[Security Discussion] NiTrOwow:
So I've basically got myself in this sh*t because lack of care.. Until it pop'd and hit the highlights.

And now straight to the point. It doesn't f*ckin matters if you had a fw or not. As the backdoors are embedded in ROOT system processes.

And those where obviously white-listed as i didn't think of a nasty Chinese guy sitting in it calling back home. My friend who got the same phone found the article as i was having my vacation for a bit, so when i found out i did a bit a research of course on my device. After finding all this i e-mail'd him it and he posted it on the Xiaomi European forums. Guess what happened, it got deleted. So they know damn good what they're doing.

Some code ... i also attached java classes and smali dalvik jvm bytecode..

#<externalId = outgoing callerid>#
package com.xiaomi.mms.net;

import android.net.Uri;
import android.net.Uri.Builder;
import android.telephony.TelephonyManager;
import android.text.TextUtils;
import com.xiaomi.mms.utils.EasyMap;
import java.util.Iterator;
import java.util.Map;
import java.util.Map.Entry;
import java.util.Set;
import miui.net.CloudManager;

public class b
{
public static final String qa = CloudManager.URL_ACCOUNT_BASE;
public static final String qb = CloudManager.URL_ACCOUNT_API_V2_BASE;
public static final String qc = CloudManager.URL_ACCOUNT_API_V3_BASE;
public static final String qd = qa + "/serviceLogin";
public static final String qe = qc + "/user@id";

protected static String a(String paramString, Map paramMap)
{
if ((paramMap != null) && (!paramMap.isEmpty()))
{
Uri.Builder localBuilder = Uri.parse(paramString).buildUpon();
Iterator localIterator = paramMap.entrySet().iterator();
while (localIterator.hasNext())
{
Map.Entry localEntry = (Map.Entry)localIterator.next();
localBuilder.appendQueryParameter((String)localEntry.getKey(), (String)localEntry.getValue());
}
paramString = localBuilder.build().toString();
}
return paramString;
}

public static c al(String paramString)
{
EasyMap localEasyMap = new EasyMap("type", "MXPH").a("externalId", paramString);
d locald = new d(a(qe, localEasyMap));
String str = TelephonyManager.getDefault().getDeviceId();
if (!TextUtils.isEmpty(str))
locald.l("deviceId", str);
return locald;
}
}
===========================================================
public static Header a(Account paramAccount, ExtendedAuthToken paramExtendedAuthToken)
{
StringBuilder localStringBuilder = new StringBuilder();
localStringBuilder.append("serviceToken=");
localStringBuilder.append(paramExtendedAuthToken.authToken);
localStringBuilder.append("; userId=");
localStringBuilder.append(paramAccount.name);
return new BasicHeader("Cookie", localStringBuilder.toString());
}
===========================================================
public void gT()
{
if (ai("http://api.comm.miui.com/miuisms/res/version").getLong("data") == PreferenceManager.getDefaultSharedPreferences(this.mContext).getLong("festival_message_version", 0L))
return;
Object[] arrayOfObject = new Object[1];
arrayOfObject[0] = Integer.valueOf(this.mScreenWidth);
a(ai(String.format("http://api.comm.miui.com/miuisms/res/categories?width=%s", arrayOfObject)).getJSONArray("data"));
}

public void m(long paramLong)
{
Cursor localCursor = this.mq.rawQuery("SELECT MIN(message_id) FROM messages WHERE category_id=" + paramLong, null);
if (localCursor == null)
throw new FestivalUpdater.DatabaseContentException(null);
try
{
if (localCursor.moveToFirst())
{
long l = localCursor.getLong(0);
Object[] arrayOfObject = new Object[3];
arrayOfObject[0] = Long.valueOf(paramLong);
arrayOfObject[1] = Long.valueOf(l);
arrayOfObject[2] = Integer.valueOf(pd);
a(ai(String.format("http://api.comm.miui.com/miuisms/res/messages?cat=%s&marker=%s&count=%s", arrayOfObject)).getJSONObject("data").getJSONArray("entries"), paramLong);
}
return;
}
finally
{
localCursor.close();
}
}
===========================================================
package miui.util;

import android.content.Context;
import android.provider.Settings.Secure;
import android.util.Log;
import org.json.JSONArray;
import org.json.JSONObject;

final class BaseNotificationFilterHelper$2
implements Runnable
{
BaseNotificationFilterHelper$2(Context paramContext)
{
}

