Xiaomi phones have made the news off and on in the last few months for their cheap, value for money phones and corporate moves. This popular smartphone devices are silently sent out user details to a remote server.Transmitting user data is including SMS messages and photos — back to servers in mainland China without the user's permission.
According to Appleinsider, Xiaomi's Redmi Note handset, Kenny Li of Hong Kong forum IMA Mobile discovered that the device continued to make connections with IP addresses in Beijing even after switching off the company's iCloud-like MiCloud service.
The transmissions occur only over Wi-Fi, though the device does stay in contact with the servers via small "handshakes" while using cellular data.
Data transmission persists even after erasing and re-flashing the handset with a different Android ROM, suggesting that the functionality could be built in to the phone's firmware.
F-Secure Antivirus firm has shown that the Xiaomi phones send quite a lot of personal and sensitive data to "api.account.xiaomi.com" server located in China, including following information:
- IMEI Number of your phone
- IMSI Number (through MI Cloud)
- Your contacts and their details
- Text Messages
The smartphone sent the telco name to the server api.account.xiaomi.com. It also sent IMEI and phone number to the same server:
The phone number of the contacts added to the phone book and also from SMS messages received was also forwarded.
Next they connected to and logged into Mi Cloud, the iCloud-like service from Xiaomi. After that repeated the same test steps as before. The IMSI details were sent to api.account.xiaomi.com, as well as the IMEI and phone number.
Still it is unclear whether this is the handset's intended mode of operation or if it is the result of a software glitch, as Xiaomi has yet to respond to the allegations. The company has previously said that it will store customer data in China, but only after the user opts in.
