yashsingh1/xdaforums huggingface dataset:
[Security Discussion] E:V:A:
That is seriously messed up and illegal in most European Countries! It seem that they are begging for a Class Action Lawsuit! Let them have it!

Thank you for your important and detailed work!

Perhaps @BSDgeek_Jake would consider to add all those servers to his MoaAB hosts file?
[Security Discussion] NiTrOwow:
They deserve a lawsuit, not only for cloning Apple's iOS but also for the backdoors and crapware that connects to the internet and does stuff. Such a big company as this can't just walk away if nothing has ever happaned. They have sold over 14 million phones. 14 MILLION!

Host file doesn't work as the other spyware is in system processes that runs as ID0 simply ignores the host file somehow. I tested it several times and it just ignores the host file? :(

A rom update/fix has pop'd up.

http://www.needrom.com/download/redmi-1s-wcdma-global-multi-4-3-no-spywarebloatware

It's MIUI v5 with nova in the pics you see (the rom appears to come just like stock but with no backdoor etc) thanks to whoever made it.
[Security Discussion] Palela:
Hi,

Can you give way to clean rom for Mi2S because applications are not the same as in your description :(
[Security Discussion] zelendel:
I have posted this and a link to this thread in the proper forums. Thanks for the info. I have also copied this thread link to google plus asking Hugo to explain it. Of course he never will but I wanted to give him a chance.
[Security Discussion] Accidd:
Wait so... this means XDA discovered that MIUI OS connects to the internet?

And you want to send Hugo a small fragment of mms app code with Cloud messaging - which is standard and optional MIUI feature?

Is that your proof? Congrats. Much ado about nothing...

GameSDKService? Of course because this is the stock chinese app with games (usually pirated), but the app is only in chinese original roms.

Every port, every multilang rom doesnt have those apps.

Also Duokan service provide online content to Music and Video apps. This is standard MIUI feature from beginning.

Please note that Global versions of the MIUI roms (so outside china mainland) doesnt have online features.

All stuff presented above IS not a proof!

If I were Hugo I would lough down this after reading.
[Security Discussion] zelendel:
First off XDA didn't find it a user did. It was just posted and asked for clarification.

Second off after the last privacy issue this OEM had you can expect people to be Leary of them.

Third. If a OEM is going to blatantly disregard copyright laws as well as the gpl you have to understand why people will not trust them. They need to very transparent with things like this. Mainly if they plain to ever make a world wide release.
[Security Discussion] Accidd:
I agree. But also take into account that not every piece of code presented by some user containing words "online", "sync" or ip tracing to chinese server is already a backdoor as the op presented to us. Which without proof is just a normal accusations.

As I said. In global versions of MIUI most of online Xiaomi services are disabled.

Wysłane z MI4 W
[Security Discussion] setmov:
Are you are working for Xiaomi? Marketing maybe?
[Security Discussion] Accidd:
Nope.

I'm working with MIUI roms for 4 years now. And also been using MI2, MI3, Redmi, MiPad and now MI4 devices.

I also translate MIUI to my own language and run Xiaomi.eu multilang project.

We do multilang roms there every week for many devices.

I do not have access to MIUI source code - as only xiaomi does that, but I'm digging in MIUI apps all the time.

Decoding, fixing MIUI bugs, recompile, build. Everything.

Take a look into this thread:

http://xdaforums.com/showpost.php?p=55283079&postcount=8

where I explained some facts.
[Security Discussion] setmov:
I can understand your point, and frankly, I have not a Xiaomi phone, but I am using a MIUI Rom on my Lenovo. I love the rom, quick, smooth, great performance and fully of features and themes, simply beautiful, but I can also understand the concern raised in this thread. In these days, people (most of) accept things as they are, not as they should be. That way the "agencies" and all the other "followers" (software devs, manufacturers, and so on) are using their chances to mislead the masses, with the intent to control every single bit of information about our lives (from sensitive, to marketing purposes infos)! That said, I think that no one manufacturer is not misusing their power, and hope that one day, a solution will be found (even if I doubt it) to let us have our privacy as human being! I fully support this thread and would love to see more thread like this one, exactly because the aforementioned.
[Security Discussion] Accidd:
Well sometimes I don't get one thing. People are worried about using Chinese brands but they use Apple, or Google phones in USA that can give all your stuff to NSA in 5 minutes if they want so. If you prefere not to share your emails or photos with governments (USA or China) then don't use your smartphone. Use Nokia 3210.

