“We are certain the device that Bluebox tested is not using a standard MIUI ROM, as our factory ROM and OTA ROM builds are never rooted and we don’t pre-install services such as YT Service, PhoneGuardService, AppStats etc. Bluebox could have purchased a phone that has been tampered with, as they bought it via a physical retailer in China. Xiaomi does not sell phones via third-party retailers in China, only via our official online channels and selected carrier stores.”
In a communication to BGR, Xiaomi stated: “There are glaring inaccuracies in the Bluebox blog post. Official Xiaomi devices do not come rooted and do not have malware pre-installed. Our investigation based on information received so far indicates that the phone Bluebox obtained is a counterfeit product purchased through an unofficial channel on the streets in China.”
Xiaomi has since released an update with their findings, which show that the device is not a genuine product and is in fact an exceptional counterfeit. Having the same internals, battery and labels as would be expected. The verification app was even fooled in this case and as such the effort required to confirm the authenticity of the device is far beyond that capablility of the average user. The hidden directory was the cause of this as any attempt to install the AntiFake app were intercepted by a copy present on the SDcard and after removing these fake applications the genuine copies could be installed and used to prove the device was not authentic.
After BlueBox ran the same tests on an official copy of Xiaomi’s MIUI ROM they received a far improved score of 6.7 and noticed many of the flaws initially detected were not present.
http://www.xda-developers.com/bluebox-security-vs-xiaomi-who-is-in-the-wrong/