Beware of Spyware and Data Collection if you are using a Micromax Laptop/Tablet

Micromax is an Indian consumer electronics maker who is notorious for data collection. While its true that they produce budget handsets and notebooks which are quite affordable, the hidden cost of that is pathetic customer support and lots of pre-installed spyware and bloatware on their devices.

I had recently purchased a laptop (Micromax Lapbook L1161) and was surprised to find a windows service called "MMXServiceL1161N" pre-installed and set to run automatically. Now thankfully, some idiot in their build department seems to have left the source-code of the windows service as it is on the C:\ drive, and the service was running right from that source code folder, so I was able to open it and read exactly what it was sending back and where:

File: C:\MMXService\MMXService\MMXService.cs

public void FireUpAPI()
{
 try
 {
  //Library.WriteLogs("FireAPI - enter" + Library.GetDetails());
  string URL = "http://sts.micromaxinfo.com/configureSms/msg.aspx?tim=" + Library.GetTime() + "&Msg=" + Library.GetDetails();
  HttpWebRequest request = (HttpWebRequest)WebRequest.Create(URL);
  request.Proxy = null;
  WebResponse resp = (HttpWebResponse)request.GetResponse();
  if (resp != null)
  {                   
   System.IO.StreamReader sr = new StreamReader(resp.GetResponseStream());
   responseString = sr.ReadToEnd();
   if (responseString.Contains("OK"))
   {
    Console.WriteLine("Message sent successfully");
    Console.ReadLine();                   
   }
  }
  //Library.WriteLogs("FireAPI - Complete" + Library.GetDetails());
 }
 catch (Exception ex)
 {
   
 }
}

As you can see, its phoning the collected data to http://sts.micromaxinfo.com/configureSms/msg.aspx and when I saw the Library.GetDetails() method to see what it was sending, I was pretty much shocked:

File: C:\MMXService\MMXService\Library.cs

string TableRegs = "";
Version os = Environment.OSVersion.Version;
string sysModel = "";
string cellid = "", lacid = "", imei = "", mccmnc = "", HWno = "", SWno = os.Build.ToString();
 HWno = "HW_V1.0";
   if (os.Build != null)
  SWno = SWno;
 else
  SWno = "";              
 //sysModel = "TABHIG0013";
   //Library.WriteLogs("GetDetails - step 1");  
   // MbnInterfaceManager mbnInfMgr = new MbnInterfaceManager();
   // Library.WriteLogs("GetDetails - step 1.1");  
   // IMbnInterfaceManager infMgr = (IMbnInterfaceManager)mbnInfMgr;
   // Library.WriteLogs("GetDetails - step 1.2");  
  //if(infMgr!=null)
  //{
   //IMbnInterface[] interfaces = (IMbnInterface[])infMgr.GetInterfaces();
   //Library.WriteLogs("GetDetails - step 2");
   sysModel = "NPWL1161SIL";
   imei = "";
   foreach (NetworkInterface nic in NetworkInterface.GetAllNetworkInterfaces())
   {
    //Library.WriteLogs("GetDetails - step 3");
    if (nic.NetworkInterfaceType == NetworkInterfaceType.Wireless80211 && nic.OperationalStatus == OperationalStatus.Up)
    {
     imei = nic.GetPhysicalAddress().ToString();
    }
   }
  // Library.WriteLogs("with out SIM-device " + imei);
   string SNO = serial_N0(imei);
   imei = SNO;

   if (string.IsNullOrEmpty(cellid))
    cellid = "0000";
   else
    cellid = "";
   ;
   if (!string.IsNullOrEmpty(lacid))
    lacid = "0000";
   else
    lacid = "";

   if (!string.IsNullOrEmpty(mccmnc))
    mccmnc = mccmnc;
   else
    mccmnc = "000000";

   if (!string.IsNullOrEmpty(cellid))
    cellid = cellid;
   else
    cellid = "0000";
   if (!string.IsNullOrEmpty(lacid))
    lacid = lacid;
   else
    lacid = "0000";
   //if (mobileInterface.GetInterfaceCapability().deviceID != null)

Its vital details about your system such as your Windows build number and model number, IMEI, MAC Address, Cell ID, etc. Thankfully, my laptop model didn't have a SIM slot in it, but there are other Micromax tablets and 2-in-1s that do have a SIM slot and the privacy implication for those users is disastrous.

If you happen to use a Micromax device running Windows-10 OS and come across this folder, then do the following immediately:

1. Open Windows Services Panel (services.msc) and disable this service.
2. Just delete the folder C:\MMXService\.
3.  Alternatively, the best thing is to just make a clean re-install of Windows-10 or a Linux OS.

The majority of Indian users are dumb and non-technical, so in all probability this data collection will keep happening until consumer awareness rises in this regard. But for rest of the users, I hope they find this article useful.