Warning - Millions of Xiaomi Phones Vulnerable, Remote Hacking

Millions of Xiaomi smartphones are vulnerable to a dangerous remote code execution (RCE) vulnerability that could grant attackers complete control of handsets.

The vulnerability, now patched, exists in MIUI – Xiaomi's own implementation of the Android operating system – in versions prior to MIUI Global Stable 7.2 which is based on Android 6.0.

The flaw, discovered by IBM X-Force researcher David Kaplan, potentially allows attackers with privileged network access, such as cafe Wi-Fi, to install malware remotely on the affected devices and fully compromise them.

Researchers found some apps in the analytics package in MIUI, which can be abused to provide malicious ROM updates remotely through a man-in-the-middle attack.

"The vulnerability we discovered allows for a man-in-the-middle attacker to execute arbitrary code as the highly privileged Android 'system' user," researchers say.

Researchers say they discovered vulnerable analytics packages in at least four default apps provided by Xiaomi in its MIUI distributions, one of those apps being the default browser app.

The flaw allows an attacker to inject a JSON response to force an update by replacing the link and MD5 hash with a malicious Android application package containing malicious code, which is executed at the system level.

Since there is not any cryptographic verification of the update code, the analytics package (com.xiaomi.analytics) will replace itself with "the attacker-supplied version via Android's DexClassLoader mechanism."

In order words, the analytics package neither uses HTTPS to query an update server for updates, nor it downloads the package over HTTPS, thus allowing attackers to modify the updates.

The custom ROM ships on devices manufactured by developer Xiaomi – World's third largest smartphone maker with over 70 Million devices shipped just last year alone – and is also ported to over 340 different handsets including Nexus, Samsung, and HTC.

Since the company has patched the flaw and released a over-the-air update, users are strongly recommended to update their firmware to version 7.2 as soon as possible in order to ensure they are not vulnerable to this issue that plagues Millions of Xiaomi devices.

PlayStation 4 is Bringing Console Gaming Streaming To PC and Mac

Sony PlayStation is the bestselling gaming console of the current generation devices. The PlayStation 4 has maintained its superiority over competitors like Xbox and Nintendo by regularly offering big updates that improve the user’s gaming experience. Today marks another big step towards improving console gaming. Sony has revealed that the upcoming PS4 firmware update will make PS4 playable on PCs and Macs via streaming. Currently, the streaming feature called Remote Play can also stream games on the PS TV and PS Vita.

Those familiar with Sony products must be aware that Sony offers a Remote Play feature for its Sony Xperia devices. The feature allows those with Xperia products to stream PlayStation games to their phone or tablet over WiFI and play them via the standard PlayStation controller.

The upcoming version 3.50 software update for PS4 will add the ability to “Remote Play” PS4 games on a home computer, effectively turning a laptop or desktop with mediocre specs to a remote PlayStation powered gaming machine.

Not so long ago, Microsoft announced that Xbox One gamers will be able to stream games to PC thanks to the updated Xbox app. That feature was, for obvious reasons, limited to Microsoft Windows PCs and not Apple devices. This new announcement is just in time to nullify Microsoft’s superior feature.

This addition is not a reply to Microsoft’s screen sharing feature. President of Sony Worldwide Studios, Shuhei Yoshida, had made the announcement a while back. In November last year, he tweeted “Some people asked if we plan to provide Remote Play function to PC, and yes, we are indeed working on an official application for PC/Mac”.

Sony says the feature will not be available in the beta release of the 3.50 update. So early adopters won’t be able to test the feature in advance. However, the company’s blog post says “you can look forward to it soon”.

There are several others inclusions in the major update. It brings online friends notifications, which will let the gamers know when their friends are online to play games. To complement the feature, users will now be able to appear offline (invisible) when they are gaming alone or busy with something else. The Play Together feature will allow friends to join game parties or start new games together in more simpler manner.

Sony’s also bringing scheduled updates to PS4 which will make the process of organising future game meetups much easier. Dailymotion is being added to the Share feature and users will be able to check their storage using PlayStation Plus. Sadly, there is still no support for external storage devices.

The beta version of the update has been released while the stable release should be coming soon after.