comscore Security firm claims Mi 4 comes preinstalled with malware, Xiaomi suggests it bought counterfeit product [confirmed]
News

Security firm claims Mi 4 comes preinstalled with malware, Xiaomi suggests it bought counterfeit product [confirmed]

xiaomi-mi-4-review

Late last week, mobile security company Bluebox, came out with a damning report about security concerns it found with the Xiaomi Mi 4. The report, close on the heels of Lenovo’s Superfish episode, claimed that the Mi 4 comes pre-installed with malware, adware and spyware. The report went on to say that the Mi 4 was “vulnerable for every vulnerability we scan for.” Xiaomi refutes the claims and suggests that the smartphone Bluebox had bought was likely to be a counterfeit device. UPDATE: Xiaomi has confirmed that the unit was “100 percent proven to be a counterfeit product purchased through an unofficial channel on the streets in China.” Also Read - Best wearable gift ideas under Rs 5,000 for Father's Day 2021

Also Read - Another Xiaomi folding phone set to launch after October with Mi MIX Fold specs 

Also Read - Best smartphones for photography under Rs 20,000 to gift for Father's Day

Xiaomi has sent a statement to BGR India where they mention the product used by Bluebox to conclude Xiaomi was pre-installing malware was a counterfeit product. Even Bluebox has confirmed that the product was counterfeit and hence, its findings were inaccurate.

First some background. Bluebox procured a Mi 4 from an unofficial third-party reseller in China. The security firm claimed it did some tests to ensure the smartphone was not a counterfeit and it was satisfied that it was a legitimate Xiaomi product. It followed it up with some basic tests that revealed six pre-installed apps that were classified to be known malware, adware or spyware.

Further, the firm also found that their Mi 4 unit was already rooted and came pre-enabled with developer debugging function. It also found that the phone’s internal storage memory had a hidden folder with some popular benchmarking apps but those were resigned, hinting that they were tampered and were different from the authentic version. It also found that the ROM was already rooted.

BGR India reached out to Xiaomi and the Chinese smartphone vendor refuted all claims made by Bluebox. It also suggested the possibility that the security company could have bought a counterfeit product.

“There are glaring inaccuracies in the Bluebox blog post. Official Xiaomi devices do not come rooted and do not have malware pre-installed. Our investigation based on information received so far indicates that the phone Bluebox obtained is a counterfeit product purchased through an unofficial channel on the streets in China. We’re gathering more information to fully confirm this and should have a final answer in the next 24 hours,” Xiaomi said in a statement. (Read the complete statement at the end.)

Bluebox also found some mismatches between Android versions and MIUI, which suggested that the forked operating system was a patchwork of different versions of Android. It also found that the OS was most likely to be a test software and not the final consumer version. Bluebox also reported that MIUI wasn’t certified by Google, a claim Xiaomi calls inaccurate.

“Contrary to what Bluebox has claimed, MIUI is true Android, which means MIUI follows exactly Android CDD, Google’s definition for compatible Android devices, and it passes all Android CTS tests, the process used by the industry to make sure a given device is fully Android compatible. All Xiaomi devices sold in China and international markets are fully Android compatible,” the statement continued.

Based in San Francisco, Bluebox was founded in 2012 and claims to provide mobile data security solutions for enterprises. It is backed by $27.5 million from Andreessen Horowitz, Tenaya Capital, and Andreas Bechtolsheim. The company was evaluating the Xiaomi Mi 4 as a BYOD option for employees and found it to score very low on its “Trustable” score. However, the results would be worthless if the Mi 4 it tested does indeed turn out to be a counterfeit product.

Last month Lenovo came under a lot of fire when reports emerged the company had pre-installed an adware, called Superfish, on some models of its consumer laptops. Superfish broke SSL protocols, enabling it to snoop on secure communications. The company stopped pre-installing the software and offered a tool to remove it from affected laptops.

“Our goal is to find technologies that best serve users. In general, we get pretty good feedback from users on what software we pre-install on computers and do our due diligence. Obviously in this case we didn t do enough. The intent of loading this tool was to help enhance our users shopping experience. What we re going to do in the next few weeks is dig deeper, and work with users, industry experts and others to see how we can improve what we do around software that comes installed on consumers computers. The outcome could be a clearer description of what software is on a user s machine, and why it s there,” said a Lenovo spokesperson in response to BGR India’s questions at the time of the Superfish episode.

For Xiaomi, another key question revolving around security would be the fact that most of its smartphones run on an older version of Android and Xiaomi rarely pushes Android updates to smartphones. This could probably make its smartphones vulnerable to security holes that Google fixes in every software update. In response to BGR India’s question, the smartphone maker said it regularly pushed out security updates rather than waiting for platform updates.

