I guess many of you have not heard about “Xiaomi can silently install any app on your android phone using a Backdoor,” but it’s true. Besides you may also unfamiliar with the preinstalled apps and services that the Manufacturer has installed on your Android device or Android Smartphone like Xiaomi, HTC, Samsung or One Plus. So here, we would discuss on does this installed apps are vulnerable to your device or not, and what the reason behind this installation is.
To get the answer to the reason behind installed pre-installed apps on your android phone, a Computer Science Student and Security enthusiast from the Netherlands had owned a Xiaomi Mi4 Smartphone and performed an investigation. They found that Dubbed AnalyticsCore.apk ran 24*7 in the background and reappeared even if you delete that preinstalled app.
Xiaomi is one of the world’s largest Smartphone manufacturers which have been criticized as secretly stealing user’s data from the device without the concern of user’s, shipping handsets with the pre-loaded spyware/adware and forked version of Android OS; and spreading the malware.
In one of the interview, when asked for the reason of AnalyticsCore app to the company’s support forum, we would not get the exact answer. But later, it was found that the app checks for a new update from the company’s official server every 24 hours. And then app sends device identification information with it, including MAC address, Nonce, Package Name and Signature; and even phone’s IMEI.
So, if there is any updated app available on the server with the filename “Analytics.apk”, it would automatically download and install the app in the background without the concern of users. So it has become a big issue that there is no validation to check which APK is getting installed to user’s phone, and hackers can even exploit to this loophole.
Hence, through research it is found that there is no exact purpose of using Analytics Core app, neither on Googling nor on searching to the company’s website. So it is a big mystery. In contrary, this secret installation can only be blocked by Xiaomi users using a firewall app to disconnect the Xiaomi related domains.
