The increased scrutiny Xiaomi have brought to their domains in my DNS logs shows that our devices are regularly trying to resolve metok-ccc.intl.xiaomi.com.home which NXDOMAINs.
I won't add it to the adlists, but I am going to blacklist it locally:
- it's extremely regular so creates log noise
- It's regularity suggests it might be a (currently failed) attempt to phone home
The ones ending .home are because the device didn't like the answer (domain blocked, most likely) and so used the LAN's search domain instead to see if there was a record for that.
So just for completeness, the following were blocked
The domain tracking.intl.miui.com was blocked quite a while back - https://github.com/bentasker/adblocklists/commit/95183702 - but, given what we've seen under xiaomi.com it's probably prudent to check if versions without the intl exist
ben@milleniumfalcon:~$ host tracking.rus.miui.com
tracking.rus.miui.com has address 107.155.53.108
ben@milleniumfalcon:~$ host tracking.india.miui.com
tracking.india.miui.com is an alias for tracking-india-miui-com1-1835355922.ap-south-1.elb.amazonaws.com.
tracking-india-miui-com1-1835355922.ap-south-1.elb.amazonaws.com has address 15.206.87.36
tracking-india-miui-com1-1835355922.ap-south-1.elb.amazonaws.com has address 13.235.208.92
tracking-india-miui-com1-1835355922.ap-south-1.elb.amazonaws.com has address 13.235.204.1
tracking-india-miui-com1-1835355922.ap-south-1.elb.amazonaws.com has address 3.6.193.53
tracking-india-miui-com1-1835355922.ap-south-1.elb.amazonaws.com has address 15.206.180.196
tracking-india-miui-com1-1835355922.ap-south-1.elb.amazonaws.com has address 15.206.39.100
tracking-india-miui-com1-1835355922.ap-south-1.elb.amazonaws.com has address 13.235.181.120
tracking-india-miui-com1-1835355922.ap-south-1.elb.amazonaws.com has address 15.206.118.188
ben@milleniumfalcon:~$ host tracking.miui.com
tracking.miui.com has address 0.0.0.0
tracking.miui.com has IPv6 address ::
ben@milleniumfalcon:~$ host tracking.gb.miui.com
ben@milleniumfalcon:~$
Let's block those too then.
Now, the interesting thing to note with Xiaomi is the difference between an empty DNS response and a NXDOMAIN. If we look for a made up name, we get an NXDOMAIN
ben@milleniumfalcon:~$ host tracking.fr.miui.com
Host tracking.fr.miui.com not found: 3(NXDOMAIN)
This means there's no zone fr.miui.com. But, there obviously is a gb.miui.com because we don't get an empty response with NOERROR
Actually, what we could really do with is creating a new type of list - a regex list. That can then be fed into pihole, so that we can block (say) tracking\..+\.miui.com and catch whatever regional zones they come up with
Repo: adblocklists
Commit: aa6c0659db6bb43ba3a6bc8efa7fa434552a77f6
Author: B Tasker <github@<Domain Hidden>>
Date: Sun May 03 09:33:13 2020 +0100
Commit Message: ADBLK-19 Add a new regex to handle Xiaomi's "resolver" service - knew there'd be another label appear at some point. This time it's "global" - resolver.msg.global.xiaomi.net
Picked up that domain whilst checking the Pihole logs from overnight.
The other thing that stands out, is that Xiaomi's hardware seems to have been designed based on Toy Story - it comes alive whilst you're asleep. Interesting to see just how regularly attempts were made to resolve tracking.intl.miui.com
May 3 00:14:51 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
May 3 00:14:51 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:14:51 dnsmasq[26416]: query[A] tracking.intl.miui.com from 192.168.3.78
May 3 00:14:51 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:15:03 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
May 3 00:15:03 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:15:03 dnsmasq[26416]: query[A] tracking.intl.miui.com from 192.168.3.78
May 3 00:15:03 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:16:27 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
May 3 00:16:27 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:16:27 dnsmasq[26416]: query[A] tracking.intl.miui.com from 192.168.3.78
May 3 00:16:27 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:19:07 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
May 3 00:19:07 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:19:07 dnsmasq[26416]: query[A] tracking.intl.miui.com from 192.168.3.78
May 3 00:19:07 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:21:49 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
May 3 00:21:49 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:21:49 dnsmasq[26416]: query[A] tracking.intl.miui.com from 192.168.3.78
May 3 00:21:49 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:21:59 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
May 3 00:21:59 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:21:59 dnsmasq[26416]: query[A] tracking.intl.miui.com from 192.168.3.78
May 3 00:21:59 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:22:09 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
May 3 00:22:09 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:22:09 dnsmasq[26416]: query[A] tracking.intl.miui.com from 192.168.3.78
May 3 00:22:09 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:22:19 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
May 3 00:22:19 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:22:19 dnsmasq[26416]: query[A] tracking.intl.miui.com from 192.168.3.78
May 3 00:22:19 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:23:27 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
May 3 00:23:27 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:23:27 dnsmasq[26416]: query[A] tracking.intl.miui.com from 192.168.3.78
May 3 00:23:27 dnsmasq[26416]: /etc/pihole/gravity.list tracking.intl.miui.com is 0.0.0.0
May 3 00:23:37 dnsmasq[26416]: query[AAAA] tracking.intl.miui.com from 192.168.3.78
Activity
2020-05-01 18:34:16
Webhook User-Agent
View Commit
2020-05-01 18:38:27
2020-05-01 18:45:34
2020-05-02 09:47:23
2020-05-02 10:07:20
I won't add it to the adlists, but I am going to blacklist it locally:
- it's extremely regular so creates log noise
- It's regularity suggests it might be a (currently failed) attempt to phone home
But, what else are the devices trying to look up?
