Hitchhiking on a security update?

[Jeff Layman]

I was notified this morning of a very large (3.6GB) MIUI "security"
update (14.0.4. Android 13) for my Xiaomi Redmi Note 10 (Vodafone). On
downloading and installing, I found several new app icons on the last
display screen. I use this very rarely and as there were spaces on the
screens which first appear, I assume this is a way of making them less
findable for some reason. These new apps were MIUI Store, Xiaomi
Community (might not be the correct name), and "Safety" which appears to
be Google's "Personal Safety". The first two I was able to uninstall,
the latter I couldn't.

On completing the update by rebooting, I found another piece of crap had
appeared as a notification - "Vodafone AppBox". Vodafone support shows a
way of switching it off
<https://support.vodafone.co.uk/Phones-devices/Device-help/1850774192/What-is-Appbox-and-how-do-I-use-it.htm>,
but the "deactivate" option doesn't appear on the Xiaomi. All I could do
is suppress notifications.

Now all I have to do is find a way of uninstalling "Personal Safety".
ADB perhaps? Has anybody succeeded in removing this system app?

I wonder why these apps have appeared now - something to do with the
MIUI update perhaps? It seems to me that 3.6GB is perhaps a serious
revision of the OS, and that's why this stuff has appeared.

--

Jeff

[Wally J]

Jeff Layman <Je...@invalid.invalid> wrote

> Now all I have to do is find a way of uninstalling "Personal Safety".
> ADB perhaps? Has anybody succeeded in removing this system app?

Hi Jeff,

As far as I'm aware, adb can remove _all_ system apps from the "user"
account, which is covered in this newsgroup, so I'll leave it at that.
<https://groups.google.com/g/comp.mobile.android>

Specifically you can look at the results of this search of this ng.
<https://groups.google.com/g/comp.mobile.android/search?q=adb%20delete%20chrome>

As noted in this newsgroup, you don't even need a PC since the free ad free
gsf free local adb program (ladb) runs on Android without needing the PC.

Also, sometimes I delete default apps (like Chrome and YouTube and the
useless Google Play Store app) from the user space on my unrooted phone,
but other times I just disable them and force stop them (e.g., Google Play
Services and other google spyware) in case an app later complains that it
needs it.

[VanguardLH]

As for removing any security software, sometimes you have to look at
Phone Administrators in Android settings to remove permission from
whatever security software you intend to install. Else, you don't have
permission to remove the security software.

I remember installing Sophos X-intercept AV on my phone, got prompted to
allow it to run as phone administrator, said yes (because some
protection feature required it), and later had to go into Phone
Administrators to remove Sophos after which I could uninstall the
software.

[Jeff Layman]

On 07/09/2023 18:07, Wally J wrote:
> Jeff Layman <Je...@invalid.invalid> wrote
>
>> Now all I have to do is find a way of uninstalling "Personal Safety".
>> ADB perhaps? Has anybody succeeded in removing this system app?
>
> Hi Jeff,
>
> As far as I'm aware, adb can remove _all_ system apps from the "user"
> account, which is covered in this newsgroup, so I'll leave it at that.
> <https://groups.google.com/g/comp.mobile.android>
>
> Specifically you can look at the results of this search of this ng.
> <https://groups.google.com/g/comp.mobile.android/search?q=adb%20delete%20chrome>
>
> As noted in this newsgroup, you don't even need a PC since the free ad free
> gsf free local adb program (ladb) runs on Android without needing the PC.

Thanks for the links. I'll have a good read through them before
attempting anything as I know that bricking is a real possibility if adb
is used carelessly.

> Also, sometimes I delete default apps (like Chrome and YouTube and the
> useless Google Play Store app) from the user space on my unrooted phone,
> but other times I just disable them and force stop them (e.g., Google Play
> Services and other google spyware) in case an app later complains that it
> needs it.

Unfortunately, Xiaomi's version of Android appears to leave even less
available to the phone owner than Google's does. Most of the time
"uninstall" doesn't even appear as an option, and "disable" or "stop" is
greyed out.

I came across another Google app which seems to have appeared since MIUI
update. It wasn't on any of the screens as an icon, but I noticed it in
the app update list which appears now and again. It is "private compute
services" (I think it uses "private compute core"). It is, of course,
uninstallable, and yet another example of Google foisting something on
us which we have no right to decide if we want or not. Oddly, reading
about it suggests it came with the Android 12 update a couple of years
ago, but it has never appeared in my update list until now.

For my next phone I will seriously consider using Sailfish OS to try to
avoid Google's influence. It won't, of course, affect any nosey android
apps I install, but hopefully I can consider alternative apps first.

Anyone here used/using Sailfish?

--

Jeff

[Jeff Layman]

Looks like I would require a Google account for that
<https://support.google.com/a/answer/3052681?hl=en>. It's not going to
happen.

> I remember installing Sophos X-intercept AV on my phone, got prompted to
> allow it to run as phone administrator, said yes (because some
> protection feature required it), and later had to go into Phone
> Administrators to remove Sophos after which I could uninstall the
> software.

--

Jeff

[VanguardLH]

Jeff Layman <Je...@invalid.invalid> wrote:

> VanguardLH wrote:
>
>> As for removing any security software, sometimes you have to look at
>> Phone Administrators in Android settings to remove permission from
>> whatever security software you intend to install. Else, you don't have
>> permission to remove the security software.
>
> Looks like I would require a Google account for that
> <https://support.google.com/a/answer/3052681?hl=en>. It's not going to
> happen.