public void run()
{
try
{
JSONObject localJSONObject1 = Network.doHttpPostWithResponseStatus(this.val$context, "http://policy.app.xiaomi.com/cms/interface/v1/checkpackages.php", BaseNotificationFilterHelper.access$000(this.val$context));
if ((localJSONObject1.has("RESPONSE_CODE")) && (localJSONObject1.getInt("RESPONSE_CODE") == 200))
{
JSONObject localJSONObject2 = new JSONObject(localJSONObject1.getString("RESPONSE_BODY"));
int i = localJSONObject2.getInt("errCode");
if (i == 200)
{
JSONArray localJSONArray = localJSONObject2.getJSONArray("packages");
StringBuilder localStringBuilder = new StringBuilder();
for (int j = 0; j < localJSONArray.length(); j++)
{
localStringBuilder.append(localJSONArray.get(j).toString().trim());
localStringBuilder.append(" ");
}
Settings.Secure.putString(this.val$context.getContentResolver(), "status_bar_expanded_notification_black_list", localStringBuilder.toString());
BaseNotificationFilterHelper.access$102(null);
return;
}
if (i == 202)
{
Log.d("NotificationFilterHelper", "blacklist is empty ");
Settings.Secure.putString(this.val$context.getContentResolver(), "status_bar_expanded_notification_black_list", "");
BaseNotificationFilterHelper.access$102(null);
return;
}
if (i == 201)
Log.d("NotificationFilterHelper", "request param empty");
}
else
{
Log.d("NotificationFilterHelper", "access network anomalies");
}
return;
}
catch (Exception localException)
{
}
}
}
===========================================================
package miui.util;

import android.app.INotificationManager;
import android.app.INotificationManager.Stub;
import android.content.ContentResolver;
import android.content.Context;
import android.content.SharedPreferences;
import android.content.SharedPreferences.Editor;
import android.content.pm.ApplicationInfo;
import android.content.pm.PackageInfo;
import android.content.pm.PackageItemInfo;
import android.content.pm.PackageManager;
import android.content.pm.PackageManager.NameNotFoundException;
import android.content.res.Resources;
import android.database.ContentObserver;
import android.os.ServiceManager;
import android.provider.Settings.Secure;
import android.provider.Settings.System;
import android.text.TextUtils;
import android.util.Log;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import miui.os.Build;
import miui.provider.CloudAppControll;
import miui.provider.CloudAppControll.TAG;
import org.json.JSONArray;
import org.json.JSONException;
import org.json.JSONObject;

public class BaseNotificationFilterHelper
{
protected static final String APP_NOTIFICATION = "app_notification";
protected static final int CODE_REQUEST_PARAM_EMPTY = 201;
protected static final int CODE_RESPONSE_EMPTY = 202;
protected static final int CODE_SUCCESS = 200;
public static final int DEFAULT = 0;
public static final int DISABLE_ALL = 3;
public static final int DISABLE_ICON = 1;
public static final int ENABLE = 2;
protected static final String EXPANDED_BLACK_LIST_CODE = "errCode";
protected static final String EXPANDED_BLACK_LIST_PACKAGES = "packages";
public static final int NONE = 0;
protected static final String SYSTEMUI_PACKAGE_NAME = "com.android.systemui";
protected static final String TAG = "NotificationFilterHelper";
protected static final String URL = "http://policy.app.xiaomi.com/cms/interface/v1/checkpackages.php";
private static HashSet<String> mBlacklist;
protected static INotificationManager nm;
protected static HashSet<String> sFilterList = new HashSet();
protected static HashMap<String, Integer> sFilterMap = new HashMap();
private static HashMap<String, Boolean> sIsSystemApp;
protected static HashMap<String, Integer> sUidMap = new HashMap();

static
{
if (Build.IS_INTERNATIONAL_BUILD);
for (int i = 2; ; i = 1)
{
DEFAULT = i;
nm = INotificationManager.Stub.asInterface(ServiceManager.getService("notification"));
mBlacklist = null;
sIsSystemApp = new HashMap();
return;
}
}

protected static void enableStatusIcon(Context paramContext, String paramString, int paramInt)
{
getSharedPreferences(paramContext).edit().putInt(paramString, paramInt).commit();
}

public static void enableStatusIcon(Context paramContext, String paramString, boolean paramBoolean)
{
if (paramBoolean);
for (int i = 2; ; i = 1)
{
enableStatusIcon(paramContext, paramString, i);
return;
}
}

public static String getAppNotificationText(Context paramContext, String paramString)
{
int i = 101450315;
switch (NotificationFilterHelper.getInstance().getAppFlag(paramContext, paramString, true))
{
default:
case 3:
case 1:
case 2:
}
while (true)
{
return paramContext.getResources().getString(i);
i = 101450314;
continue;
i = 101450315;
continue;
i = 101450313;
}
}

