Breach Disclosure: Xiaomi BBS Forum

Breach Disclosure: Xiaomi

The Xiaomi user forum, a forum dedicated to support of Xiaomi smartphone users, was breached in May 2014. Xiaomi is one of China's largest smart phone manufacturers, and has been accused of shipping personal data from their phones to Chinese servers. The original HackerNews post showed that a researcher obtained the data and was going to present it, but the talk was pulled due to intervention from the company. In total, 7 million email addresses were compromised, and the data included usernames, IP addresses and salted MD5 password hashes.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media

Details

Xiaomi has a history in the security community. A Taiwanese researcher was supposedly responsible for the breach, and they were going to publish data about the company in a talk at Ground Zero Summit in 2014. The talk went into detail about the privacy concerns of the company and it's devices. In a response email from officials at the company, they had the following to say about the researcher:

We have verified that the zero-day data breach allegation made by security researcher Chen Huang and the Ground Zero Summit organizing committee is a hoax. The zero-day vulnerability reported by the cyber security researcher, Chen Huang, is a deliberate falsehood, and Xiaomi is taking the necessary legal action against the parties involved.
To date, throughout Xiaomi's history, there has only been one incident in which a two-year-old user account file was leaked in May 2014. After conducting a comprehensive investigation, we concluded that file contained information from user accounts registered before August 2012 in an old version of the Xiaomi user forum website. That information became obsolete when, in September 2012, we launched the Xiaomi Account integrated system.
In response to the incident in May 2014, we immediately requested users to change their passwords. We also announced the incident publicly via social media and to our user forums on May 14, 2014.
Chen Huang has recently threatened to expose data from the old user account file during a session at the upcoming Ground Zero Summit 2014, falsely claiming it to be data compromised through an existing vulnerability. This is a grave accusation, as we take our users' privacy very seriously, and we will seek legal action against the involved parties.```