Xiaomi accused of recording users' incognito web browsing

[midian182]

A hot potato: Xiaomi is being accused of recording users’ interactions with its phones and sending the data to servers hosted by Alibaba in Singapore and Russia that have been rented by the Chinese phone giant.

Forbes’ Thomas Brewster and cybersecurity researchers Gabriel Cirlig and Andrew Tierney discovered that the Redmi Note 8 was observing users’ phone habits and sending them to Xiaomi’s rented servers.

It was found that when browsing the web using the handset’s default Xiaomi browser, all the websites and search engine queries were recorded. It also monitored each item viewed on a news feed feature of Xiaomi’s software. Worryingly, the surveillance appeared to be happening even when browsing using incognito mode.

The phone also sent data about what folders were opened and interactions with the home screen, along with unique device numbers and Android versions.

Tierney discovered that in addition to the pre-installed stock browser on MIUI, Xiaomi’s Android-based OS, the company’s Mi Browser Pro and the Mint Browser—both available on Google Play with a combined 15 million+ downloads—were also collecting user data.

Cirlig found the same browser tracking code was present in the firmware code of other Xiaomi phones, including the Xiaomi MI 10, Xiaomi Redmi K20, and Xiaomi Mi MIX 3 devices.

Xiaomi said that the data being sent was encrypted, but it was encoded in the easily crackable base64, meaning the researcher was able to decode the information in a few seconds. “My main concern for privacy is that the data sent to their servers can be very easily correlated with a specific user,” warned Cirlig.

Responding to the report, Xiaomi did admit to collecting users’ browser data but said it was by consent and anonymized. It also denied recording browsing data when using incognito mode. Forbes provided Xiaomi with a video proving that it was recording private browsing sessions, but it continued to deny it.

“This video shows the collection of anonymous browsing data, which is one of the most common solutions adopted by internet companies to improve the overall browser product experience through analyzing non-personally identifiable information,” said a spokesperson.

While collecting user data is something most tech companies do, it isn’t supposed to be this easy to link it with specific users, which appears to be the case here.

Xiaomi’s full statement:

Xiaomi was disappointed to read the recent article from Forbes. We feel they have misunderstood what we communicated regarding our data privacy principles and policy. Our user's privacy and internet security is of top priority at Xiaomi; we are confident that we strictly follow and are fully compliant with local laws and regulations. We have reached out to Forbes to offer clarity on this unfortunate misinterpretation.

Image credit: testing via Shutterstock

Permalink to story.

https://www.techspot.com/news/85065-xiaomi-accused-recording-users-incognito-web-browsing.html

 

[Getgone]

No way that chinese would lie!

The only xiaomi phone I used became unusable when I tried to remove too much of bloatware. MIUI is a pile of garbage and backdoors on backdoors.

 

[m3diapers]

Isn't that the industrial standard? I deleted my FB account because they mysteriously knew I wanted a career change, and showed specific targeting ads, believe they were able to see my google search. Yeah, I also switched to duckduckgo even since

 

[psycros]

Isn't that the industrial standard? I deleted my FB account because they mysteriously knew I wanted a career change, and show specific targeting ads, believe they were able to see my google search. Yeah, I also switched to duckduckgo even since

These companies have built their empires selling you out to every cyber-criminal, bounty hunter and terrorist on Earth. They do NOT care about your safety or security - their actions always prove it no matter what they may say. China is, of course, the worst of the worst. Their entire economy was based upon stealing intellectual property from foreigners AND their an expansionist dictatorship. No sane human being should be buying anything from a Chinese manufacturer and the sooner we cut ties with them the better. Bring the jobs back to North America, Taiwan and Japan.

 

[QuantumPhysics]

Really?

Because I always assumed that simply clicking "incognito" would stop the government from ever figuring out what I was searching on the internet.

Wow...

I wonder if the multiple Billions of dollars spent by the governments can get through my $10 VPN?