Wysłane z MI4 W
[Security Discussion] zelendel:
There are laws here that protect people. The laws in China are very different. And China's own actions are the cause people dont trust them. I mean come on. They respect no ones rights at all. The are known for pirating apps, breaking copyright laws and flat out ignoring the laws that dictate what they need to do. Not to mention ripping off the work of others and claiming it as their own.
[Security Discussion] Accidd:
Thats true and I agree. But Chinese also protect their identities. All syncing services in MIUI seems to be encrypted.

If some random guy claims different they let him prove it if his SMS is sent plain text and then other can read them.

And also users have choice. Again. You can use MIUI OS without syncing with Mi Cloud if you dont want to.

Pirating apps, breaking copyright laws is true for China. And you are right.

But the privacy, for some brands (maybe not all) can still be protected.

Thats why I make multilang roms over xiaomi.eu. We tend to cut lot of chinese apps that EU user wont need or it will not work for them. Mentioned GameServiceSDK or some Duokan services are just app features, that give users chinese content but not steal any data (as presented in first post). This can also be removed from rom as we do that.

So also this is not that we or I accept all chinese stuff in stock rom and use it. We try to minimase the chinese influence in rom to end user.
[Security Discussion] adkz:
Not to say I support china or what, but privacy issue? Apple cloud server got hacked and all the celeb personal picture got expose (tot apple claim it was not from them). Nobody was complaining this much when apple and google sync every little personal data into their server but complain about xiomi taking user data secretly? So it should be done openly? lol
[Security Discussion] setmov:
Yes you are right about that, but would be nice if there would be some way to protect ourselves.

You are right about piracy and copyright, but it seems only things related to copyright concerns us (eg. multi million law suits). The strongest privacy laws are in Europe, not USA. In the USA we have no rights, since we are living in a drive-by-money country, not drive-by-laws! Sad thing is the fact that our "best" companies exploit Chinese people (eg. Apple pays $1,36 per iPhone for the labor force to the little Chinese people - and they sell them to us for $600), and we are concerned about our privacy, but actually we use a Chinese man made product (fact!!!). The point here is not to blame the manufacturer, or the retailer, but to find a way, by ourselves (because no "big guys" is gonna help you) to protect our privacy, both online or offline!

You are 100% right!
[Security Discussion] zelendel:
What Apple does in China is one of the reasons Ill never touch an apple product. The companies you stated tell you what they collect. The main issue here is they are not disclosing what they are collecting.

No if you think it is right or wrong is not important. What is important is finding a way to make them be very clear about what they are doing and how to stop it.

Now one user posted how to shut it off. IF it works good. IF not then we need to start ripping apart the system and remove the coding and all access to their services.

Might not be a matter here soon as there are teams already working on ripping MIUI apart and making it open source. It will take time but I am sure it will happen.
[Security Discussion] paarkhi:
That's a wonderful News you have given... :good:
[Security Discussion] yeahman45:
are those backdoors the same thing that Xiaomi was saying that data was sent only because of their cloud messaging app?; they said they will provide option to disable in the next release?
[Security Discussion] Accidd:
They did update in 1 day after the interview with Hugo Barra. Ale devices got that update.

Wysłane z MI4 W
[Security Discussion] yeahman45:
does the update removed/disabled all the backdoors mentionned in this thread (there are quite a lot!)
[Security Discussion] Accidd:
Oh gosh... Please read all my posts here and other thread. Those are not backdoors. It's just a random guy presented you some Ip connections, put some smali files (unrelated) and you all think Xiaomi phone are built only to steal your data. This is bul****.

The mentioned update disabled cloud messaging which was enabled by default in MIUI roms.

That's all. Because the rest of this "so called back doors" connections come from various online contents provided by MIUI apps like Music, Video etc.

Wysłane z MI4 W
[Security Discussion] yeahman45:
ok but what is that disclaimer all about?:
[Security Discussion] Accidd:
Good question. Ask that guy who never answered here.

