Owners of Xiaomi smartphones, especially the Redmi 9 model, often face intrusive offers to install third-party apps or games that were not found in the official Google Play store.This is because the Android operating system by default allows the installation of programs from external sources if the user or someone from the household accidentally clicks “Allow” in the system window. For many users, especially the elderly or children, this becomes the cause of advertising debris and potentially malware.
In this article, we will take a look at how to securely prevent the installation of applications from unverified sources on your device. We will go through all the layers of protection of the MIUI shell, from basic security settings to hidden debugging functions that can become a loophole for attackers.
Basic Security Setup in MIUI
The first and most important step is to disable the global installation permit. APK-files for all browsers and file managers. MIUI, The process is a little different from pure Android, which is installed on Redmi 9, and you need to open the standard Security app, which is the access control system center. Find the “Permissions” or “Permissions Management” section where the key switch is hidden.
After you go to the permissions menu, look for "Install Unknown Apps." Here you'll see a list of all the programs that theoretically can initiate software installation. By default, browsers (Chrome, Mi Browser) and instant messengers (Telegram, WhatsApp) often have active permission. Your task is to disable this access for every suspicious or unused application. This will create the first barrier that will prevent the installer from starting even when a file is accidentally downloaded.
⚠️ Note: Even if you have banned installation, some aggressive ad scripts may try to emulate clicks.
Also, check your browser-specific settings. If you use Chrome, go to its settings, look for the Privacy and Security section, and make sure that Safe Browsing is active and set to Enhanced Protection. This will help block the download of malicious APK-Files before they reach your device by analyzing their signatures in the Google cloud.
💡
Use guest mode or a second profile if you give your children a phone so they can’t change the security settings on your main account.
Use of the “Device Protection” function
Xiaomi Redmi 9 smartphones have a built-in mechanism that is often ignored by users, but it is critical to prevent the installation of unwanted software. This is the “Device Protection” feature, which scans the system in real time. To activate it, go to Settings, then to the “Passwords and Security” section and select “Privacy”.
It doesn't just look for viruses, it also checks the digital signatures of apps you install. If you try to install an app that hasn't been verified by Google Play Protect or has a questionable certificate, the system will issue a red alert and block the process. In some cases, especially when installing older versions of programs, the system may say "Install it anyway." Ignore this sentence if you're not sure about the source of the file by 110%.
- 🔍 Regularly update the virus databases in the Security app to detect new threats.
- 🚫 Turn it off «USB-debugging immediately after use to avoid remote installation of software.
- 🛡️ Use the “Ad Blocker” in the built-in Mi browser to prevent clicks on malicious sites.
It is important to understand that the device protection works in the background and consumes the minimum amount of resources of the Snapdragon processor installed in Redmi 9. However, if you notice that the phone has started to warm up or slow down when installing applications, this can signal an attempt to stealth mining or implement a Trojan.
☑️ Checking security settings
Limitation of Rights for System Services
One of the common loopholes that allows you to install applications without the user's knowledge is system and update services. On Redmi 9, some system components may have redundant rights. Go to Settings → Apps → All Apps. On the screen, click three dots and select Show System Processes.
In the list that opens, look for services with names like Package Installer or Google Software and Services. When you go to them, make sure they don't have rights to "Display on top of other apps" or "Access to use" unless it's clearly necessary. Limiting these rights will prevent the malicious script from running the installer on top of your desktop, which is often used to deceive the user.
| System component | Recommended status | Risk of inclusion |
|---|---|---|
| Package Installer | Only for the system. | High (APK installation) |
| Google Play Services | Included. | Low (basic function) |
| MIUI Security | Included. | No (defence) |
| Unknown Sources | Off. | Critical (viruses) |
Also worth paying attention to is the Downloads app. Make sure it doesn't have permission to install apps. Often users download a file thinking it's a picture, but it's actually an installer. If Downloads doesn't have permission to install the APK, the file will simply open as an archive or be locked, which will save you from error.
⚠️ Note: Do not remove system components through ADB Or root rights if you don't have a deep knowledge, which can lead to a "bootloop" (cyclical reboot) of your Redmi 9.
Blocking through parental control
If your goal is to completely ban all apps, including those on Google Play, the best solution is to use digital well-being or parental control. In Redmi 9, go to Digital Well-being and Parental Control, where you can set up a Child profile or restrict the rights of the primary user.
Parental Control allows you to set a password for making purchases and installing apps, and even if you find a way to circumvent the ban on unknown sources, you can’t install anything new from the official store without entering it. PIN-It's a reliable method for devices used by children or people with dementia who may accidentally click the wrong way.
To lock things more tightly, you can use third-party launchers or kiosk apps that turn a smartphone into a device with one or more allowed apps. In Guide Access mode (or its Android counterparts), the user will not physically be able to log into the settings menu to change anything, making Redmi 9 a specialized tool, eliminating the possibility of installing games or junk software.
Hidden Features of Family Link
Working with the developer mode
Many users, trying to speed up a smartphone or access hidden features, include Developer Mode. On Redmi 9, this is done by repeatedly clicking on the build number in the About Phone section. However, inside this menu, there is a dangerous setting — “Install through” USB» (Install via USB). If it is enabled, a computer connected to the phone can install any application without screen confirmation.
It is strongly discouraged to keep this feature on permanently.Attackers can use ADB (Android Debug Bridge) vulnerabilities to inject malicious code if the phone is connected to a public charging station or computer with a virus. To protect yourself, go to Developer's For and find the USB Install switch, turning it to Off.
Also in the developer menu, you should pay attention to the item “Debugging by USB». If you're not using your phone to program or debug deeply, it has to be turned off, and its active status opens up a wide range of possibilities for external control, which is contrary to the concept of a closed and secure environment.
- 🔒 The password to enter the developer mode can be set in new versions MIUI extra protection.
- 📉 Disabling animations in the developer menu does not affect security, but speeds up the interface.
- ⚡ The function “Do not turn off the screen when charging” is convenient, but consumes battery if you forget the phone on charging.
💡
Developer Mode is a powerful tool that should only be turned on while specific tasks are being performed and turned off immediately after they are completed.
Additional System Protection Measures
In addition to the software settings, smartphone hygiene plays an important role. On Redmi 9, as on any Android device, the source of problems is often not the settings themselves, but the behavior of the user. SMS-messages from unknown numbers, especially those that promise winnings or require urgent data verification.
Use only official sources to download the software.The Google Play Store, Galaxy Store (if installed) or official Xiaomi site (GetApps) undergo strict security checks. APK-files from forums or torrent trackers, you take responsibility for the security of your data. Even if the antivirus is silent, the file may contain a spy module that is activated later.
Check the list of applications with device administrator rights regularly. Go to Settings → Passwords & Security → Privacy → Device Administrators. There shouldn't be any weird programs here. If you see an unknown application with these rights, immediately delete it and reset the rights, otherwise it will block the screen or prevent the deletion of itself.