Cyber-security firm Check Point has discovered vulnerabilities in Xiaomi’s ‘Guard Provider’ app that could have let attackers steal users’ data, implant ransomware or install malware. The ‘Guard Power’ security app comes pre-installed on Xiaomi phones.
As per the firm’s blog post, Xiaomi released a patch for the vulnerability shortly after it was reported. Given that ‘Guard Provider’ app uses several Software Development Kits (SDKs), and in this case, three different antivirus brands built in, an issue in one SDK can compromise others as well.
Watch: Xiaomi Redmi Note 7 Pro review
The app includes Avast, AVL and Tencent antivirus to offer its users security features. In addition to a problem in one SDK affecting all others, another issue is that the individual private data storage of SDKs is accessible to other SDKs as well.
“Briefly put, due to Guard Provider’s network traffic from any Xiaomi device being unsecured, this allows it to be intercepted via a Man-in-the-Middle (MiTM) attack and inject rogue code as part of a third-party SDK update,” according to the post.
Xiaomi is one of the largest smartphone companies in India. According to the International Data Corporation’s (IDC) report, Xiaomi had 28.9 per cent market share in India in Q4 2018 with 10.5 million shipments.
Xiaomi phones ship with ‘Guard Provider’ app that offers basic security features such as security app, optimisation, app lock, and also helps boost speed and manage data usage. Xiaomi is said to have released the patch to fix the problem, though specific issues that have been fixed have not been mentioned by the company.