I own a Xiaomi Mi4 and I discovered it comes with a pre-installed app called AnalyticsCore, package name com.miui.analytics, that’s running in the background. I’m not a big fan of apps gaining information without my permissions, so I started investigating its activities. For those who don’t know, Xiaomi is the largest smartphone manufacturer in China and actively growing worldwide.
For this I downloaded dex2jar and Java Decompiler and started AnalyticsCore.apk in it. The APK is downloadable here if you want to take a look yourself.
I first googled what its purpose is, and I found a single thread on the Xiaomi forums, but there is no response or explanation on what it does. See this thread.
Inside Java Decompiler there are mainly three interesting classes in how AnalyticsCore gets his updates, named c.class, e.class and f.class by Java Decompiler. Here is the code of a function inside f.class. (all decompiled code)
private boolean I()
{
boolean bool = false;
if (b.t()) {}
for (;;)
{
return bool;
long l2 = J();
m.d("Analytics-UpdateManager", "last update check time is " + new Date(l2).toString());
long l1 = new Random(System.currentTimeMillis()).nextLong();
if (System.currentTimeMillis() - l2 >= (l1 % (2L * 43200000L) + 2L * 43200000L) % (2L * 43200000L) - 43200000L + 86400000L) {
bool = true;
}
}
}
The above function checks some time within every 24 hours for a new Analytics update. It makes the following request every day within 24 hours, which is very often if you ask me:
public void run()
{
int i = 0;
long l1 = System.currentTimeMillis();
for (;;)
{
int j = i + 1;
if (i < 2) {}
try
{
Object localObject2 = new java/lang/StringBuilder;
((StringBuilder)localObject2).();
Object localObject1 = f.a(this.A);
((StringBuilder)localObject2).append("currentApiVersion0.0.0");
Object localObject3 = new java/lang/StringBuilder;
((StringBuilder)localObject3).();
((StringBuilder)localObject2).append("currentCoreVersion" + k.t(f.b(this.A)));
localObject3 = new java/lang/StringBuilder;
((StringBuilder)localObject3).();
((StringBuilder)localObject2).append("imei" + com.miui.analytics.internal.a.k.j(f.b(this.A)));
localObject3 = new java/lang/StringBuilder;
((StringBuilder)localObject3).();
((StringBuilder)localObject2).append("mac" + com.miui.analytics.internal.a.k.k(f.b(this.A)));
localObject3 = new java/lang/StringBuilder;
((StringBuilder)localObject3).();
((StringBuilder)localObject2).append("model" + com.miui.analytics.internal.a.k.getModel());
localObject3 = new java/lang/StringBuilder;
((StringBuilder)localObject3).();
((StringBuilder)localObject2).append("nonce" + (String)localObject1);
localObject3 = new java/lang/StringBuilder;
((StringBuilder)localObject3).();
((StringBuilder)localObject2).append("package" + f.b(this.A).getPackageName());
localObject3 = new java/lang/StringBuilder;
((StringBuilder)localObject3).();
((StringBuilder)localObject2).append("ts" + l1);
((StringBuilder)localObject2).append("miui_sdkconfig_jafej!@#)(*e@!#");
localObject3 = n.getMd5Digest(((StringBuilder)localObject2).toString()).toLowerCase(Locale.getDefault());
localObject2 = new java/lang/StringBuilder;
((StringBuilder)localObject2).("http://sdkconfig.ad.xiaomi.com/api/checkupdate/lastusefulversion?");
((StringBuilder)localObject2).append("currentApiVersion=0.0.0");
Object localObject4 = new java/lang/StringBuilder;
((StringBuilder)localObject4).();
((StringBuilder)localObject2).append("¤tCoreVersion=" + k.t(f.b(this.A)));
localObject4 = new java/lang/StringBuilder;
((StringBuilder)localObject4).();
((StringBuilder)localObject2).append("&imei=" + com.miui.analytics.internal.a.k.j(f.b(this.A)));
localObject4 = new java/lang/StringBuilder;
((StringBuilder)localObject4).();
((StringBuilder)localObject2).append("&mac=" + com.miui.analytics.internal.a.k.k(f.b(this.A)));
localObject4 = new java/lang/StringBuilder;
((StringBuilder)localObject4).();
