Xiaomi App Store design defects have man-in-the-middle risks

Xiaomi App Store design defects have man-in-the-middle risks

Xiaomi app store can be attacked by man-in-the-middle to leak information
Testing System miui 7 6.2.18 development Edition

Xiaomi app store does not verify whether the SSL certificate is valid when using HTTPS communication, so the man-in-the-middle can intercept the request with a self-signed certificate.

First, connect to my scan vpn (get a self-signed certificate to intercept traffic)

Open Xiaomi App Store

No prompts
Let's take a look at the display on my vps.