“We prioritize security updates over platform updates (via backporting). We have one of the industry s strongest security software teams and we make sure that our devices are always running the most secure software,” a Xiaomi spokesperson told BGR India.

Here’s the initial official statement Xiaomi sent to BGR India. We are expecting another follow up statement soon.

There are glaring inaccuracies in the Bluebox blog post. Official Xiaomi devices do not come rooted and do not have malware pre-installed. Our investigation based on information received so far indicates that the phone Bluebox obtained is a counterfeit product purchased through an unofficial channel on the streets in China. We’re gathering more information to fully confirm this and should have a final answer in the next 24 hours.

With the large parallel street market for mobile phones in China, not only is it somewhat common for third parties to tamper with the software sold on smartphones, but there are counterfeit products which are almost indistinguishable from the original products on the outside. This happens across all brands, affecting both Chinese and foreign smartphone companies selling in China.

Furthermore, “entrepreneurial retailers may add malware and adware to these devices, and even go to the extent of pre-installing modified copies of popular benchmarking software such as CPU-Z and Antutu, which will run “tests” showing the hardware is legitimate fooling even very discerning buyers.

Xiaomi takes all necessary measures to crack down on the manufacturers of fake devices or anyone who tampers with our software, supported by all levels of law enforcement agencies in China. However, for the safety of our users, Xiaomi and all smartphone brands always recommend buying phones through authorised channels. Xiaomi only sells via Mi.com, and a small number of Xiaomi trusted partners including mobile operators and select authorised retailers, such as Flipkart in India.

In addition, contrary to what Bluebox has claimed, MIUI is true Android, which means MIUI follows exactly Android CDD, Google’s definition for compatible Android devices, and it passes all Android CTS tests, the process used by the industry to make sure a given device is fully Android compatible. All Xiaomi devices sold in China and international markets are fully Android compatible.

For the latest tech news across the world, latest PC and Mobile games, tips & tricks, top-notch gadget reviews of most exciting releases follow BGR India’s Facebook, Twitter, subscribe our YouTube Channel. Also follow us on  Facebook Messenger for latest updates.
  • Published Date: March 9, 2015 4:04 AM IST
  • Updated Date: March 9, 2015 2:45 PM IST



