Xiaomi Can Silently Install Any App On Your Android Phone Using A Backdoor

Do you own an Android Smartphone from Xiaomi, HTC, Samsung, or OnePlus?

If yes, then you must be aware that almost all smartphone manufacturers provide custom ROMs like CyanogenMod, Paranoid Android, MIUI and others with some pre-loaded themes and applications to increase the device's performance.

But do you have any idea about the pre-installed apps and services your manufacturer has installed on your device?, What are their purposes? And, Do they pose any threat to your security or privacy?

With the same curiosity to find answers to these questions, a Computer Science student and security enthusiast from Netherlands who own a Xiaomi Mi4 smartphone started an investigation to know the purpose of a mysterious pre-installed app, dubbed AnalyticsCore.apk, that runs 24x7 in the background and reappeared even if you delete it.

Xiaomi is one of the world's largest smartphone manufacturers, which has previously been criticized for spreading malware, shipping handsets with pre-loaded spyware/adware and forked version of Android OS, and secretly stealing users' data from the device without their permission.

Xiaomi Can Silently Install Any App On your Device

After asking about the purpose of AnalyticsCore app on company’s support forum and getting no response, Thijs Broenink reverse engineered the code and found that the app checks for a new update from the company's official server every 24 hours.

While making these requests, the app sends device identification information with it, including phone's IMEI, Model, MAC address, Nonce, Package name as well as signature.

If there is an updated app available on the server with the filename "Analytics.apk," it will automatically get downloaded and installed in the background without user interaction.

"I couldn't find any proof inside the Analytics app itself, so I am guessing that a higher privileged Xiaomi app runs the installation in the background," Broenink says in his blog post.

Now the question is, Does your phone verify the correctness of the APK, and does it make sure that it is actually an Analytics app?

Broenink found that there is no validation at all to check which APK is getting installed to user's phone, which means there is a way for hackers to exploit this loophole.

This also means Xiaomi can remotely and silently install any application on your device just by renaming it to "Analytics.apk" and hosting it on the server.

"So it looks like Xiaomi can replace any (signed?) package they want silently on your device within 24 hours. And I’m not sure when this App Installer gets called, but I wonder if it’s possible to place your own Analytics.apk inside the correct dir, and wait for it to get installed," Broenink said.

Hackers Can Also Exploit This Backdoor

Since the researcher didn't find the actual purpose of the AnalyticsCore app, neither on Googling nor on the company's website, it is hard to say why Xiaomi has kept this mysterious "backdoor" on its millions of devices.

As I previously said: There is no such backdoor that only its creator can access.

So, what if hackers or any intelligence agency figure out how to exploit this backdoor to silently push malware onto millions of Xiaomi devices within just 24 hours?

Ironically, the device connects and receive updates over HTTP connection, exposing the whole process to Man-in-the-Middle attacks.

"This sounds like a vulnerability to me anyhow, since they have your IMEI and Device Model, they can install any APK for your device specifically," Broenink said.

Even on the Xiaomi discussion forum, multiple users have shown their concerns about the existence of this mysterious APK and its purpose.

"Don't know what purpose does it serve. Even after deleting the file it reappears after some time," one user said.

Another said, "if I go to battery usage app, this app is always at the top. It is eating away at resources I believe."

How to Block Secret Installation? As a temporary workaround, Xiaomi users can block all connections to Xiaomi related domains using a firewall app.

No one from Xiaomi team has yet commented on its forum about the question raised by Broenink. We'll update the story as soon as we heard from the company.

Meanwhile, if you are a Xiaomi user and has experienced anything fishy on your device, hit the comments below and let us know.  

Continue Reading →

Turing’s 2018 phone to have three Snapdragon 830s, 18GB RAM, 1.2TB storage

Turing announces Monolith Chaconne with 3 Snapdragon 830s, 4K display, 18GB of RAM, and much more

Turing Robotics Industries (TRI) with some more craziness after introducing the Turing Phone Cadenzalast week. The company has just announced the Turing Monolith Chaconne, a smartphone with specs even stranger than its name, through an email newsletter.

The above announcement by TRI come two months after the firm finally managed to ship the pilot Turing Phone, a crowdfunded Android handset, to early backers, after much delay and some revisions.

Coming to Turing Monolith Chaconne, let’s have a look at its specifications at a glance:

• 6.4-inch 4K display with 2160×3840 pixel resolution

• 3 Qualcomm Snapdragon 830 processors

• 18GB of LPDDR4X RAM (or 3 x 6GB memory chips)

• 1.2TB of storage (3 x 256GB memory, 512GB via microSD card)

• 60MP quad rear camera with Triplet Lens/T1.2 and iMAX 6K

• 20MP dual front camera

• Swordfish OS with deep learning (AI) features based on Sailfish OSS

• 120 Wh battery based on 3,600mAh Graphene Super-capacitor + 2,400mAh Li-Ion + Hydrogen Fuel Cell wordfish Sailfish OS

