Thijs Broenink audited the AnalyticsCore.apk app that ships pre-installed on all Xiaomi phones (Xiaomi has their own Android fork with a different set of preinstalled apps) and discovered that the app, which seemingly serves no useful purpose, allows the manufacturer to silently install other code on your phone, with unlimited privileges and access.
The app phones home to Xiaomi once a day and transmits the user’s “IMEI, MAC address, Model, Nonce, Package name and signature,” all in the clear, then gets instructions back about which apps to install — it can seemingly overwrite your signed, pre-installed apps with modified versions.
It seems like there indeed is no validation on what APK is getting installed. So it looks like Xiaomi can replace any (signed?) package they want silently on your device within 24 hours. And I’m not sure when this AppInstaller gets called, but I wonder if it’s possible to place your own Analytics.apk inside the correct dir, and wait for it to get installed (edit: getExternalCacheDir() is inside the app’s sandbox, so probably not). But this sounds like a vulnerability to me anyhow, since they have your IMEI and Device Model, they can install any apk for your device specifically.If you own a Xiaomi device yourself, you might want to block all access to Xiaomi related domains, because by far this isn’t the only request to a Xiaomi site. I use AdAway for this. It does require root access, but that should be no problem if you run the International ROM. I don’t know if the official rom supports root access out of the box.
Reverse Engineering Xiaomi’s Analytics app
[Thijs Broenink]
(Images: Little Marco Rubios Campaign is a Dumpster Fire, TJ Hawk, CC-BY-SA; Xiaomi Malaysia)