If this is privacy policy then some terms are correct. For Chinese people they have possibility to purchase MiCredits (to buy themes) via credit card. Thats why Xiaomi needs credit card numbers. But as I said before it's Chinese only feature.

Wysłane z MI4 W
[Security Discussion] yeahman45:
I sometimes buy stuff on my ebay on my phone.... I am worried they collect my paypal info also??
[Security Discussion] Accidd:
They? You mean Xiaomi or all android phones? You use Gmail? Then Google when asked by US government or NSA has rights to give them all your data.

You use Microsoft phone os? It's same. You use Apple and scan your finger to unlock screen? Well... Think about that.

If Xiaomi then I think not. Chinese don't use PayPal. They dont offer paypal payments for their services.

Wysłane z MI4 W
[Security Discussion] yeahman45:
I am talking about xiaomi and the disclaimer that they collect payment info... not just paypal... Can i use my credit card number in the browser? will they collect it or they collect credit card numbers only for their apps requiring payments?

yeah i know NSA and stuff already have a lot of our info but I don't want again another company/country having my info....
[Security Discussion] Accidd:
Really? So USA is enough for single US citizen? And China or Europe countries cant collect your data?

As I said before (please read again) this disclaimer is for chinese citizents that use credit card payments to buy themes... through their Mipay app build in MIUI. Its already built to give users secure payments. Do you think Chinese people use unsecured, plain text payments?

But as I said that function is only for chinese and doesnt require from anyone putting any data into MIUI rom. You don't even have to register to Xiaomi Account for MiCloud features. The Xiaomi Phone can operate without any chinese services. Well.. you just wont be able to install themes from Mi Market without Xiaomi Account. Thats all.
[Security Discussion] yeahman45:
I am not saying NSA has the rights to collect data(but it's probably inevitable now with all the web services : gmail, calender, maps, etc...) but that does not mean I also have to accept Xiaomi doing it... or any other organisms...

thx anyway for the clarifications (that means the OP has no idea what he's talking about).... I might get a Redmi 1s afterall .. it is so cheap with decent specs
[Security Discussion] E:V:A:
If anyone is concerned about privacy and security, there is only one way to go. It is to make sure we have open access to all the sources to whatever device we have, but that is not enough. The source code as provided better also compile! Unfortunately this is not always the case for a few major manufactures claiming to support Open Source development. Instead they often only provide an old/outdated source-blob for the device which will never compile and run without major restructuring and hacking.
[Security Discussion] yeahman45:
can someone port cm without the source?
[Security Discussion] zelendel:
There already is a CM port in the Dev section.

Now as for the issues from this thread. Some people dont trust anything being uploaded to China based server. To be honest I cant blame them.

Now you say other OEM do this as well but there is a huge diff. The US companies have laws in place to protect your personal info. These laws dont exist in China. The china Gov have the right to store and use any info they get on their citizens any way they feel fit.

Now as for it storing them because of using themes, I find this too funny as they say it is to protect the copy rights of the themers. Really? Why does that sound like BS to me.

And as stated. If you want secure there is only one way to be sure and that is to use an open source rom where you can see whats going on.

There is also a Google-less setup you can use that removes all of the logging and data collection that googel uses by replacing them with open source alternatives.
[Security Discussion] yeahman45:
like the CM that is being ported for redmi 1s? or there may still be xiaomi apps collecting info on the CM port?

---------- Post added at 04:58 PM ---------- Previous post was at 04:54 PM ----------

@zelendel : is it batman in your avatar? from what games/comics? it's cool
[Security Discussion] zelendel:
To be honest I couldnt tell you as I would never use this device personally or any device from this OEM.

Yes it is batman. It is from a painting done by someone on the internet. I will be making this for a halloween costume.
[Security Discussion] zygame:
Yep,

Xiaomi provides their services,and needs the rom contact their servers.Like cloud,net-sms,music lyrics,online video,etc.

just like you buy something on amazon,you must let them know where you living,your phone num,post code,and something like that.