 

[tankbig]

These companies have built their empires selling you out to every cyber-criminal, bounty hunter and terrorist on Earth. They do NOT care about your safety or security - their actions always prove it no matter what they may say. China is, of course, the worst of the worst. Their entire economy was based upon stealing intellectual property from foreigners AND their an expansionist dictatorship. No sane human being should be buying anything from a Chinese manufacturer and the sooner we cut ties with them the better. Bring the jobs back to North America, Taiwan and Japan.

Why do we bring the jobs to Taiwan? I got lots of scam call from Taiwan. In my option, it isn't a good idea.

 

[Danny101]

When you allow China to virtually make and sell every product, this would be the case. How much is being collected that we don't know about? You can thank Henry Kissinger for all of this.

 

[bas416]

Forbes is misinterpreting... China should have sent police to knock on the journalist's door, them make him disappear for a month or so just to resurface saying he made a huge mistake, China is glorious, he unfortunately was spreading fake news, and that his whole family dead opened his eye and he sees clearly that it won't happen again. Also a camera from Chinese police installed in his living room facing him all day is the bare minimum, it's for his own safety.

 

[Godel]

While this is all peachy keen in America, are they selling these phones in the EU with their fairly draconian GPDR privacy laws?

I could see a big investigation and massive fines coming Xiaomie's way if further testing validates these claims.

 

[Nobina]

When it comes to smartphones, internet and privacy nothing can surprise me at this point. I always assume something like this is happening online, and it likely is. At least on most Android phones you can minimize surveillance by installing custom ROMs without Google. Or just turn off your WiFi.

 

[Freddie159]

Isn't that the industrial standard? I deleted my FB account because they mysteriously knew I wanted a career change, and showed specific targeting ads, believe they were able to see my google search. Yeah, I also switched to duckduckgo even since

Do you also use a VPN because if not your ISP is probably tracking you as well. FaceBook was not the first but is probably the first to go mainstream with the fact that they actively gather and sell peoples data, and yes they can see your Google searches as well as all the other browser liinks you click on. FB is a large company with their fingers in lots of pies and gather data from all of their platforms as well as things like porn sites to crossmatch people to the data. They also have a ton of 'business agreements' with ALOT of other pieces of software that they gather our data from, deleting FB to stop them won't work.

 

[Reehahs]

They will have a lot of awkward searches and 18+ links for each user in this case.

 

[Digitalzone]

Going for Samsung next time. Being cheap-*** is not always worthy, especially with these chinese scums.

 

[OortCloud]

When you allow China to virtually make and sell every product, this would be the case. How much is being collected that we don't know about? You can thank Henry Kissinger for all of this.

Google and Facebook are no better.

 

[itsameeeMalario]

Really?

Because I always assuming that simply clicking "incognito" would stop the government from ever figuring out what I was searching on the internet.

Wow...

???

 

[lazer]

Google and Facebook are no better.

add Micro$$lop.....

 

[Puiu]

Going for Samsung next time. Being cheap-*** is not always worthy, especially with these chinese scums.

Oh yeah, Samsung expensive-*** is better. They're totally not snooping on you /s

 

[Digitalzone]

Oh yeah, Samsung expensive-*** is better. They're totally not snooping on you /s

Samsung offers various phones competing with cheap chinese brands. And yeah, I think, they have lesser motivation to do it. And if not for it, I stopped supporting China by buying their brands.

 

[Puiu]

Samsung offers various phones competing with cheap chinese brands. And yeah, I think, they have lesser motivation to do it. And if not for it, I stopped supporting China by buying their brands.

That's your personal opinion, but the facts are simple: they have the same motivation to get your info and they do get it. As for competing phones, I know of no Samsung mid to low end phone that is actually good value even among western phone manufacturers. The Exynos 9611 in the popular Galaxy A51 is behind in performance even when compared to the HD730, especially in the GPU front.

As a side note, to make things clear, I'm also disgusted by such practices. But let's not think for even one second that it's just China doing it.