I don't use an app nor go through any of the machinations mentioned at
that web site. As I said, "Phone Administrators in Android settings".
I just go into Android settings, find Phone Administrators, and delete
the one for the security software that I want to uninstall.

[Jeff Layman]

I do not have anything for Phone Administrators in my Android settings
(in "Passwords and Security"). A search of all apps for "admin" found
nothing.

--

Jeff

[VanguardLH]

On my old Android 8 phone (LG V20), it's called Phone Administrators.
On my phone, it's under Android settings -> General -> Lock screen &
security -> Advanced section. On other, or newer, phones, it may be
called Device Administrators.

https://www.youtube.com/watch?app=desktop&v=7w1xUBd4b-I
That shows Device Admins, for the video author's phone, are under
Settings -> Biometrics and security -> Other security options.

https://www.youtube.com/watch?v=cvNTxuyYB6k
That shows another navpath through settings to find the admin options.

https://www.lifewire.com/hidden-administrator-apps-153445
That mentions another navpaths to admin options.

Doesn't your Android have a Search field when looking at settings?
Mine does, and searching on "admin" finds Phone Administrators.

[Jeff Layman]

It does have a search field. It found only one hit - "Device admin
apps". This was in Privacy/Manage/Special permissions/Device admin apps.
It also said there were no device admin apps available. However,
touching the only hit turned up two "Device admin apps". These were the
"Find My Device" app, and the "My Vodafone" app.

I don't have the "Find my device" app activated. It would allow me to
delete all data, change the screen lock, lock the screen, and disable
some screen lock features according to the info.

The My Vodafone app is also not activated. If I did activate it, it
would delete all data (are the other apps that do this? Do I need two of
them on my phone?), and it can also set storage encryption.
Interestingly, if I touch "activate" I get a strong warning about what
the app can do. Evidently it can also monitor and control the screen
lock, and restrict the camera usage (although neither of these were
mentioned on the first info screen).

FYI, the android version is 13 TP1A.220624.014. MIUI is 14.04.0.

I think the issue here is what "OS" controls what. Is it android or MIUI
which is effectively in control of the phone? Oh, and let's not forget
that at least for this Xiaomi phone, which I bought from Vodafone, there
is a "Vodafone" rom in it. I wonder where that sits in the hierarchy of
phone control.

--

Jeff

[VanguardLH]

Every phone maker customizes the Android OS to brand their phone. Looks
like Xiaomi decided to bundle Vodafone Appbox on their phones. Well,
Vodafone bundled their app on their customized Xiaomi phone they sold
you. I'm pretty sure if you hunt for message in this newsgroup, you'll
find some that mention how to remove bundled apps using their AppPackage
name after activating Developer Options to enable ADB (Android Debug
Bridge). You might have to install the ADB driver in Windows. Else,
contact Xiaomi support to ask how, but I thought they sold cheap by not
providing any support.

Is this a locked phone? If so, Vodafone probably doesn't want you
removing any of their bundled apps, but you probably can still remove
their AppBox package assuming you having installed any of Vodafone's
apps that AppBox installed.

I don't know what all are the Vodafone apps that their AppBox can
install for you, but getting rid of AppBox could mean losing those other
apps, and some might be important. The Dialer is a bundled app, and
possible Vodafone has their own Dialer app, but I don't know if AppBox
handles their Dialer app setup.

As for finding a community more focused on Vodafone customized Xiaomi
phones, you might want to ask over in their forums.

https://forum.vodafone.co.uk/

[Jeff Layman]

Wally J (Arlen?) provided some useful links which I've yet to look at.
The phone is now just out of the guarantee period, so I guess I can have
a play with adb, and if I brick it, that's my fault. As I mentioned
earlier, I'll seriously consider Sailfish, but installing it isn't that
simple (and I'm pretty sure it is not possible on the Redmi Note 10 I have).

BTW, the MyVodafone app was apparently installed via Google Playstore at
the time I bought the phone, and can be uninstalled. I had thought it
was simply an app linked to my Vodafone account, but it seems it is more
powerful (and destructive if used carelessly).

> Is this a locked phone? If so, Vodafone probably doesn't want you
> removing any of their bundled apps, but you probably can still remove
> their AppBox package assuming you having installed any of Vodafone's
> apps that AppBox installed.

I haven't checked if it's locked or not. Vodafone unlocked all of their
phones from 1/1/22. I bought mine in August 21. Even if locked,
unlocking it would be straightforward, and shouldn't take that long
(although this would be Vodafone I'm dealing with...).

> I don't know what all are the Vodafone apps that their AppBox can
> install for you, but getting rid of AppBox could mean losing those other
> apps, and some might be important. The Dialer is a bundled app, and
> possible Vodafone has their own Dialer app, but I don't know if AppBox
> handles their Dialer app setup.
>
> As for finding a community more focused on Vodafone customized Xiaomi
> phones, you might want to ask over in their forums.
>
> https://forum.vodafone.co.uk/

I had a look at that but there's not a lot of Xiaomi info there. There
seems to be more info at <https://c.mi.com/>

--

Jeff