((StringBuilder)localObject2).append("&model=" + URLEncoder.encode(com.miui.analytics.internal.a.k.getModel(), "utf-8"));
localObject4 = new java/lang/StringBuilder;
((StringBuilder)localObject4).();
((StringBuilder)localObject2).append("&nonce=" + (String)localObject1);
localObject1 = new java/lang/StringBuilder;
((StringBuilder)localObject1).();
((StringBuilder)localObject2).append("&package=" + f.b(this.A).getPackageName());
localObject1 = new java/lang/StringBuilder;
((StringBuilder)localObject1).();
((StringBuilder)localObject2).append("&ts=" + l1);
localObject1 = new java/lang/StringBuilder;
((StringBuilder)localObject1).();
((StringBuilder)localObject2).append("&sign=" + (String)localObject3);
localObject1 = new java/net/URL;
((URL)localObject1).(((StringBuilder)localObject2).toString());
localObject1 = (HttpURLConnection)((URL)localObject1).openConnection();
((HttpURLConnection)localObject1).setRequestMethod("GET");
((HttpURLConnection)localObject1).setConnectTimeout(5000);
((HttpURLConnection)localObject1).connect();
localObject2 = new java/lang/String;
((String)localObject2).(d.a(((HttpURLConnection)localObject1).getInputStream()));
localObject1 = new java/lang/StringBuilder;
((StringBuilder)localObject1).();
m.d("Analytics-UpdateManager", "result " + (String)localObject2);
localObject1 = new org/json/JSONObject;
((JSONObject)localObject1).((String)localObject2);
localObject3 = ((JSONObject)localObject1).optString("url");
i = ((JSONObject)localObject1).optInt("code", 0);
localObject2 = ((JSONObject)localObject1).optString("v");
f.a(this.A, ((JSONObject)localObject1).optInt("force", 0));
f.a(this.A, ((JSONObject)localObject1).optBoolean("wifi", true));
if ((!TextUtils.isEmpty((CharSequence)localObject3)) && (!TextUtils.isEmpty((CharSequence)localObject2)))
{
localObject4 = new com/miui/analytics/internal/a;
((a)localObject4).((String)localObject2);
if ((b.q()) || (((a)localObject4).a == 0))
{
f.a(this.A, ((JSONObject)localObject1).optString("md5"));
f.b(this.A, (String)localObject3);
f.c(this.A).execute(this.A.aP);
}
}
while (i != -8) {
return;
}
long l2 = f.c(this.A, ((JSONObject)localObject1).optString("failMsg"));
l1 = l2;
i = j;
}
catch (Exception localException)
{
f.a(this.A, 0L);
m.e("Analytics-UpdateManager", "exception ", localException);
i = j;
}
}
As you can see, it makes a request to http://sdkconfig.ad.xiaomi.com/api/checkupdate/lastusefulversion? which is of course an official Xiaomi domain. It sends some parameters with it: including IMEI, MAC address, Model, Nonce, Package name and signature.
After the above code has been executed, it might get an (updated) apk file back. Inside e.class this APK file gets downloaded:
public void run()
{
try
{
if ((!k.m(f.b(this.A))) && (f.d(this.A))) {}
for (;;)
{
return;
Object localObject1 = new java/net/URL;
((URL)localObject1).(f.e(this.A));
localObject1 = (HttpURLConnection)((URL)localObject1).openConnection();
((HttpURLConnection)localObject1).setRequestMethod("GET");
((HttpURLConnection)localObject1).setConnectTimeout(5000);
((HttpURLConnection)localObject1).connect();
if (((HttpURLConnection)localObject1).getResponseCode() == 200)
{
Object localObject2 = d.a(((HttpURLConnection)localObject1).getInputStream());
localObject1 = localObject2;
Object localObject3;
if (!TextUtils.isEmpty(f.f(this.A)))
{
localObject3 = a.a((byte[])localObject2);
localObject1 = localObject2;
if (!f.f(this.A).equalsIgnoreCase((String)localObject3)) {
localObject1 = null;
}
}
if (localObject1 != null)
{
Log.d("Analytics-UpdateManager", "download apk success.");
localObject2 = new java/io/File;
((File)localObject2).(f.g(this.A));
localObject3 = new java/io/FileOutputStream;
((FileOutputStream)localObject3).((File)localObject2);
((FileOutputStream)localObject3).write((byte[])localObject1);
((FileOutputStream)localObject3).close();
f.h(this.A);
}
}
}
...
