Categories: Security

F-Secure discovered Xiaomi handset spying on users’data

Experts at F-Secure security firm analyzing the new Xiaomi RedMi 1S discovered that it sends out to a server located in China a lot of user’s data.

Xiaomi, one of the most important Chinese smartphone manufacturers is accused for secretly steal users’ data and send it back to a server in China, despite the company has turned off the data backup functions.

Security experts at F-Secure security firm has conducted a series of analysis on the new Xiaomi RedMi 1S and to verify the alleged presence of hidden data stealer components. The researchers confirmed that the devices send an impressive amount of users’data to “api.account.xiaomi.com“, a server located in China. The information transferred by the Xiaomi device includes:

IMEI Number of your phone
IMSI Number (through MI Cloud)
Your contacts and their details
Text Messages

A couple of months ago, a report issued by the Nanjing-based Yangtse Evening News stated that smartphones produced by Chinese Xiaomi are able to steal bank card data from wireless connections.

On the forum IMA Mobile recently was reported that Redmi Note smartphones continually make connections with IP addresses in Beijing, China, even if users turn off the iCloud-like service named MiCloud.

The experts noticed that the Xiaomi was transmitting only when the handset was connected to a WiFi network, they also noticed that also erasing the pre-installed Android distribution the anomalous and worrying behavior still persisted.

In a blogpost, Hugo Barra from Xiaomi denied all the allegations made by F-Secure.

“MIUI does not secretly upload photos and text messages. MIUI requests public data from Xiaomi servers from time to time. These include data such as preset greeting messages (thousands of jokes, holiday greetings and poems) in the Messaging app and MIUI OTA update notifications, i.e. all non-personal data that does not infringe on user privacy.” Barra said.

To the question: “Does Xiaomi upload any personal data without my knowledge?” he replied:

Xiaomi offers a service called Mi Cloud that enables users to back up and manage personal information in the cloud, as well as sync to other devices. This includes contacts, notes, text messages and photos. Mi Cloud is turned off by default. Users must log in with their Mi accounts and manually turn on Mi Cloud. They also have the option to only turn on backup for certain types of data. The use and storage of data in Mi Cloud fully respects the local laws of each country and region. Strict encryption algorithms are implemented to protect user privacy.

The expert refers to the Xiaomi’s Mi Cloud Service as the service used by the company to backup personal information in the cloud. Hugo announced that from today users’ will be able to turn OFF Mi Cloud Service manually from the mobile device.

“We have scheduled an OTA system update for today (Aug 10th) to implement this change. After the upgrade, new users or users who factory reset their devices can enable the service by visiting “Settings > Mi Cloud > Cloud Messaging” from their home screen or “Settings > Cloud Messaging” inside the Messaging app — these are also the places where users can turn off Cloud Messaging.” he added.

Hugo Xiaomi highlight that Xiaomi considers that user’s privacy seriously and takes all possible steps to protect it.

Xiaomi is considered a young giant of mobile manufacturers, if the allegations on the Xiaomi handset come true it could be the second time that a Chinese smartphone was found spying on user’s data, recently security experts at German G Data claimed that the popular Chinese Android Smartphone Star N9500 comes with a pre-installed spyware.

Stay Tuned for further details on the case.

Pierluigi Paganini

(Security Affairs – Xiaomi, cyber espionage)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.