Recently security consultancy Bluebox Labs reported on some major security flaws found in the latest Xiaomi Mi 4 phone. Xiaomi didn’t take this criticism lying down, and has prepared a lengthy rebuttal to Bluebox’s claims.

While Xiaomi had already called the report “inaccurate” in a statement to VR World, Hugo Barra, Xiaomi’s VP International responded to Bluebox Labs by saying the phone purchased by the company in China had been tampered with. It’s important to note that Bluebox had already tested the device to make sure that it was authentic and not a knockoff.

“We are certain the device that Bluebox tested is not using a standard MIUI ROM, as our factory ROM and OTA ROM builds are never rooted and we don’t pre-install services such as YT Service, PhoneGuardService, AppStats etc,” Barra said in his statement. “Bluebox could have purchased a phone that has been tampered with, as they bought it via a physical retailer in China. Xiaomi does not sell phones via third-party retailers in China, only via our official online channels and selected carrier stores.”

If Barra’s claim holds true, this brings up the very worrying issue of supply chain security, as Bluebox points out. If these — authentic — phones are modified by the retailer, or someone else in the supply chain, that’s incredibly concerning for device security and brand reputation.

Barra says that customers should only purchase Xiaomi phones from the official online store to ensure authenticity and “reputable retailers”. But what makes a “reputable retailer”? If the one Bluebox purchased its phone from — and it went to great lengths to ensure authenticity — isn’t reputable than which ones are? After all, China is home to fake Xiaomi stores (and fake Apple as well as Samsung stores too).

If indeed what Barra says is true, this is largely a lesson in supply chain security. All vendors need to ensure that the China side of their supply chain isn’t compromised by a man-in-the-middle attack. Because clearly even local companies aren’t immune.

UPDATE: March 9 2015 11:00 AM China Standard Time

Xiaomi emailed VR World further statements to expand upon what it told Bluebox Labs. Here’s the statement in full.

There are glaring inaccuracies in the Bluebox blog post. Official Xiaomi devices do not come rooted and do not have malware pre-installed. Our investigation based on information received so far indicates that the phone Bluebox obtained is a counterfeit product purchased through an unofficial channel on the streets in China. We’re gathering more information to fully confirm this and should have a final answer in the next 24 hours.

With the large parallel street market for mobile phones in China, not only is it somewhat common for third parties to tamper with the software sold on smartphones, but there are counterfeit products which are almost indistinguishable from the original products on the outside. This happens across all brands, affecting both Chinese and foreign smartphone companies selling in China. 

Furthermore, “entrepreneurial” retailers may add malware and adware to these devices, and even go to the extent of pre-installing modified copies of popular benchmarking software such as CPU-Z and Antutu, which will run “tests” showing the hardware is legitimate — fooling even very discerning buyers.

Xiaomi takes all necessary measures to crack down on the manufacturers of fake devices or anyone who tampers with our software, supported by all levels of law enforcement agencies in China. However, for the safety of our users, Xiaomi and all smartphone brands always recommend buying phones through authorised channels. Xiaomi only sells via Mi.com, and a small number of Xiaomi trusted partners including mobile operators and select authorised retailers, such as Flipkart in India. 

In addition, contrary to what Bluebox has claimed, MIUI is true Android, which means MIUI follows exactly Android CDD, Google’s definition for compatible Android devices, and it passes all Android CTS tests, the process used by the industry to make sure a given device is fully Android compatible. All Xiaomi devices sold in China and international markets are fully Android compatible.

The post Updated: Xiaomi Hits Back Hard at Bluebox Labs’ Claims appeared first on VR World.

Everyone knows that Xiaomi’s growth has been remarkable, and now two separate reports from IDC and Strategy Analytics quantify it: the company is now the world’s third biggest smartphone manufacturer thanks to growth in Asia’s emerging markets.

According to data provided by IDC,  Xiaomi accounted for 6% of the approximately 320 million smartphones shipped during the last quarter. In comparison, Apple claimed 12% of all handsets shipped while the market leader Samsung had a 23.8% grasp on the market. The biggest loser of the lot was Samsung, which saw its market share erode by 8.2% compared to the same quarter last year.

IDC chalks up the success of Xiaomi to its successful launch of its flagship Mi4 smartphone, and expansion into India and Southeast Asia.

“Key to its success was the launch of its Mi4 smartphone in August, which was positioned as a high-end alternative to the status quo. What remains to be seen is how quickly the company can move beyond its home territories to drive volumes higher,” IDC said in a press release. “Despite rumours of a slowing market, smartphone shipments continue to see record-setting volumes.”

“Samsung continues to face tough competition from Apple at the higher-end of the smartphone market, from Xiaomi and Huawei in the middle-tiers, and from Lenovo and others at the entry-level,” Strategy Analytics said in its report.