The download location for the APK is set in f.class, where also the 24h time check was placed:
private String G()
{
try
{
Object localObject = new java/lang/StringBuilder;
((StringBuilder)localObject).();
localObject = this.mContext.getExternalCacheDir().getAbsolutePath() + "/Analytics.apk";
return (String)localObject;
}
catch (Exception localException)
{
for (;;)
{
String str = "";
}
}
}
Now the question is, where does this APK gets installed? I couldn’t find any proof inside the Analytics app itself, so I’m guessing that a higher privileged Xiaomi app runs the installation in the background. The question is then: does it verify the correctness of the APK, and does it make sure that it is in fact an Analytics app? If it does not, that means Xiaomi can install any app on your device it wants, as long as it’s named Analytics.apk.
Update 12:31: Someone told me the package gets installed from l.class, with following code:
try
{
paramContext.getPackageManager().getClass().getMethod("installPackage", new Class[] { Uri.class, Class.forName("android.content.pm.IPackageInstallObserver"), Integer.TYPE, String.class }).invoke(paramContext.getPackageManager(), new Object[] { Uri.parse(paramString), null, paramContext.getPackageManager().getClass().getField("INSTALL_REPLACE_EXISTING").get(null), null });
m.d("AppInstaller", "install apk success.");
return;
}
...
It seems like there indeed is no validation on what APK is getting installed. So it looks like Xiaomi can replace any (signed?) package they want silently on your device within 24 hours. And I’m not sure when this AppInstaller gets called, but I wonder if it’s possible to place your own Analytics.apk inside the correct dir, and wait for it to get installed (edit: getExternalCacheDir() is inside the app’s sandbox, so probably not). But this sounds like a vulnerability to me anyhow, since they have your IMEI and Device Model, they can install any apk for your device specifically.
If you own a Xiaomi device yourself, you might want to block all access to Xiaomi related domains, because by far this isn’t the only request to a Xiaomi site. I use AdAway for this. It does require root access, but that should be no problem if you run the International ROM. I don’t know if the official rom supports root access out of the box.
My AdAway:
Here is a link to a post with other bloatware apps you can safely remove from your device, next to Analytics: https://forum.xda-developers.com/xiaomi-mi-3/general/tip-safe-to-remove-bloatware-list-miui-t2999283
If anyone has tips or a comment, please email or contact me.
Interesting 😀 Nice find !
How about the custom roms based on MIUI, for example Xiaomi.eu?
Is it known if they also contain it or already ‘cleaned’ the OS by removing this?
I think this Will be the “topje van de ijsberg” about custum roms, themes and backdoor/exploits.
Thank you for sharing this,
I’m not an android programmer, I’m just asking if there is a way (since the process of getting the new update is not secure at all) to use a Man in the Middle attack to send back a dumb AnalyticsCore AKP and analyze the behavior ? I think that’ll show if there is any verification, and thereby if a real world attack is possible.
As long as you can OEM unlock you can root so there shouldn’t be any problems with that.
Got a OnePlus Two with OxygenOS 3.1.0 and I can’t find that apk in /system/app/ nor the package name (or anything resembling it) so apparently not all Xiaomi derivatives are affected.
A coworker has a Xiaomi 4c with MIUI 6.5.26 and it’s affected.