root@PIHRP1:~# grep xiaomi /var/log/pihole.log | grep query | cut -d\ -f7 | sort | uniq -c 4 fr.app.chat.global.xiaomi.net 3 fr-app-chat-global-xiaomi-net1-1667981913.eu-central-1.elb.amazonaws.com 1 fr-app-chat-global-xiaomi-net-1516654448.eu-central-1.elb.amazonaws.com 14 metok-ccc.intl.xiaomi.com 51 metok-ccc.intl.xiaomi.com.home 8 metok-ccc.intl.xiaomi.com.home.home 11 resolver.msg.global.xiaomi.net 4 xiaomi.eu 8 zeus.ad.intl.xiaomi.com.homeand, in yesterday's log (i.e. a full day of logs)
root@PIHRP1:~# grep xiaomi /var/log/pihole.log.1 | grep query | cut -d\ -f7 | sort | uniq -c 4 api.ad.intl.xiaomi.com 3 data.mistat.intl.xiaomi.com 11 fr.app.chat.global.xiaomi.net 1 fr-app-chat-global-xiaomi-net1-1667981913.eu-central-1.elb.amazonaws.com 10 fr-app-chat-global-xiaomi-net-1516654448.eu-central-1.elb.amazonaws.com 70 metok-ccc.intl.xiaomi.com.home 19 resolver.msg.global.xiaomi.net 25 sdkconfig.ad.intl.xiaomi.com 2 zeus.ad.intl.xiaomi.com 14 zeus.ad.intl.xiaomi.com.homeThe ones ending
So just for completeness, the following were blocked
root@PIHRP1:~# grep xiaomi /var/log/pihole.log.1 | grep gravity | cut -d\ -f7 | sort | uniq -c 4 api.ad.intl.xiaomi.com 3 data.mistat.intl.xiaomi.com 25 sdkconfig.ad.intl.xiaomi.com 2 zeus.ad.intl.xiaomi.com2020-05-02 10:17:10
-
-
We can see from here - https://xiaomi.eu/community/threads/calls-home-to-the-maintainers.43699/ - that
I've never used Mi Message so it shouldn't be enabled
That page also gives a list of identified domains, so lets add those
- app.chat.xiaomi.net
- data.mistat.xiaomi.com
- data.mistat.intl.xiaomi.com
- ccc.sys.miui.com
- ccc.sys.intl.miui.com
- connect.rom.miui.com
- sdkconfig.ad.xiaomi.com
- sdkconfig.ad.intl.xiaomi.com
- api.sec.intl.miui.com
- api.sec.miui.com
- auth.be.sec.miui.com
- auth.be.sec.intl.miui.com
- weatherapi.market.xioami.com
- resolver.msg.xiaomi.net
That list is missing the "chat" endpoint I hit though, so we'll include
2020-05-02 10:18:14
Webhook User-Agent
View Commit
2020-05-02 10:20:15
Webhook User-Agent
View Commit
2020-05-02 10:28:14
Webhook User-Agent
View Commit
2020-05-02 11:08:14
Webhook User-Agent
View Commit
2020-05-02 11:12:57
All of those should now be blocked (except the
2020-05-02 11:16:32
The domain
Let's block those too then.
Now, the interesting thing to note with Xiaomi is the difference between an empty DNS response and a
This means there's no zone
So, should probably think about blocking those too in case they come in use later
2020-05-02 11:22:15
Webhook User-Agent
View Commit
2020-05-02 11:22:34
Doing that in ADBLK-21
2020-05-02 11:53:19
A Xiaomi domain was added as part of the initial config for that
looking back at their earlier list of domains, we almost certainly want to do
2020-05-02 11:54:15
Webhook User-Agent
View Commit
2020-05-02 12:04:47
2020-05-02 12:04:58
2020-05-02 12:05:06
2020-05-02 12:05:06
2020-05-02 12:05:09
2020-05-02 12:07:48
2020-05-03 09:35:15
Webhook User-Agent
View Commit
2020-05-03 10:06:48
The other thing that stands out, is that Xiaomi's hardware seems to have been designed based on Toy Story - it comes alive whilst you're asleep. Interesting to see just how regularly attempts were made to resolve