public static int getAppUid(Context paramContext, String paramString)
{
int i = 0;
if (sUidMap.containsKey(paramString))
return ((Integer)sUidMap.get(paramString)).intValue();
try
{
i = paramContext.getPackageManager().getApplicationInfo(paramString, 0).uid;
sUidMap.put(paramString, Integer.valueOf(i));
return i;
}
catch (PackageManager.NameNotFoundException localNameNotFoundException)
{
}
return i;
}

protected static int getDefaultFlag(Context paramContext, String paramString)
{
initFilterList(paramContext);
if (sFilterList.contains(paramString))
return 2;
return 0;
}

protected static int getGameCenterFlag(Context paramContext, String paramString)
{
readBlacklist(paramContext);
if (mBlacklist.contains(paramString))
return 3;
return 0;
}

private static String getInstalledAppsJson(Context paramContext)
{
JSONObject localJSONObject = new JSONObject();
JSONArray localJSONArray = new JSONArray();
Iterator localIterator = paramContext.getPackageManager().getInstalledPackages(0).iterator();
while (localIterator.hasNext())
{
PackageInfo localPackageInfo = (PackageInfo)localIterator.next();
if ((0x1 & localPackageInfo.applicationInfo.flags) == 0)
localJSONArray.put(localPackageInfo.packageName + "/" + localPackageInfo.versionCode);
}
try
{
localJSONObject.put("packages", localJSONArray);
return localJSONObject.toString();
}
catch (JSONException localJSONException)
{
}
return "";
}

protected static int getNetDefaultFlag(Context paramContext, String paramString)
{
if (sFilterMap.containsKey(paramString))
return ((Integer)sFilterMap.get(paramString)).intValue();
return loadAppNetFlagByPkg(paramContext, paramString);
}

public static SharedPreferences getSharedPreferences(Context paramContext)
{
if (!paramContext.getPackageName().equals("com.android.systemui"));
try
{
Context localContext = paramContext.createPackageContext("com.android.systemui", 2);
paramContext = localContext;
return paramContext.getSharedPreferences("app_notification", 4);
}
catch (PackageManager.NameNotFoundException localNameNotFoundException)
{
while (true)
localNameNotFoundException.printStackTrace();
}
}

protected static void initFilterList(Context paramContext)
{
if (sFilterList.size() == 0)
{
String str = Settings.System.getString(paramContext.getContentResolver(), "status_bar_notification_filter_white_list");
if (!TextUtils.isEmpty(str))
{
String[] arrayOfString = str.split(" ");
for (int i = 0; i < arrayOfString.length; i++)
sFilterList.add(arrayOfString[i]);
}
sFilterList.add("cn.com.fetion");
sFilterList.add("com.google.android.talk");
sFilterList.add("com.tencent.mm");
sFilterList.add("com.tencent.qq");
sFilterList.add("com.tencent.mobileqq");
sFilterList.add("com.xiaomi.channel");
}
}

public static boolean isNotificationForcedFor(Context paramContext, String paramString)
{
int i = getAppUid(paramContext, paramString);
return ("android".equals(paramString)) || (i == 1000) || (i == 1001) || (i == 0);
}

public static boolean isSystemApp(String paramString, PackageManager paramPackageManager)
{
Boolean localBoolean = (Boolean)sIsSystemApp.get(paramString);
if (localBoolean == null);
try
{
ApplicationInfo localApplicationInfo2 = paramPackageManager.getApplicationInfo(paramString, 0);
localApplicationInfo1 = localApplicationInfo2;
boolean bool = false;
if (localApplicationInfo1 != null)
{
int i = 0x1 & localApplicationInfo1.flags;
bool = false;
if (i != 0)
bool = true;
}
localBoolean = Boolean.valueOf(bool);
sIsSystemApp.put(paramString, localBoolean);
return localBoolean.booleanValue();
}
catch (PackageManager.NameNotFoundException localNameNotFoundException)
{
while (true)
ApplicationInfo localApplicationInfo1 = null;
}
}

protected static boolean isUserSetttingInited(Context paramContext, String paramString)
{
int i = getSharedPreferences(paramContext).getInt(paramString, 0);
boolean bool = false;
if (i != 0)
bool = true;
return bool;
}

public static void loadAppNetFlag(Context paramContext)
{
new Thread(new Runnable()
{
public void run()
{
BaseNotificationFilterHelper.sFilterMap.clear();
Iterator localIterator = this.val$context.getPackageManager().getInstalledPackages(0).iterator();
while (localIterator.hasNext())
{
PackageInfo localPackageInfo = (PackageInfo)localIterator.next();
if ((0x1 & localPackageInfo.applicationInfo.flags) == 0)
{
String str = localPackageInfo.applicationInfo.packageName;
BaseNotificationFilterHelper.loadAppNetFlagByPkg(this.val$context, str);
}
}
}
}).start();
}

