Throw away your Xiaomi and Huawei phones, but keep the OnePlus, the Lithuanian government warns following the publication of its own report on the safety of 5G smartphones made in China.
“Our recommendation is not to buy new Chinese phones and get rid of those already purchased as quickly as reasonably possible,” Lithuanian Deputy Defense Minister Margiris Abukevicius told reporters when the National Center report was released. cybersecurity department, according to Reuters. .
Xiaomi appears to be auctioning the Chinese government in a way that could threaten Western users, the report argues, including putting a censorship module in its phones and secretly communicating with Chinese-run servers around the world. Meanwhile, Huawei’s lax app installation process may infect your phone with Android malware.
As for OnePlus, its phones were not found by the study authors to do anything bad. Researchers were following reports in recent years that all three brands were engaging in possibly fishy behavior.
Neither Xiaomi nor Huawei have any carrier partnerships or direct distribution in the United States, although their relatively inexpensive phones are easy to purchase from major online retailers. The brands are widely known and used in Europe.
What to do if you have a Huawei or Xiaomi phone
As with all Android phones, you’ll want to install and use some of the best Android antivirus apps while using these devices. The built-in Google Play Protect on Xiaomi phones doesn’t cut it, and we don’t know what kind of built-in protection Huawei phones have.
You’ll also want to avoid using any app stores other than the built-in AppGallery on a Huawei phone. These third-party stores often have corrupted versions of well-known apps that secretly contain malware.
As for Xiaomi, it’s a more difficult call. The allegations in the Lithuanian government report are quite suspicious, although the censorship module appears to be disabled on phones sold in Europe.
Likewise, Xiaomi’s secret communications could possibly be explained as part of normal operations, but the researchers could not determine because they could not decipher the encrypted messages. You will have to decide for yourself whether you want to continue using a Xiaomi phone.
Xiaomi’s dormant censorship
Lithuanian researchers found that the Xiaomi Mi 10T regularly updated a file called “MiAdBlacklistConfig” which contained an embedded list of nearly 450 Chinese taboo phrases, including “Free Tibet”, “Democratic Movement” and “Long live the independence of Taiwan “.
These are all phrases the Chinese government does not want its citizens to see. The phone has built-in filters that are supposed to prevent users from viewing any type of media associated with these phrases.
The censorship filter has been disabled for phones sold in the European Union, to which Lithuania belongs, but researchers said it could easily be activated remotely by Xiaomi.
“The existence of such functionality can compromise free access to information and limit its accessibility,” the report said. “This is important not only for Lithuania, but also for all countries using Xiaomi devices.”
The Xiaomi phone also secretly communicated with a Chinese-owned server in Singapore when the user signed up to use Xiaomi’s cloud functions, which include phone backups and lost device location services.
Communication with remote servers is normal during such procedures, but in this case, the Xiaomi phone sent an encrypted SMS message (somehow) to the server without the user’s knowledge and immediately deleted the message sent from the phone text message log.
“Investigators were unable to read the contents of this encrypted message, so we cannot tell you what information the device sent,” one of the report’s co-authors told The Record.
The behavior did not occur after the Xiaomi Cloud service was disabled.
“The automated sending of messages and its concealment by means of software constitute potential threats to the security of the device and the personal data”, warned the report of the Lithuanian government. “This way, without the user’s knowledge, device data can be collected and transmitted to remote servers.”
The Xiaomi phone also sent what the researchers called a “relatively large amount of information” about the phone’s configuration, applications and processes, as well as user behavior, to Google Analytics and a similar Chinese company called Sensor Data.
It also sent “statistical data on the activity of certain applications” to servers around the world managed by the Chinese Internet company Tencent.
Backdoor to malware
The Huawei P40 was not found to censor or spy, but posed a pretty serious security risk as it regularly contacted off-road app stores where malicious apps are known to be hiding.
Huawei’s default app store is Huawei’s own AppGallery. But if the user searches for an app that is not in the AppGallery, the phone will search for third-party app stores including, but not limited to, APKMonk, APKPure, and Aptoide.
The user will be notified that they are redirected to off-road stores over which Huawei has no control and must allow jumping out of the AppGallery. Nevertheless, Lithuanian researchers came across three malicious apps through this process using the Huawei P40.
“These applications can be downloaded and installed by the user on the mobile phone, thus compromising the security of the device and the data it contains,” the report said.