwan based security researcher, Mr. Chen Huang was supposed to give a presentation on his research, titled: “<span style="color: #3b5a97; word-wrap: break-word;"><a href="http://g0s.org/speakers" style="color: #336699; word-wrap: break-word;" target="_blank">Privacy-Alert: Exposing China-based XIAOMI Mobiles</a></span>” at Asia’s biggest hackers conference, Ground Zero Summit (G0S) 2014 organized by Indian InfoSec Consortium in New Delhi (on 13th & 14th November).</span></span></span></div><div style="background-color: white; color: #444444; font-size: 14px; line-height: 24px; padding: 0px; word-wrap: break-word;"><span style="color: dimgrey; word-wrap: break-word;"><span style="word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif; font-size: 16px; word-wrap: break-word;">In regards to his presentation, the website said,  “In this session Taiwanese Researcher will demonstrate how Xiaomi Phones have been sending device data and personal data of Xiaomi Phone user to Chinese Servers. The Researcher will also release Server Logs, Mi Account username, Emails and passwords of millions of Xiaomi users which have been obtained using a Zero Day flaw in the Xiaomi Servers.”</span></span></span></div><div style="background-color: white; color: #444444; font-size: 14px; line-height: 24px; padding: 0px; word-wrap: break-word;"><span style="color: dimgrey; word-wrap: break-word;"><span style="word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif; font-size: 16px; word-wrap: break-word;">In short, Chen Huang was going to demonstrate how Xiaomi phones have been sending data to Chinese servers and he had server logs, account user names, emails and passwords to prove it.</span></span></span></div><div style="background-color: white; color: #444444; font-size: 14px; line-height: 24px; padding: 0px; word-wrap: break-word;"><span style="color: dimgrey; word-wrap: break-word;"><span style="word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif; font-size: 16px; word-wrap: break-word;">From Xiaomi’s point of view, they have done the right thing by bringing a restraining order, so as to ensure that their user data does not become public. However, there is something quite startling in the what Xiaomi has said. They have mentioned that the researcher may be holding millions of Mi phone user names and passwords, which is quite significant.</span></span></span></div><div style="background-color: white; color: #444444; font-size: 14px; line-height: 24px; padding: 0px; word-wrap: break-word;"><span style="color: dimgrey; word-wrap: break-word;"><span style="word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif; font-size: 16px; word-wrap: break-word;"><img alt="" border="0" class="zoom" height="335" id="aimg_xA595" src="http://trak.in/wp-content/uploads/2014/11/extractnew.jpg" style="cursor: pointer; word-wrap: break-word;" width="638" /></span></span></span></div><div style="background-color: white; color: #444444; font-size: 14px; line-height: 24px; padding: 0px; word-wrap: break-word;"><span style="color: dimgrey; word-wrap: break-word;"><span style="word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif; font-size: 16px; word-wrap: break-word;">It is known fact that Xiaomi was sending the user data to Chinese servers, and subsequently they took steps to ensure user has a choice of avoiding it. The significant thing however this court order points is that Xiaomi thinks millions of user accounts may have actually been compromised.</span></span></span></div><span style="background-color: white; color: #444444; font-size: 14px; font-weight: 700; line-height: 21px; word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif;">Complete Court Restraining Order.</span></span><br /><div style="background-color: white; color: #444444; font-size: 14px; line-height: 24px; padding: 0px; word-wrap: break-word;"><span style="color: dimgrey; word-wrap: break-word;"><span style="word-wrap: break-word;"><span style="font-family: Helvetica Neue, Arial, Helvetica, sans-serif; font-size: 16px; word-wrap: break-word;"><img alt="" border="0" class="zoom" height="1158" id="aimg_KopiQ" src="http://trak.in/wp-content/uploads/2014/11/page-1.jpg" style="cursor: pointer; word-wrap: break-word;" width="659" /><img alt="" border="0" class="zoom" height="1103" id="aimg_ptTo2" src="http://trak.in/wp-content/uploads/2014/11/Page-2.jpg" style="cursor: pointer; word-wrap: break-word;" width="660" /><img alt="" border="0" class="zoom" height="879" id="aimg_b04Zq" src="http://trak.in/wp-content/uploads/2014/11/Page-3.jpg" style="cursor: pointer; word-wrap: break-word;" width="658" /><img alt="" border="0" class="zoom" height="994" id="aimg_LPKV6" src="http://trak.in/wp-content/uploads/2014/11/Page-4.jpg" style="cursor: pointer; word-wrap: break-word;" width="654" /><img alt="" border="0" class="zoom" height="918" id="aimg_l0X2a" src="http://trak.in/wp-content/uploads/2014/11/Page-5.jpg" style="cursor: pointer; word-wrap: break-word;" width="641" /><img alt="" border="0" class="zoom" height="889" id="aimg_sSkta" src="http://trak.in/wp-content/uploads/2014/11/Page-6.jpg" style="cursor: pointer; word-wrap: break-word;" width="642" /></span></span></span></div></div>

Xiaomi / MI India User data Compromised? Delhi Court’s Restraining Order Shows It Might!

Xiaomi has obtained a permanent injunction against Indian InfoSec Consortium and Taiwan based security expert Mr. Chen Huang that restrains ...