Slashdot Mirror
F-Secure: Xiaomi Smartphones Do Secretly Steal Your Data
They may be well reviewed and China's new top selling phone, but reader DavidGilbert99 writes with reason to be cautious about Xiaomi's phones: Finnish security firm F-Secure has seemingly proven that Xiaomi smartphones do in fact upload user data without their permission/knowledge despite the company strongly denying these allegations as late as 30 July. Between commercial malware and government agencies, how do you keep your phone's data relatively private?
"By not having one" comment
One could always try one of these...
Nice little phone
You have 5 Moderator Points!
Which Helpless Linux zealot/MS basher do you want to mod down today?
Xiaomi smartphones do in fact upload user data without their permission/knowledge
Considering that half the apps out there (and I mean benign/legitimate apps!) seem to upload user data without user's knowledge, that is not so shocking. Once you start using your phone, several apps will start siphoning your data.
Recent "simplification" of Android Google-store permissions means that I don't even know how much of a permission I am giving to a new app.
I want it totally private. Has the concept of privacy gotten so totally lost that people seem okay to settle for relative privacy?
By the way, the best way to keep your data private is to keep it out of your untrusted phone/computer/whatnot, and use bogus data when you need to enter something.
Exemples: use "Acme inc." as your home phone number's name in your addressbook, and nicknames for your contacts. Don't enter your full address as your home in your satnav's app but someone's address in a street close-by, etc.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Oh, someone swears it's all a-okay. I'm totally reassured now...
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
So far, all they've found it doing is reporting the IMEI by sending an HTTP GET http://api.account.xiaomi.com/pass/v3/user@id?type=MXPH&externalId=01, The data is transmitted as a cookie of the form deviceId=IMEI . (The API returns a brief reply in JSON.) That tells them the phone has connected to the phone network, and its IP address. That's not particularly interesting information. The carrier knows the IMEI number, too, of course. Perhaps this is to check up on whether carrier-reported sales data matches actual phones coming on the air.
Carriers, app vendors, Microsoft, Google, and Apple collect far more data than that. There are way too many things phoning home with the user's contact list and other personal info.
Look, these days if you want to be safe, do not use a smartphone. Get a dumb phone, then you don't have to worry about any apps leaking your data.
Either an app will leak your data, someone will hack your phone, you leave it somewhere or someone steals it. Either way, you are screwed if you use your phone for all sorts of personal/business stuff.
I guess it's about convenience over personal/financial/business safety.
Be seeing you...
The allegations are specific, proven and Hugo Barra denies different allegations. A simple PR trick.
"We saw that on startup, the phone sent the telco name to the server api.account.xiaomi.com. It also sent IMEI and phone number to the same server," F-Secure said.
So Barra denies it sends PHOTOS and TEXT MESSAGES to China without permission. He does not deny it sends to PHONE NUMBERS and IMEI details without permission.
This is a classic PR misdirection strategy. Mi Cloud was not turned on when it sent this information, the phone was straight out of the box. So turning off Mi Cloud does not fix this spyware.
It's as simple as that. It doesn't matter if you turn on mobile data as long as that is under the control of the phone's operating system, and it doesn't matter if you pay attention to your cell phone bill, as traffic to and from specific government servers is likely exempt from the monthly traffic calculations just as the provider's own servers are likely to be. It doesn't matter if you monitor your wireless network, since questionable transmissions are likely to only go through mobile data, as that's harder to monitor.
While you may be able to test this with your own base station, the phone might also detect that it's not on an official network and therefore not do anything, but that's probably taking it a bit far.
While you could switch to a "dumb" phone, those are of course also trackable, and your conversations and messages can still be monitored, so I don't see any real gain there.
Myself, I carry a phone with me all the time, but I simply do not treat it as a secure device. If you want to take private pictures with your girlfriend, for instance, your phone is not the camera you want to use. End of story.
Get a Blackphone
...because its manufacturer assures you it's secure!
So in your mind, only American companies should be in the news when they do something like this?
Frankly at this point, I'd rather the Chinese have my data to be honest. They won't share it with the Australian/Five eyes governments, and since I live ina Five eyes country, that works better for me. It's not like they'll put me in a prison from China for some BS they find on my phone. My own government on the other hand is much more likely to screw up my life using my own private data.
The data is copied, not "stolen". Get it right!
There are 4 main smartphone brands:
Apple is in the hardware business. Their goal is to sell you hardware with a basket of software that enhances the experiences and showcases the hardware.
Blackberry is in the enterprise software business. Their goal is to sell you hardware that ties you to a management system from which they make their margin.
Microsoft is in the productivity software business. Their goal is to sell you an endpoint that showcases the features of their productivity suites including their server / cloud based collaboration tools.
Google is in the advertising business. Their goal is to sell you an endpoint that showcases their web services. Those web services are designed to collect information about you to sell to advertisers.
Of those 4 companies which do you think you are going to have the toughest time with privacy? If you care about privacy and don't have a strong reason to pick Android, don't use Android, it is quite obviously going to have to be the worst of the 4. You are going to have to cut against the grain to be secure and be on a platform designed advertisers. The other 3 while they may have problems are all much much better on privacy. Blackberry's balance feature allows you to create a container which divides your data a secure side and an insecure side. They offer things like secure browsing by default. You want security choose an operating system designed to enhance not reduce security. Apple and Microsoft are sort of midpoints. Apple is very good about now allowing applications to upload data you don't know about sharing between apps is off by default. Microsoft emulated the Apple sandboxing, certification and limited interaction approach we'll see if overtime they maintain it. If you want to use these devices and have secure data something like Good's containers (which do work on Android) provide a pretty excellent way to keep specific data associated with specific applications secure.
> Unfortunately, that won't help. Your phone number(s) and your home address are already on many of your friend's devices under your real name. Apple, Google & Co already have your details [...]
While it's important to keep that in mind, the "this won't help" mindset is a classical fallacy: someone gotta start, and if (and when) it's widespread enough, it'l help all of us. Like higiene.
You don't spit on the roads, do you? Or do you shit out your window?
So if you implement that -- have a talk with your friends about it too.
Well not really, because *everybody* has to do it or it's useless, and since your phone number could easily be in 100 phonebooks that's alot of poisoning to do. And As soon as people start doing it in numbers you can imagine a malicious Google (or whatever) would implement anti-poisoning analysis.
I believe the only real solution, which is unpopular on this largely libertarian site, is to have stronger protections in law, making data about you your property and controlled as such, and penalties for misuse the same seriousness as theft. That's a long way from where we are now though.
So should "find restaurants near me" apps instead require users to download the complete list of worldwide restaurants? Because even clicking on a map or entering a postal code is "location data". Another is to satisfy movie studios that refuse to license works for streaming unless the provider can positively match viewers to a country whitelist.
In fairness there's not a lot of US or European articles that don't include slants against those governments/corporations as well. The governments and corporations of the world seem to be rapidly sliding toward an invasive authoritarian dystopia. Great for big business and other power-mongers, but not so much for the rest of us. Are you really so surprised we give extra grief to those countries such as Russia and China who wear their fascism openly? We're not ranting against the *citizens* of those countries, we're ranting against their governments and corporations, just as we rant against our own. If you don't like it, go home and fix your country. And while you're at it share your techniques so we can do the same.
--- Most topics have many sides worth arguing, allow me to take one opposite you.