Monday, 1 August 2016

Possible Backdoor in MiPad-1?

Yesterday, I connected my MiPad to the internet for the first time and noticed a lot of background downloading happening immediately. This is not supposed to be happening since I've disabled automatic update checking and running the latest stable ROM (V7.3.1.0.KXFMIDD) from here. I used the "busybox netstat -at" command to see what's going on and sure enough, found that the MiPad is downloading lots of data from the IP 42.62.94.2 on the xmpp-client port:


Code:


tcp        0      0 ::ffff:10.42.0.199:39645 ::ffff:74.125.68.188:5228 ESTABLISHED
tcp        1      0 ::ffff:10.42.0.199:35061 ::ffff:216.58.221.46:https CLOSE_WAIT 
tcp        1      0 ::ffff:10.42.0.199:40799 ::ffff:216.58.220.1:https CLOSE_WAIT 
tcp        1      0 ::ffff:10.42.0.199:37015 ::ffff:216.58.196.193:https CLOSE_WAIT 
tcp      38      0 ::ffff:10.42.0.199:55343 ::ffff:52.77.134.112:https CLOSE_WAIT 
tcp        0      0 ::ffff:10.42.0.199:48529 ::ffff:42.62.94.2:xmpp-client ESTABLISHED
tcp      38      0 ::ffff:10.42.0.199:43885 ::ffff:52.74.1.172:https CLOSE_WAIT 
tcp        0      0 ::ffff:10.42.0.199:45423 ::ffff:172.217.24.238:https ESTABLISHED
tcp        1      0 ::ffff:10.42.0.199:37061 ::ffff:216.58.196.193:https CLOSE_WAIT 
tcp        1      0 ::ffff:10.42.0.199:34925 ::ffff:172.217.26.1:https CLOSE_WAIT 
tcp        1      0 ::ffff:10.42.0.199:34245 ::ffff:216.58.196.193:https CLOSE_WAIT 
tcp        1      0 ::ffff:10.42.0.199:32864 ::ffff:216.58.221.46:https CLOSE_WAIT 
tcp        1      0 ::ffff:10.42.0.199:46026 ::ffff:216.58.196.193:https CLOSE_WAIT 
tcp        1      0 ::ffff:10.42.0.199:35559 ::ffff:54.169.176.68:xmpp-client CLOSE_WAIT




I did a quick google search and found that others have found this and suspected a backdoor too. The WHOIS information is traced to a company called WLWM Communication Tech. co. ltd in Haidian District,Beijing. Can some experts here explain what could be going on here?

No comments:

Post a Comment