new arrivals in india

Infinix Note 10
Infinix Note 10

10,999

Vivo Y73
Vivo Y73

20,990

OnePlus Nord CE 5G
OnePlus Nord CE 5G

22,999

iQOO Z3
iQOO Z3

19,990

Realme C25s
Realme C25s

9,999

Poco M3 Pro 5G
Poco M3 Pro 5G

13,999

Realme X7 Max 5G
Realme X7 Max 5G

26,999

Oppo F19
Oppo F19

18,990

Motorola Moto G40 Fusion
Motorola Moto G40 Fusion

13,999

POCO M2 Reloaded
POCO M2 Reloaded

9,499

OPPO A74 5G
OPPO A74 5G

17,990

Oppo A53s 5G
Oppo A53s 5G

14,990

Vivo V21 5G
Vivo V21 5G

29,990

Realme C25
Realme C25

9,499

Realme C21
Realme C21

7,999

Realme C20
Realme C20

6,799

Motorola Moto G60
Motorola Moto G60

17,999

iQOO 7
iQOO 7

31,990

Samsung Galaxy M42 5G
Samsung Galaxy M42 5G

21,999

Xiaomi Mi 11 Ultra
Xiaomi Mi 11 Ultra

69,999

Xiaomi Mi 11X Pro 5G
Xiaomi Mi 11X Pro 5G

39,999

Xiaomi Mi 11X
Xiaomi Mi 11X

29,999

Realme 8 5G
Realme 8 5G

13,999

Samsung Galaxy F02s
Samsung Galaxy F02s

8,999

Samsung Galaxy F12
Samsung Galaxy F12

10,999

POCO X3 Pro
POCO X3 Pro

18,999

Realme 8 Pro
Realme 8 Pro

17,999

Realme 8
Realme 8

14,999

Vivo X60 Pro Plus
Vivo X60 Pro Plus

69,990

Vivo X60 Pro
Vivo X60 Pro

49,990

Vivo X60
Vivo X60

37,990

OnePlus 9 Pro 5G
OnePlus 9 Pro 5G

64,999

OnePlus 9R 5G
OnePlus 9R 5G

39,999

OnePlus 9 5G
OnePlus 9 5G

49,999

Samsung Galaxy A72
Samsung Galaxy A72

34,999

Samsung Galaxy A52
Samsung Galaxy A52

26,499

Micromax In 1
Micromax In 1

10,499

Asus ROG Phone 5
Asus ROG Phone 5

49,999

Samsung Galaxy M12
Samsung Galaxy M12

10,999

Motorola Moto G30
Motorola Moto G30

10,999

Motorola Moto G10 Power
Motorola Moto G10 Power

9,999

Oppo F19 Pro Plus 5G
Oppo F19 Pro Plus 5G

25,990

Oppo F19 Pro
Oppo F19 Pro

21,490

Xiaomi Redmi Note 10 Pro Max
Xiaomi Redmi Note 10 Pro Max

18,999

Xiaomi Redmi Note 10 Pro
Xiaomi Redmi Note 10 Pro

15,999

Xiaomi Redmi Note 10
Xiaomi Redmi Note 10

11,999

Realme Narzo 30A
Realme Narzo 30A

8,999

Realme Narzo 30 Pro
Realme Narzo 30 Pro

16,999

Infinix Smart 5
Infinix Smart 5

7,199

Samsung Galaxy F62
Samsung Galaxy F62

23,999

Samsung Galaxy A12
Samsung Galaxy A12

12,999

Nokia 5.4
Nokia 5.4

13,999

Nokia 3.4
Nokia 3.4

11,999

Realme X7 Pro 5G
Realme X7 Pro 5G

29,999

Realme X7
Realme X7

19,999

Vivo Y31
Vivo Y31

16,490

Oppo Reno5 Pro 5G
Oppo Reno5 Pro 5G

35,990

Samsung Galaxy S21 Ultra 5G
Samsung Galaxy S21 Ultra 5G

1,05,999

Samsung Galaxy S21 Plus 5G
Samsung Galaxy S21 Plus 5G

81,999

Samsung Galaxy S21 5G
Samsung Galaxy S21 5G

69,999

Vivo Y12s
Vivo Y12s

9,990

Vivo Y51A
Vivo Y51A

17,990

Samsung Galaxy M02s
Samsung Galaxy M02s

8,999

Xiaomi Mi 10i
Xiaomi Mi 10i

21,999

Oppo A15s
Oppo A15s

11,490

Tecno Spark 6 Go
Tecno Spark 6 Go

8,499

Vivo V20 2021
Vivo V20 2021

24,990

Vivo Y20A
Vivo Y20A

11,490

Xiaomi Redmi 9 Power
Xiaomi Redmi 9 Power

11,999

Motorola Moto G9 Power
Motorola Moto G9 Power

11,999

Motorola Moto G 5G
Motorola Moto G 5G

20,999

Vivo V20 Pro
Vivo V20 Pro

29,990

Xiaomi Mi 10T
Xiaomi Mi 10T

35,999

Xiaomi Redmi 9i
Xiaomi Redmi 9i

8,299

Xiaomi Mi 10T Pro
Xiaomi Mi 10T Pro

39,999

Infinix Hot 10
Infinix Hot 10

9,999

Vivo V20 SE
Vivo V20 SE

20,990

Vivo V20
Vivo V20

24,990

Micromax In 1b
Micromax In 1b

6,999

Micromax In Note 1
Micromax In Note 1

10,999

OnePlus 8T
OnePlus 8T

42,999

Samsung Galaxy F41
Samsung Galaxy F41

15,499

Apple iPhone 12 Pro Max
Apple iPhone 12 Pro Max

1,29,900

Apple iPhone 12 Pro
Apple iPhone 12 Pro

1,19,900

Apple iPhone 12 Mini
Apple iPhone 12 Mini

69,900

Apple iPhone 12
Apple iPhone 12

79,900

Poco X3
Poco X3

16,999

Realme Narzo 20A
Realme Narzo 20A

8,499

Realme Narzo 20
Realme Narzo 20

10,499

Realme Narzo 20 Pro
Realme Narzo 20 Pro

13,999

Oppo F17
Oppo F17

16,990

Samsung Galaxy M51
Samsung Galaxy M51

22,999

Poco M2
Poco M2

10,999

Oppo F17 Pro
Oppo F17 Pro

22,990

Realme 7 Pro
Realme 7 Pro

19,999

Realme 7
Realme 7

14,999

Xiaomi Redmi 9A
Xiaomi Redmi 9A

6,799

Vivo Y20
Vivo Y20

12,990

Xiaomi Redmi 9
Xiaomi Redmi 9

8,999

Nokia 5.3
Nokia 5.3

13,999

Best Sellers