Xiaomi trackers and backdoors (Update)

In my last post, I had described how I had found a constant tcp connection in the background that I suspected of being a backdoor or tracking app. Further to this, I investigated this matter more by rooting my tablet and running the netstat command in super-user mode to check what processes (apps) were actually listening on these connections.

Of course, I should mention credits to this xda-developers post that thoroughly explains how to remove some pre-installed bloatware from the MIUI such as Analytics-core app that constantly leeches your network and others like Live wallpaper themes that I’m not personally interested in.

Anyways, after removing all this bloat, the tcp connections in background didn’t go entirely, but were reduced to a substantial degree:

As you can see, the established connections were from three apps specifically. Two of them were from Google which unfortunately we can’t do anything about. Since a lot of software and services are depending on Google (including the Android OS itself), Google surveillance is something that we have to accept as part of our life.

The third process, however, is not of Google. It belongs to com.xiaomi.xmsf or in other words, the Xiaomi Service Framework.  This is one of the core system apps in the MIUI, so you can’t just disable it in a firewall – if you do that, none of the other apps will be able to access internet. In other words, this Xiaomi service is pretty much like the Windows 10 telemetry, you can’t do anything about it.

In any case, I am glad that at least I’ve reduced some bloatware on my tablet and also reduced the network overhead to some degree.

If you want, you can try this yourself and let me know in the comments below.