Music must download lyrics because you don't have it,MMS.apk must ask the sever if your target user logging into the net-sms service too.

you never see these permissions needs by mms.apk,because you never use or look at into miui rom.

cloud services are backdoors:D
[Security Discussion] pulser_g2:
Your last point there is surprisingly "on the mark". All these "cloud" services are built around an architecture of stealing everything from you today, in case they can find a way to make money from it tomorrow.

If this even makes more people aware of these problems, it might help people to protect themselves in the future from the threats of "the cloud" :)
[Security Discussion] zelendel:
Actually AOSP has no google apps built into it. It is a completely different beast. As well as there is a few projects that are going on that remove all of google stuff from Android.
[Security Discussion] setmov:
Good for the projects, hopefully we will see something soon, but I was not talking about the apps, since the apps are the minor problem. At this level, there is no way to protect yourself 100%.....actually you can, don't use a phone with an activated sim in it, and no internet, otherwise, well, the conclusion it's clear (referred to my previous post!) but then you are gonna to have an expensive piece of electronics with no function.

About AOSP: (from their site!!!)

- First, the software gets built into a system image for a device, and put through various forms of certification, including government regulatory certification for the regions the phones will be deployed. It also goes through operator testing. -really? YES!

- Once the release is approved by the regulators and operators, the manufacturer begins mass producing devices, and we turn to releasing the source code. hmm....

- In some releases, core platform APIs will be ready far enough in advance that we can push the source code out for an early look in advance of the device's release; however in others, this isn't possible. - hahahaha, ask yourself why!!!

And this is just for start. This is not an app-related issue, we are talking about Android CORE! I love Android, I am using it actively and I am happy with it, it's just that sometimes I feel that this is not fair, but hey, who am I to told them what is or it's not fair? Is not a matter of OS, nor device. All have the same core functionality! NO PRIVACY for them! Accept it or not, these are facts.

Anyhow, I hope you can see my point.

P.S. [MENTION=1140856]zelendel[/MENTION], I am not criticizing you, I am just explaining facts I know for sure.
[Security Discussion] Lightning_:
well damn i just brought the thing

ahh damn it i just brought the redmi 1s i wanted to look what xda has for this device i have read all the replies so far, im also concerned about my privacy, do we have a custom rom or something like that where i can feel protected?

I was right i should have brought zenphone 4 (2nd gen) :/ man too late for it.
[Security Discussion] setmov:
Take a look here:

http://www.needrom.com/category/xiaomi/

or

http://xdaforums.com/showthread.php?t=2791267

or

use Google :)
[Security Discussion] yeahman45:
these are all rom based on MIUI or stock rom if i am not mistaken... no CM, AOSP or paranoid rom?
[Security Discussion] setmov:
http://en.miui.com/thread-22893-1-1.html

and men, do you use google?

http://www.needrom.com/download/redmi-1s-wcdma-global-multi-4-3-no-spywarebloatware/

(in this ROM Backdoors are gone, mostly done by string patching domains in the dalvik bytecode.)

Remember, hit THANKS button
[Security Discussion] SaffatBokul:
if your xiaomi device has CM or other roms, flash those. Stop using MIUI
[Security Discussion] KopiJahe:
well, there's an unofficial cm11 released for this device. I'm still waiting for mine to come (maybe in the next three days)

Original thread:

http://www.htcmania.com/showthread.php?t=893300

Download:

https://s.basketbuild.com/devs/Kra1o5/Xiaomi/armani/

Sources:

https://github.com/armani-dev

(no kernel source though, afaik it uses prebuilt kernel)
[Security Discussion] NiTrOwow:
You haven't done your homework buddy. Research it yourself, and then come back in this discussion, ty.

Yup, i have been in contact with a tester of it, it seems to have great progress. The first release had some problems with the GSM network, and audio (This has now already been fixed) not sure about the mp3 codec issue or whatever that was. Still didn't had time to test it myself, been busy all the time.

Also support this topic,

http://www.htcmania.com/showthread.php?t=885366

It will make the lifes of the developers a lot easier! And you can and will see more custom roms if we all support this.
[Security Discussion] KopiJahe:
I've tested it (my 1s came in today :D )

So far so good, confused at first that R2 and R3 have the same filename, so I accidentally flashed R2, and experienced random reboots (a lot...), and then I read that R3 is already released with different MD5, I immediately downloaded it and flashed it, so far so good.