Right now all there’s left it so simulate an attack. IMHO it will fail as the package manager does check if the APK was signed with the same cert on INSTALL_REPLACE_EXISTING. Easiest way to check is to run:
adb install custom_app-cert1-v1.apk
adb install custom_app-cert2-v2.apk
So the shit will hit the fan once Xiaomi’s certificates leak or a bad actor in the company will decide to use them.
As for prevention methods – if deleting does not work did you try to remove the execution permissions on the apk?
You do realize OnePlus is from Oppo and not Xiaomi?
Also, this affects the MIUI rom, not Oxygen.
The process does not seem to be running on the 7.5.1 Global ROM. Which version do you see it on?
we are same situation. I can’t see the process on my android phone. my MIUI version is 7.1.1.0.0 Global ROM.
But I have founded analytics.pak file. Why is there a analytics.apk without operating background ?
Thanks for sharing
Thank you for your work! Isn’t MIUI open source btw?
Interesting info. I always use adaway on my devices but just use the default settings (block lists) it comes with and then delete it. Any advice? How can I add xiaomi?
In Settings > Your Lists you can define a blacklists. Click on adaway image to get my rules. Import them via the menu.
I’m just wondering, how does the loop in I() method execute?
“for (;;)
{
return bool;
long l2 = J();
m.d(“Analytics-UpdateManager”, “last update check time is ” + new Date(l2).toString());
long l1 = new Random(System.currentTimeMillis()).nextLong();
if (System.currentTimeMillis() – l2 >= (l1 % (2L * 43200000L) + 2L * 43200000L) % (2L * 43200000L) – 43200000L + 86400000L) {
bool = true;
}
}”
The first line of loop is return statement, which should always exit the loop, making code after the return, being never called. What I’m missing here?
Probably because of decompiling. That’s also why all vars are random.
The app has been removed in the release from this week and last week. Can you verify if data is still send out to the Xiaomi servers via some sort of Analytics app?
When I monitored I saw a lot of traffic sent from other domains also. One was wifiapi.xiaomi.eu or something related, which suggests they also log wifi connection details, which is something I at least don’t want.
Still advised to block all traffic to Xiaomi domains.
Can you check xiaomi phones with the blackberry DTEK app? Or is more needed for that.
How is xiaomi dealing with this claim of spying us at the end of 2016, there was a lot of rumor since 2014, so never buy xiaomi, or just update to the newest ROM. What would you conclude?
So is this just moved or really no issue anymore, and no issue in the original global version of miui at all?
Is the analytics core app there but without function?
The comment above says the app is not delivered with the latest rom anymore. Here’s the official Xiaomi statement: “AnalyticsCore is a built-in MIUI system component that is used by MIUI components for the purpose of data analysis to help improve user experience, such as MIUI Error Analytics.”
For me, as long as you block any Xiaomi related domain and don’t use their cloud services, it’s very safe to buy one. But they just save a lot of data otherwise.
Continue Xiaomi response: “As a security measure, MIUI checks the signature of the Analytics.apk app during installation or upgrade to ensure that only the APK with the official and correct signature will be installed,” the representative added. “Any APK without an official signature will fail to install. As AnalyticsCore is key to ensuring better user experience, it supports a self-upgrade feature. Starting from MIUI V7.3 released in April/May, HTTPS was enabled to further secure data transfer, to prevent any man-in-the-middle attacks.”
Cool. Thanks for the answer. So this is not 2014 again 😉
“as long as you block any Xiaomi related domain and don’t use their cloud services”
And this is only possible with root access, right?
It’s possible to not use their Mi Cloud app, but then you don’t know how much traffic still is sent. I advise to block all access, and yes that requires root. But as long as you take the miui.eu rom, I think that’s predelivered (in my case it was, just had to enable root in options).
Is a spanish company more to trust in terms of data security and privacy, like BQ. Any comment on that? BQ has similar specs in phones. Designed in Europe, made in china.
I would have to test it manually. It’s easy to just man in the middle all traffic, you could run a proxy with for example Fiddler. Easy to set up. But I guess that Europe is more strict in what’s allowed to monitor, so I think you’re pretty safe with your choice. But again, has to be tested to be sure.