MIUI Lock Screen Vulnerability Provided Access to Clipboard Data, Fix Released

Xiaomi is already infamous for pushing ads through its MIUI operating system but of late the company's software and apps have also been found to have vulnerabilities. Now, a new flaw has been found in the lock screen implementation of the latest MIUI versions that could give an attacker access to the user's clipboard data. The issue is claimed to be specific to India region and exists not only on Redmi and Mi smartphones but also on the Poco F1. The vulnerability requires physical access to the device to give a backdoor entry to the clipboard data and partial access to user's stored social media credentials. Xiaomi has released an updated version of its Mi Wallpaper Carousel app in the Play Store that has patched the vulnerability.

Security researcher Arif Khan on infosec blog Andmp reports that the latest MIUI stable releases are affected by a vulnerability that could give an attacker ability to access the Xiaomi phone's clipboard. The issue is said to be specific to India region, though it exists on all the recent MIUI builds. The flaw is said to be a part of the Wallpaper Carousel feature that Xiaomi has provided in collaboration with InMobi -- through its Glance app.

The Wallpaper Carousel feature is designed to frequently showcase new wallpapers on the lock screen. Each of the wallpapers presented on the lock screen comes with a title and a Read More button that lets you read the context of the image. The vulnerability primarily exists in the context part of the feature as it lets users share the featured content through their social media accounts without unlocking the device. This also includes the ability to paste data directly from the clipboard. Similarly, users can add data to their clipboard direct from the content being served through the Wallpaper Carousel feature.

While the Wallpaper Carousel feature is disabled by default, anyone who has physical access to the device can enable it directly from the lock screen -- simply by swiping the screen and then tapping the Turn on button.

Xiaomi's Mi Wallpaper Carousel app was found to have a lock screen vulnerability
Photo Credit: Andmp

We were able to verify the existence of the flaw on our Poco F1 unit running the latest MIUI 10.3.4.0 version. The researcher claims that he found the vulnerability on a device based on MIUI 10.1.3.0. This suggests that the issue isn't limited to any specific MIUI version and is available not only on some Xiaomi's Redmi and Mi phones but also on the Poco F1 that runs a modified MIUI build.

After the initial media reports about the vulnerability surfaced, Xiaomi has released an updated version of the Mi Wallpaper Carousel app in Google Play, which plugs the vulnerability, restricting access to the clipboard as well as social media accounts. If you use a Xiaomi smartphone, it is recommended that you update the Mi Wallpaper Carousel app on your phone.

We've reached out to Xiaomi for more information on the vulnerability and will update this report when we hear back from the company.

Importantly, this isn't the first time when Xiaomi has hit the headlines over a security flaw in its apps or software. Just earlier this month, the security app Xiaomi Guard Provider, which comes pre-installed on the Xiaomi phones, was discovered with a serious vulnerability that could allow an attacker to wreak havoc by intercepting the traffic linked to the app. The Mi Browser and Mint Browser by the Chinese company were also found to have a critical URL spoofing security issue.

Xiaomi also faces consumer outage over how it serves ads through different MIUI elements. Xiaomi CEO Lei Jun earlier this month revealed that MIUI 11 would restrict ads to some extent and remove vulgar ads.

Do Redmi Note 7 Pro, Redmi Note 7, and Mi Soundbar redefine their price segments? We discussed this on Orbital, our weekly technology podcast, which you can subscribe to via Apple Podcasts or RSS, download the episode, or just hit the play button below.