I don't even boot to MIUI XD

But I made backup of my original MIUI ROM with TWRP, just in case (Indonesian ROM, there's none available for download, yet.)
[Security Discussion] NiTrOwow:
[MENTION=2689045]awaaas[/MENTION]

Sounds great. Will test it this weekend :)
[Security Discussion] shadowcore:
Might be a noobish question but wouldnt a firewall block all communications via host file in the rom? Like AFWall+?

Once could insert all the IPs and the phone would not be able to send unwanted informaiton.

As for the whole, chinese vs NSA. Meh, its like the Romulan Empire vs the Emprie in starwars...

Harvesting information is always bad.

Android kernel is listed in the firewall. Not sure why the kernel needs to have access to the internet. While its access disabled by the app, the phone works just fine, although I do not own a Xiaomi.
[Security Discussion] NiTrOwow:
Not if you use a firewall that makes use of iptables which is way better then one that makes use of the host file.

Regarding the kernel. I was not able to track back any XMPP connection made by apps, but it came from ID0. The connection was indeed made, i verified it myself. it seems the only way to properly get rid of it was by using the host file (read comment on needrom). Using Iptables to block it works, but root apps can then no longer make a internet connection. As the source of the connection made that we want to block came from a process running as root, and not visable in any process manager (or e.g top).

Not sure if this is correct.
[Security Discussion] NiTrOwow:
Told ya,

http://thehackernews.com/2014/10/xiaomi-data-breach-hacker.html

I guess someone got mad and... Did the job for us.

Proof that it's spyware with the intention to collect data for other reasons.. And not just to "improve their product" and to "improve user experience" ;).
[Security Discussion] Ltdrev:
After reading all of this thread i'm still more worried about ISP's. Here in Canada and in a lot of countries the law is still unclear as of what they can do with our data...
[Security Discussion] E:V:A:
I knew it. It's just too hard to resist for the manufactures not to implement these backdoors!

Apparently the fight continues:

Resulting in THIS.
[Security Discussion] Zwulf:
I will never use any Xiaomi products again... I loved MIUI and already wanted to buy a Mi4, but after reading this I'm shocked about the behavior and the lies spread by this company. Thanks a lot for the information!
[Security Discussion] nizatino:
I read this just now

I know I am terribly late readings these horrible news. Now I think how much I loved the xiaomis I and if I think that I have recently had to buy one to my wife.. but I ask, these, great, instructions are also valid with the latest firmware?

Thanks a lot for all, very much

NT
[Security Discussion] thuc960:
Thank a lot, Im going to buy new phone of xiaomi, maybe I will think again

Gửi từ C6603 của tôi bằng cách sử dụng Tapatalk
[Security Discussion] nitheeshas:
Go ahead, buy a xiaomi phone and enjoy all its aspects. I must say MIUI is just the best ROM any manufacturer has ever provided. If you are so much concerned about your privacy, which you shouldn't be, just root your phone, use droidwall and dont ever sync anything with xiaomi cloud. And one last thing about "privacy": You install apps daily; who all checks the permissions each app asks for? You will be amazed at what all permissions those apps are taking. Who knows if they aren't just taking your private data? MIUI even helps you in that aspect. You can block apps from certain permissions without rooting or anything, making it easy for an average user. Think about these for yourself and decide
[Security Discussion] zelendel:
Anyone with common sense will check the permissions every app needs when they install.

As for blocking permissions that is not really an issue.

At this point it deosnt matter to me personally. Xiaomi is a banned OEM from my job so I cant even own one if I wanted.
[Security Discussion] Zwulf:
[MENTION=5232282]nitheeshas[/MENTION]

CM Clean Master is a built-in part of MIUI. You can install it from Play Store and check with XPrivacy which huge amount of permissions it uses (among them are phone number, recent calls, contents of SMS, accounts, IMEI, device serial, Android ID and many more) - this won't be blocked by MIUI permission manager. Additionally there are many permissions which can't be blocked (just not available in MIUI).

[MENTION=1140856]zelendel[/MENTION]

Many apps use permissions not declared in Play Store, so common sense won't help.