Any way but Huawei

In many ways Xiaomi is beginning to run into some of the same problems that Huawei (SHE:002502) has experienced over the past three years: Sinophobia.

Xiaomi has done its part to address these concerns, by promising to move data out of China  and providing a feisty response to claims that the company engages in wholesale design theft from its competitors.

But as Xiaomi grows, these attacks are expected to intensify. Huawei — though not directly comparable — suffered through an onslaught of allegations that it was an extension of China’s official signals intelligence apparatus, but largely that has come from clever lobbying by Cisco (NASDAQ: CSCO). When put to the test by security researchers, Huawei’s gear was not a listening outpost for China’s spies — it was just buggy and poorly made. There’s no evidence that Apple or Samsung are engaging in the same sort of attacks against Huawei, but it wouldn’t be entirely implausible.

Perhaps, however, Xiaomi will avoid the pains of expansion that Huawei experienced. Hugo Barra, its global VP and face of the company, recently told The Wall Street Journal that his company has no plans to expand into the United States.

The post How Long Will Xiaomi’s Growth Last? appeared first on VR World.

Xiaomi says it plans to move data for customers that are not Chinese nationals to data centers in the United States and Singapore.

“This is a very high priority for Xiaomi as we expand into new markets over the next few years,” Barra said.

Xiaomi’s Hugo Barra made the announcement on Facebook earlier this week, shortly after censorship watchdog GreatFire.org reported that Apple’s iCloud being the target of a man in the middle attack from Chinese authorities hoping to harvest the login details of users. Xiaomi had previously faced scrutiny and investigation in Taiwan as reports from the island-state indicated that Xiaomi handsets were sending data back to China — posing a security risk if the phones were used by government officials.

Barra said that Xiaomi will use Amazon’s (NASDAQ: AMZN) cloud services for US customers, and Akamai’s content delivery network for global customers.

Barra said the transition out of China will occur in two phases. The first part, which should be done within the next few weeks, involves moving its e-commerce platform  and  Mi Services  to  new datacenters. Part two involves building new data centers in up-and-coming markets such as Brazil, Russia and India.

For Xiaomi — a company with global aspirations — having data centers in China is something of a liability. Legally, a company hosting data in the country must give authorities access to it upon request. There are no oversight mechanisms such as warrants in China.  This move should help restore some confidence in the brand for privacy concerned consumers.

The post Xiaomi to Move Data Out of China appeared first on VR World.

This past weekend at an event hosted by the magazine Vanity Fair, Apple’s (NASDAQ: APPL) Jony Ive had some strong words for Xiaomi and other “copycats” — accusing them of outright theft — but these claims were strongly rebutted by Xiaomi’s Hugo Barra.

Speaking with Vanity Fair, Ive said that he thinks copy-cat designs, from rivals such as Samsung and Xiaomi, were the product of laziness as well as being out-and-out theft.

“I’ll stand a little bit harsh, I don’t see it as flattery,” Ive said during an on-stage interview with Vanity Fair’s editor Graydon Carter. “When you’re doing something for the first time, you don’t know it’s going to work. You spend seven or eight years working on something, and then it’s copied. I have to be honest, the first thing I can think, all those weekends that I could have at home with my family but didn’t. I think it’s theft, and it’s lazy.”

Days later, when asked to respond to Ive’s comments during an interview with India’s Economic Times, Barra said that Apple has no rights to claim ownership of a “design language.”

“If you look at the iPhone 6, iPhone 6 has been using the design language that has been around for a while. The iPhone 6 is using design language that HTC has had for five years,” he said.

Who copied whom?

As the blockbuster Apple v. Samsung court case of 2012 showed, the question of who’s the originator and who’s the imitator sometimes becomes ambiguous. Granted, Samsung (KRX:005930) was found guilty of violating a number of Apple’s patents, but at the same time the company presented evidence which it claims showed it was developing a rectangular black smartphone with a touchscreen before the release of the first iPhone in 2007.

Although this evidence was not entered into submission for the trial in 2012, it didn’t stop Samsung’s lawyers from sending it out to journalists covering the case at the time with the following statement:

“The Judge’s exclusion of evidence on independent creation meant that even though Apple was allowed to inaccurately argue to the jury that the F700 was an iPhone copy, Samsung was not allowed to tell the jury the full story and show the pre-iPhone design for that and other phones that were in development at Samsung in 2006, before the iPhone. The excluded evidence would have established beyond doubt that Samsung did not copy the iPhone design. Fundamental fairness requires that the jury decide the case based on all the evidence.”

In this case, Xiaomi, the nimble startup that’s been taking China by storm, is being unfairly marginalized; Apple is no saint when it comes to integrity of its intellectual property. This is simply a case of the market leader trying to swat away its competition.

The post Hugo Barra: Xiaomi Doesn’t Steal appeared first on VR World.