Third-party distribution platforms the NCSC found linked to AppGallery include but are not limited to Apkmonk, APKPure, and Aptoide. Software classes in these Xiaomi applications use MiAdBlackListConfig to analyze multimedia which might be displayed on the device and block that content if 'undesirable' keywords are associated with it.Īlthough the NCSC discovered that the actual content filtering via MiAdBlackListConfig is disabled on phones registered in the European Union, the phones still regularly download the blocklist itself-and, the agency says, can be remotely reactivated at any time.

In this file, the NCSC found 449 records identifying religious, political, and social groups. Several of the Xiaomi system applications on the Mi 10T 5G regularly download a file called MiAdBlackListConfig from servers in Singapore. The mobile phone number is sent whether the user ties it to a new cloud account or not, and the encrypted SMS is not visible to the user. The NCSC also found that the user's mobile phone number is silently registered to servers in Singapore via encrypted SMS message on activation of default Xiaomi cloud services.

These statistics are encrypted and sent to Xiaomi servers in Singapore, a country which the NCSC notes is not covered by the EU's GDPR and has been tied to excessive data collection and abuse of user privacy.

The NCSC found that Sensor Data's module collects statistics on 61 parameters related to application activity, including time of app activation, language used, and so forth.

Mortal kombat play store