public static int loadAppNetFlagByPkg(Context paramContext, String paramString)
{
int i = CloudAppControll.get(paramContext, CloudAppControll.TAG.TAG_NOTIFICATION_BLACKLIST, paramString);
if (i == -1)
return 0;
sFilterMap.put(paramString, Integer.valueOf(i));
return i;
}

public static void observeSettingChanged(ContentResolver paramContentResolver, ContentObserver paramContentObserver)
{
paramContentResolver.registerContentObserver(Settings.System.getUriFor("status_bar_notification_filter_white_list"), false, paramContentObserver);
}

private static void readBlacklist(Context paramContext)
{
if (mBlacklist == null)
{
mBlacklist = new HashSet();
String str = Settings.Secure.getString(paramContext.getContentResolver(), "status_bar_expanded_notification_black_list");
if (!TextUtils.isEmpty(str))
{
String[] arrayOfString = str.split(" ");
for (int i = 0; i < arrayOfString.length; i++)
mBlacklist.add(arrayOfString[i]);
}
}
}

public static void requestBlacklist(Context paramContext)
{
new Thread(new Runnable()
{
public void run()
{
try
{
JSONObject localJSONObject1 = Network.doHttpPostWithResponseStatus(this.val$context, "http://policy.app.xiaomi.com/cms/interface/v1/checkpackages.php", BaseNotificationFilterHelper.getInstalledAppsJson(this.val$context));
if ((localJSONObject1.has("RESPONSE_CODE")) && (localJSONObject1.getInt("RESPONSE_CODE") == 200))
{
JSONObject localJSONObject2 = new JSONObject(localJSONObject1.getString("RESPONSE_BODY"));
int i = localJSONObject2.getInt("errCode");
if (i == 200)
{
JSONArray localJSONArray = localJSONObject2.getJSONArray("packages");
StringBuilder localStringBuilder = new StringBuilder();
for (int j = 0; j < localJSONArray.length(); j++)
{
localStringBuilder.append(localJSONArray.get(j).toString().trim());
localStringBuilder.append(" ");
}
Settings.Secure.putString(this.val$context.getContentResolver(), "status_bar_expanded_notification_black_list", localStringBuilder.toString());
BaseNotificationFilterHelper.access$102(null);
return;
}
if (i == 202)
{
Log.d("NotificationFilterHelper", "blacklist is empty ");
Settings.Secure.putString(this.val$context.getContentResolver(), "status_bar_expanded_notification_black_list", "");
BaseNotificationFilterHelper.access$102(null);
return;
}
if (i == 201)
Log.d("NotificationFilterHelper", "request param empty");
}
else
{
Log.d("NotificationFilterHelper", "access network anomalies");
}
return;
}
catch (Exception localException)
{
}
}
}).start();
}

protected boolean areNotificationsEnabled(Context paramContext, String paramString)
{
return false;
}

public boolean canSendNotifications(Context paramContext, String paramString)
{
return getAppFlag(paramContext, paramString, true) != 3;
}

public void enableAppNotification(Context paramContext, String paramString, boolean paramBoolean)
{
}

public void enableNotifications(Context paramContext, String paramString, boolean paramBoolean)
{
enableAppNotification(paramContext, paramString, paramBoolean);
}

public int getAppFlag(Context paramContext, String paramString, boolean paramBoolean)
{
if (paramBoolean);
for (boolean bool = areNotificationsEnabled(paramContext, paramString); bool; bool = true)
{
int i = getSharedPreferences(paramContext).getInt(paramString, 0);
if ((i == 0) && (isSystemApp(paramString, paramContext.getPackageManager())))
i = 2;
if (i == 0)
i = getNetDefaultFlag(paramContext, paramString);
if (i == 0)
i = getDefaultFlag(paramContext, paramString);
if (i == 0)
i = getGameCenterFlag(paramContext, paramString);
if (i == 0)
i = DEFAULT;
return i;
}
return 3;
}

public void initUserSetting(Context paramContext, String paramString)
{
if (!isUserSetttingInited(paramContext, paramString))
{
if (isSystemApp(paramString, paramContext.getPackageManager()))
enableStatusIcon(paramContext, paramString, true);
}
else
return;
int i = getAppFlag(paramContext, paramString, false);
if (i == 3)
{
enableAppNotification(paramContext, paramString, false);
enableStatusIcon(paramContext, paramString, false);
return;
}
enableStatusIcon(paramContext, paramString, i);
}
}

RELATED

http://apkscan.nviso.be/report/show/48b5666fa2bcbe738c0b623da712918f

http://lists.clean-mx.com/pipermail/viruswatch/20130714/072661.html

OTHER SOURCES

http://www.newmobilelife.com/2014/08/12/xiaomi-china-server/

http://www.htcmania.com/showthread.php?p=14730859