Lithuania's National Cyber Security Centre has told its citizens to get rid of Xiaomi-made mobile devices amid fears that the Chinese company could remotely enable censorship tools.

In an audit it published yesterday

[1]PDF

the agency called out Xiaomi's Mi 10T 5G phone handset firmware for being able to censor terms such as "Free Tibet", "Long live Taiwan independence" or "democracy movement".

Defence Deputy Minister Margiris Abukevicius told [2]reporters at the audit's release: "Our recommendation is to not buy new Chinese phones, and to get rid of those already purchased as fast as reasonably possible."

[3]

Although the censorship setting was disabled for phones sold into the manufacturer's "European region", the Lithuanian NCSC said (page 22):

It has been established that during the initialisation of the system applications factory-installed on a Xiaomi Mi 10T device, these applications contact a server in Singapore at the address globalapi.ad.xiaomi.com (IP address 47.241.69.153) and download the JSON file MiAdBlacklistConfig, and save this file in the metadata catalogues of the applications.

That file contained a list of more than 400 terms, including "free Tibet", "89 Democracy Movement" (a reference to Tiananmen Square) and "long live Taiwan's independence".

The local security agency's 32-page report, titled "Assessment of cybersecurity of mobile devices supporting 5G technology sold in Lithuania", focused on devices from Xiaomi, Huawei and OnePlus.

[4]GOP lawmakers ask for former Huawei handset biz Honor to be placed the Entity List

[5]Xiaomi builds a robot dog out of smartphone cameras and an Nvidia edge AI board

[6]Xiaomi parties like a winner after coming second on world smartphone sales charts

[7]Biden expands Chinese tech and military blocklist to 59 companies

"It is believed that this functionality allows a Xiaomi device to perform an analysis of the target multimedia content entering the phone; to search for keywords based on the MiAdBlacklist list received from the server," said the Lithuanian report.

"Once the device determines that the content contains certain keywords, the device performs filtering of this content and the user cannot see it. The principle of data analysis allows analysis not only of words written in letters; the list that is regularly downloaded from the server can be formed in any language."

[8]

The agency said the censorship could be remotely re-enabled at any time by Xiaomi.

Huawei was mildly criticised in the report for its factory-loaded software directing [9]users of its P40 5G handsets to unofficial app stores, while OnePlus was not criticised at all.

[10]

Xiaomi has not yet commented on the findings. ®

Get our [11]Tech Resources



[1] https://www.nksc.lt/doc/en/analysis/2021-08-23_5G-CN-analysis_env3.pdf

[2] https://www.reuters.com/business/media-telecom/lithuania-says-throw-away-chinese-phones-due-censorship-concerns-2021-09-21/

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YUunmUy3XNvHC33zfqGeUwAAANI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[4] https://www.theregister.com/2021/08/11/honor_entity_list_letter/

[5] https://www.theregister.com/2021/08/11/xiaomi_cyberdog/

[6] https://www.theregister.com/2021/07/16/xiaomi_canalys_number_two_smartphone_vendor/

[7] https://www.theregister.com/2021/06/04/biden_expands_blocklist/

[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YUunmUy3XNvHC33zfqGeUwAAANI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[9] https://www.theregister.com/2020/05/20/huawei_p40_lite_5g_uk_availability/

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YUunmUy3XNvHC33zfqGeUwAAANI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[11] https://whitepapers.theregister.com/