miui ROM: miui malware

<div dir="ltr" style="text-align: left;" trbidi="on"><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Data security firm Bluebox has discovered preinstalled malware and a host of other issues with a Xiaomi Mi 4 device the company tested. Scarier still, the phone seems to have been tampered with by an unidentified third party.</span></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSpNmHZJRrSF-K3CdFbVWo0ZWLYiujFv4t_L5euauHmP14X1YNRe6OBcmHUQH-HzhXWz5FfrKGVnDE3IP5QSSHdltex_CS0tjbTwVav3XmFDi7ZPClaCXWzJ3acU3yhuIir4t3tzXtdyE/s1600/mi4.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSpNmHZJRrSF-K3CdFbVWo0ZWLYiujFv4t_L5euauHmP14X1YNRe6OBcmHUQH-HzhXWz5FfrKGVnDE3IP5QSSHdltex_CS0tjbTwVav3XmFDi7ZPClaCXWzJ3acU3yhuIir4t3tzXtdyE/s1600/mi4.jpg" width="640" /></a></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;"><br /></span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Bluebox first </span><span style="color: #444444;"><span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; box-sizing: border-box; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline-width: medium;">issued a report on Thursday</span></span><span style="color: #444444;">, after reaching out to Xiaomi and not getting a response.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">When the researchers first received the phone, they made sure it was legitimately a Xiaomi device using Xiaomi’s “Mi Identification” app. Upon further testing, security researchers found that there were several malicious applications preloaded onto the smartphone, including adware that disguises itself as a verified Google application; trojans, which allow hackers to gain control of the phone; and other high-risk software.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Furthermore, the device was “vulnerable to every vulnerability we scanned for,” wrote Andrew Blaich, Bluebox’s lead security analyst, in a blog post.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Blaich also said that Mi 4’s operating system is a non-certified version of Android and is therefore subject to a number of flaws. Some of the bugs and security holes his researchers discovered were specific to old Android software, not its current release, leading them to believe that the OS was a mashup between the new KitKat 4.4.4. and an older form of Android. Other issues within the API build made the researchers unsure whether the device was meant for testing or consumer use.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">There was also suspicion that the device may have been tampered with, because some of the apps held signatures that differed from the manufacturer’s signing key.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">On Friday, the firm finally heard back from Xiaomi.</span></div><blockquote style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; font-style: italic; line-height: 1.4444444444; margin: 0px 46px 2em; outline: none medium; padding: 11px 22px; quotes: none; vertical-align: baseline;"><div style="border: 0px; box-sizing: border-box; font-family: inherit; font-size: inherit; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">“We are certain the device that Bluebox tested is not using a standard MIUI ROM, as our factory ROM and OTA ROM builds are never rooted and we don’t pre-install services such as YT Service, PhoneGuardService, AppStats etc. Bluebox could have purchased a phone that has been tampered with, as they bought it via a physical retailer in China. Xiaomi does not sell phones via third-party retailers in China, only via our official online channels and selected carrier stores.” — Hugo Barra, VP International</span></div></blockquote><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Barra went on to say that the company was investigating why it took Xiaomi so long to respond to Bluebox’s initial message. He also said that customers should only purchase Xiaomi products from Mi.com and the select verified stores that the company works with. However, Blaich seemed unimpressed by the response.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">“If it’s this easy to modify the device in the retail chain, it could also be modified in transit, even when purchased from mi.com,” he wrote, and then referenced a <span style="font-family: inherit;"><span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; box-sizing: border-box; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline-width: medium;">recent article from Der Spiegel</span></span> that demonstrated how U.S. intelligence officials are able to intercept computers before they reach their destination and load them with malware — a more modern form of wiretapping. The thought being, if Xiaomi smartphones are already getting hacked at the retail level, they may be vulnerable to more complex attacks.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">Within the report, Blaich notes that the more popular a device is, the more frequently it’s attacked. Xiaomi already has <span style="font-family: inherit;"><span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; box-sizing: border-box; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline-width: medium;">100 million people on its MIUI platform</span></span> and has <span style="font-family: inherit;"><span style="background-attachment: initial; background-clip: initial; background-image: initial; background-origin: initial; background-position: initial; background-repeat: initial; background-size: initial; box-sizing: border-box; font-stretch: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; outline-width: medium;">plans to launch in the U.S. this year</span></span>, which means the number of Xiaomi users is only going up.</span></div><div style="background-color: white; border: 0px; box-sizing: border-box; font-family: 'Open Sans', sans-serif; font-size: 16px; font-stretch: inherit; line-height: 24px; margin-bottom: 2em; outline: none medium; padding: 0px; vertical-align: baseline;"><span style="color: #444444;">source: <a href="http://venturebeat.com/2015/03/07/security-firm-finds-pre-installed-malware-on-xiaomi-mi-4-smartphone/">VB</a></span></div></div>

According to Bluebox , Xiaomi MI 4 may have preinstalled malware

Data security firm Bluebox has discovered preinstalled malware and a host of other issues with a Xiaomi Mi 4 device the company tested. Scar...