In its report, eScan had alleged that Xiaomi’s MI-Mover app, which helps you move your apps and data from an old device to a Mi Phone, “overrides the application sandbox of the Android OS.”
“Any device-administrator app can be uninstalled without revoking its device-admin rights. Unlike other smartphones, Xiaomi with MI-Mover can be cloned in few minutes without needing to root the device. MIUI devices rather than deleting, hides the Work-Profile Admin app,” said the report, while adding it’s not “easy to delete the Work-Profile,” the report claimed.
It added that the inability to differentiate workspace profile from personal profile poses a “serious challenge from the security point of view in Enterprise Mobility Management.”
“Any perpetrator who gains physical access to an unlocked phone, is capable of malicious activity and an unlocked phone is greatly at risk of user data being stolen. This is why, we at Xiaomi encourage our users to be more aware of guarding their private data using PIN, Pattern locks, or the onboard fingerprint sensor available on most of our smartphones. In fact, prompting users to enable fingerprint lock is a standard step when setting up a Xiaomi smartphone for first use,” the report continued.
“Mi Mover is designed to be a convenient tool for our users to move their data from an old smartphone to a new phone. In order for Mi Mover to initiate this process, a password is required. More importantly, in order to use Mi Mover, the smartphone has to be unlocked. Thus, there are two layers of protection for the user – phone lock and a Mi Mover password that are necessary,” it added.
“Further, as per the Escan report, “As part of exploiting the issue you describe, someone needs to take control of a user’s mobile phone and get that phone in an unlocked state. This is a very high barrier to entry and seems unlikely to happen commonly, making this more of a theoretical attack. The protection, in this case, is to not allow someone to steal and unlock your phone,” Xiaomi’s report concluded.