• WiGig support, Marshall audio, A.L.A.N

• Advanced AI Voice-Authenticated Power On/Off

• Four Nano-SIM support

• Graphene Oxide composite bodywork with Liquid Metal 2.0 Structural Frame, Lightweight Metal Outer Frame, High Temperature Alloy Components

• 4G + VoLTE, 3G, GSM

• Augmented Reality: Parallel Tracking & Mapping API

Steve Chao, CEO of TRI, in an email newsletter explains how it is going to connect the three Snapdragon 830 SoCs in the smartphone:

“TRI plans on connecting multiple CPUs via WiGig by implementing an ad-hoc driver to the 60GHz channel via on-board USB3.0. This complicated computing process stores a transient matrix in SSD of CPU(1), then it recomputes and shares the transient matrix with the other SSD of CPU(2) simultaneously. This results in the CPUs sharing their computing power in parallel. Such proprietary technology enables TRI to achieve never-seen-before computing power on a mobile device. So what exactly is this technology intended for? The answer is – Computational Intelligence (CI).”

The Turing Monolith Chaconne is expected to release in 2018. Whether or not will the company be able to launch this device next year and keep its promise, only time will tell. TRI also says that it will make its presence felt in Salo, Finland and start building prototypes for the Turing Phone Cadenza in a manufacturing facility right where Nokia and Microsoft used to produce their mobile phone prototypes.

Source: Turing

Continue Reading →

iPhone 7 is waterproof, but Apple will not cover it under water damage warranty!!!

iPhone 7 And iPhone 7 Plus Are Ip67 Water Resistant, But Water Damage Isn’t Covered Under Warranty

Apple launched their first official water resistant smartphones – the iPhone 7 and the iPhone 7 Plus – yesterday at an event in San Fransisco. These iPhones have been advertised as “water and dust resistant” with an official IP67 rating under International Electrotechnical Commission (IEC) Standards. Apart from water, Apple designed the devices to resist against dust completely.

The IP67 rating is a combination of both water and dust resistance index. IP6x is the highest dust resistance rating and new iPhone models are completely protected against dust. Similarly, IPx7 means that the iPhone 7 and iPhone 7 Plus can withstand immersion in water to one meter (3.3 feet) for 30 minutes, tested in laboratory conditions. It is the second highest rating, below IP8, which indicates an ability to withstand long periods of immersion under pressure. Samsung’s devices are rated at IP68, suggesting better overall water resistance.

“iPhone 7 and iPhone 7 Plus are splash, water, and dust resistant and were tested under controlled laboratory conditions with a rating of IP67 under IEC standard 60529. Splash, water, and dust resistance are not permanent conditions and resistance might decrease as a result of normal wear. Do not attempt to charge a wet iPhone; refer to the user guide for cleaning and drying instructions. Liquid damage not covered under warranty.”

The above message seems to indicate that the iPhone 7 and the iPhone 7 Plus should be able to handle accidental drops in the shower, bathtub, pool, or light splashing. Also, it shouldn’t be used in high-pressure water situations, such as in direct shower water or a pressure washer, and it should not be left under water for a long period of time.

Apple also warns against trying to charge a wet iPhone, which could result in damage to the device, and it specifies that any liquid damage to the device is not covered under warranty. So, as a cautionary measure, it is best to avoid contact of iPhone 7 and iPhone 7 Plus with water. In short, try and keep your smartphone safe and dry wherever possible.

Continue Reading →

बैशाखदेखि यसकारण ब्लक हुन सक्छ तपाईंको जुनसुकै मोबाइल

तपाईंले विदेशबाट ल्याउनुभएको वा अवैध रुपमा आयात भएको मोबाइल सेट बोक्नुभएको त छैन ? यदि त्यसो हो भने होस् गर्नुहोस्, तपाईंको मोबाइल फोन ब्लक नै हुन सक्छ । तपाईंले बोकेको मोबाइल सेटको विशिष्ट पहिचान अंक आइएमईआई नम्बर नहुन पनि सक्छ । आइएमइआई नम्बर नभएका मोबाइल सेट ब्लक गराउने तयारी नेपाल दूरसञ्चार प्राधिकरणले गरेको छ ।

प्राधिकरणले तयार पारेको राष्ट्रिय उपकरण पहिचान दर्ताको अन्तरिम कार्यविधिमा आधिकारिक आइएमइआई नम्बर नभएका मोबाइल ब्लक गरिने उल्लेख छ । तर, हाल नेपालभर प्रयोगमा रहेका सेटले भने ६ महिनाको म्याद पाउनेछन् । अर्थात्, हालसम्म नेपाल भित्रिएका सेटमा आधिकारिक आइएमइआई नम्बर नभएको पाइएमा सेवाप्रदायकले ६ महिनाभित्र त्यसको जानकारी प्रयोगकर्तालाई दिनेछन् । त्यसपछि प्रयोगकर्ताले प्राधिकरणमा गएर मोबाइलको आइएमइआई नम्बर लिन सक्नेछन् । आजको नयाँ पत्रिका दैनिकमा समाचार छ ।

Continue Reading →

7 Reasons to buy Samsung Galaxy S7 Edge

Galaxy S7 edge has been crowned as the number one smartphone of 2016 or at least for the time being. S7 Edge manages a very precise balance between aesthetic and performance. It has now a lot of improvements compared to edge models of last year; especially the size. Both the Galaxy S7 and S7 Edge were launched in Nepal last week, despite being a great phone many people might have their doubts about why they should buy this phone. Here are 7 reasons why you should consider buying the Samsung Galaxy S7 Edge.

