Reuters published a warning article about the Chinese giant Xiaomi recording personal data of millions about their online activities and device usage. "This is a backdoor with phone functionality," said Gabi Cirlig jokingly about his new Xiaomi smartphone.
This experienced cybersecurity researcher spoke with Forbes journalists after discovering that his Redmi Note 8 smartphone was tracking everything he did. This data was then sent to remote servers hosted by another Chinese tech giant, Alibaba, which Xiaomi is likely renting.
Mr. Cirlig found that alarming volumes of information about his behavior were being tracked while various types of data were collected from the device — he was disturbed by the fact that his personal and private information was fully known to the Chinese company.
When he browsed websites using the default Xiaomi browser on the device, it recorded all visited sites, including search queries, whether it was Google or privacy-oriented DuckDuckGo, and also logged all items viewed in the Xiaomi interface news feed. This tracking worked even when using 'incognito' mode.
The device logged which folders were opened, which screens were switched, even if it was the status bar and the settings page of the device. All data was sent in batches to remote servers in Singapore and Russia, although the web domains servers were registered in Beijing.
At Forbes's request, another cybersecurity researcher Andrew Tierney conducted his own investigation. He also found that browsers provided by Xiaomi on Google Play — Mi Browser Pro and Mint Browser — collect the same data. According to Google Play statistics, together they have been installed more than 15 million times, meaning millions of devices could be affected.
Mr. Kirlig believes that the issues pertain to a significantly larger number of models. He downloaded firmware for other Xiaomi phones, including the Xiaomi Mi 10, Xiaomi Redmi K20, and Xiaomi Mi MIX 3, and subsequently confirmed that they use the same browser and likely share the same privacy issues.
It seems there are also difficulties with how Xiaomi transmits data to its servers. Although the Chinese company claims that data is encrypted, Gabi Kirlig discovered that he could quickly see what had been uploaded from his device because the simplest base64 algorithm is used for encryption. It took only a few seconds to convert data packets into readable information snippets. He also warned: "My main concern regarding privacy is that the data sent to remote servers can be very easily associated with a specific user."
In response to the conclusions drawn by the mentioned experts, a Xiaomi representative stated that the claims regarding the research are unfounded, emphasizing that privacy and security are of utmost importance, and the company strictly adheres to and fully complies with local laws and regulations regarding users' personal data. However, the representative did confirm that browsing data is collected, claiming that the information is anonymous and not tied to any individual, and that users consent to such tracking.
But, as noted by Gabi Kirlig and Andrew Tierney, information was sent to the server not only about visited websites or internet searches: Xiaomi also collects data about the phone, including unique numbers for identifying specific devices and versions of Android. Such metadata can easily be associated with a real person behind the screen if one wishes.
A Xiaomi representative also dismissed claims that browsing data is recorded in incognito mode. However, security experts in their independent tests found that their online behavior is sent to remote servers regardless of the browser's operating mode, providing both photos and videos as evidence.
When Forbes journalists provided Xiaomi with a video showing how Google searches and website visits were sent to remote servers even in incognito mode, the company's representative continued to deny that information is recorded: "This video demonstrates the collection of anonymous browsing data, which is one of the most common practices adopted by internet companies to enhance the overall environment in the browser through the analysis of non-identifying information."
However, security experts believe that the behavior of the Xiaomi browser is much more aggressive than that of other popular browsers like Google Chrome or Apple Safari: the latter do not record browsing behavior, including URLs, without explicit user consent and in private browsing mode.
Additionally, in his research, Mr. Kirlig discovered that the music player pre-installed on Xiaomi smartphones collects information about listening habits: which songs are played and when.
Gabi Kirlig also suspects that Xiaomi monitors software usage, as every time he opens applications, small amounts of information are sent to a remote server. Another anonymous researcher referenced by Forbes stated that he also recorded how the Chinese company's phones gather similar data. Xiaomi did not provide comments on this matter.
Reports indicate that data is sent to the Chinese analytics company Sensors Analytics (also known as Sensors Data), which was founded in 2015 and specializes in deep user behavior analysis and providing professional consulting services. Its tools help clients explore hidden data by studying key behavioral patterns. A Xiaomi representative confirmed the connection to the startup: "Although Sensors Analytics provides data analysis solutions for Xiaomi, the collected anonymous data is stored on Xiaomi's own servers servers and will not be given to Sensors Analytics or any other third-party companies."
Source: 3dnews.ru
