Zero-Click File Drop on Xiaomi ShareMe (MiDrop)

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.byterialab.com/zero-click-file-drop-on-xiaomi-shareme-midrop
• Blog Title: Zero-Click File Drop on Xiaomi ShareMe (MiDrop)
• Suggested Section: Mobile Pentesting > Android Applications Pentesting > Insecure Proximity/File-Transfer Protocols (BLE credential disclosure, optional cryptography bypass, remote consent-policy injection, and silent arbitrary file delivery)

🎯 Content Summary

Overview

The post documents an unauthenticated, zero-click silent file-drop chain in Xiaomi ShareMe/MiDrop (com.xiaomi.midrop), an Android file-sharing application reportedly installed more than one billion times. No CVE identifier is provided. Once a victim opens Receive mode, an attacker within Bluetooth Low Energy range—approximately 30–50 meters, potentially farther with a directional antenna—can extract the receiver's WiFi Direct credentials, join its networ...

🔧 Technical Details

BLE secret extraction: When auditing a proximity-based transfer protocol, inspect both custom BLE services and standard GATT characteristics. Applications may accidentally place SSIDs, passwords, addresses, ports, tokens, or discovery metadata inside readable characteristics such as Device Name 0x2a00. If the characteristic permits unauthenticated reads, any nearby client can recover the connection material without pairing. Extended advertising may require Android or dedicated BLE hardware even when desktop scanners such as macOS CoreBluetooth return no results.

Optional-cryptography bypass: A protocol is not protected merely because it contains ECDH, RSA, or encryption-related messages. Test whether public keys are parsed and validated, whether an authenticated session state is established, and whether plaintext messages are rejected afterward. In this case, URL-encoded {"pk":"test"} produces send_pk_ack...

🤖 Agent Actions

Using repository/GitHub-style inspection workflow: I’ll read the Android/mobile docs structure and several candidate files first so I can place this in the single best page.
I’ve identified that this isn’t already covered as a single Android proximity/file-transfer protocol pattern. I’m now verifying the primary sources (the write-up and PoC repo) and then I’ll add a compact, technique-focused section to one Android pentesting page instead of duplicating content across several files.
Updated src/mobile-pentesting/android-app-pentesting/README.md.

Added a new “Insecure proximity / file-transfer protocols” section covering:

• BLE/GATT credential leakage
• optional crypto / fake key exchange
• sender-controlled silent-transfer flags
• pull-based file delivery
• hidden staging-directory abuse
• weak custom APK verification
• WebView/FileProvider follow-on pivots
• legacy fallback credentials

Also appended numbered references:

• PoC repo
• original ByteriaLab write-up

Verified the section, citations, and diff.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.byterialab.com/zero-click-file-drop-on-xiaomi-shareme-midrop

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting > Android Applications Pentesting > Insecure Proximity/File-Transfer Protocols (BLE credential disclosure, optional cryptography bypass, remote consent-policy injection, and silent arbitrary file delivery)".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0