1. The Edge Display:

Believe it or not, the edge display on a phone is one of the most pleasing things you can see today. While using the device it gives you a kind of immersive experience where icons and other stuff just flows through the edges of the display giving a really natural vibe to it. It is also really helpful to launch to quick contacts, quick settings, and other important apps without bothering to turn on the actual display of the phone.

2. Super AMOLED Screen:

Galaxy S7 Edge now sports a rather bigger display of 5.5-inch (1440 x 2560) with the pixel density of 534ppi, which is way more than our eyes can tell. Samsung has a streak of making the best displays on their flagship phone and the AMOLED display on the S7 Edge is no different. The viewing angles are great, colors are really sharp, outdoor visibility is good as well, also the VR experience using this phone is really awesome.

3. Water Resistant:

S7 Edge is now IP68 dust and water resistance which makes it one of the sturdiest flagship phone. Not to mention its glass and metal body provides additional protection. We have seen the phone withstand underwater for a really long time without any issues. It’s a great addition if you’re used to handling your phone roughly.

4. Camera

The camera of both the S7 and S7 edge has been titled as the best camera on any smartphone. It has one of the fastest and most accurate camera sensors and with f1.7 aperture S7 edge can capture good quality pictures even in low light. Also, the larger pixels of 12MP rear camera captures a lot of details. S7 Edge also has one of the fastest autofocus seen on any smartphone. It is also capable of shooting 4K videos with optical image stabilization. Double tap on the home button to launch the camera app is a very neat feature which makes taking pictures instantly a joy. Talking about the Front Facing camera, the 5MP camera also has f1.7 aperture along with wide angle lens where you can fit a lot of objects or people to the canvas and does an excellent job of capturing high details like the rear camera.

5. Expandable Storage:

S7 Edge brings back the Micro SD support which is a huge deal as many of the users have complained about storage on the previous galaxy flagships. Now you have the support of expandable storage up to 200GB where you can store a lot of high-quality pictures and videos taken from the stunning camera. Also, since the internal storage has some room to breathe, you’ll see some slight improvement in the performance as well.

6. Battery Life and Wireless Fast Charging:

Battery life has always been an issue with a flagship phone as the phone has to handle powerful processors and background apps for fluid user experience. S7 Edge now comes with a bigger battery than before and also few added optimizations on TouchWiz which provides plenty of screens ON time for a normal user. And even if you manage to drain all of the 3600mAh battery with heavy usage, you have the option to fast charge your phone with either standard charger or a wireless charger with Quick Charge 2.0 which charges your phone from 0 to 60% at mere 30mins.

7. Lighter TouchWiz:

TouchWiz has been one of the most resource hogging UI of all time, there were always a lot of unnecessary apps and services running in the background which made the phone sluggish and battery life inefficient. TouchWiz now has a facelift where a lot of unnecessary services has been removed which has significantly improved the overall performance, multitasking and battery life of the phone. But we still have few helpful options like the Always ON Display, Multi Screen, SHealth, Theme Store etc. TouchWiz is now lighter in terms of both looks and weight making the device a pleasure to use.

Source : Click Here

Continue Reading →

Deals: Grab a Powerbank with the purchase of Colors K3

Powerbanks are becoming extremely popular among smartphone users these days because of limited battery life that the current generation smartphone exhibits. Looking into that, Colors Mobile Nepal has come up with an offer on its latest flagship Pearl Black K3; the company is offering free 10,000mAh Powerbank worth Rs. 3,000 with the purchase of the handset.

The Colors Pearl Black K3, priced at Rs. 20,995, offers a 5-inch HD display with Asahi enhanced protection glass on both back and the front. It is powered by a MediaTek 1.3Ghz quad-core Cortex A53 processor and has 3GB of DDR3 RAM. It is one of the few phones in this price range to offer 32GB of inbuilt storage and has microSD card slot for further expansion. Talking about the camera, the Colors K3 boasts 13MP rear camera with F2.2 aperture lens and LED flash. There is a 5MP camera on the front. It currently runs on Android Lollipop 5.1 and has 2350mAh non-removable battery. As far as connectivity is concerned, the phone comes with dual hybrid SIM slot, Wi-Fi b/g/n, GPS, and Bluetooth 4.0.

This is a Powerbank from their own brand, the Power Plus. It is is a 10400 mAh powerbank with pure 10000 mAh capacity. It has 2 USB port for charging: One is a fast charging port with 5V/2A rating while the other is a normal one with 5V/1A rating.  The Power Plus features Over voltage controller (OVC), over current controller (OCR), and over temperature controller (OTC) that the phone while charging. Colors has not announced any specific date on when the Power Plus powerbank will be able for purchase.

Source : Click Here

Continue Reading →