Kenny Li of Hong Kong forum IMA Mobile was reviewing a smartphone from Xiaomi, when he noticed something odd. The Redmi Note smartphone was continually trying to connect to an IP address in Beijing.
The phone kept trying to make the connection, even after Li turned off Xiaomi’s iCloud-like MiCloud service. He then tried erasing and installing a new version of Android. The problem persisted.
According to Apple Insider, Xiaomi had previously said it would store customer data in China, but only if a user opted in. Xiaomi is headquartered in Beijing.
Xiaomi did not immediately respond to an email sent to its Hong Kong office.
If the allegations are true, it wouldn’t be the first time a Chinese smartphone was found to spy on its users.
Security researchers at Germany’s G Data found in June that China’s Generic Star N9500 smartphone had a similar bug. The phone came preinstalled with the Uupay.D spyware program, which was stealing the phone’s data and relaying it back to an IP address in China.
Just like the Redmi Note smartphone, the spying program on the Star N9500 could not be removed if the user erased the phone or installed a new operating system, since the spyware was located on the Star N9500′s firmware.
Going by the Kenny Li’s account, it’s very likely the Redmi Note’s connection to a Beijing IP address also comes from something in its firmware.
The breach on the Star N9500 could allow someone to listen to phone calls, read emails and text messages, and remotely control the phone’s microphone and camera. It could also be used for theft, including granting access to the user’s online banking.
