Slashdot Mirror
HTC Android Phones Found With Malware Pre-Installed
Trailrunner7 writes "Security researchers have found that Vodafone, one of the world's larger wireless providers, is distributing some HTC phones with malware pre-installed on them. The phone, HTC's Magic, runs the Google Android mobile operating system, and is one of the more popular handsets right now. A researcher at Panda Software received one of the handsets recently, and upon attaching it to her PC, found that the phone was pre-loaded with the Mariposa bot client. Mariposa has been in the news of late thanks to some arrests connected to the operation of the botnet."
It's an undocumented feature!
SJW: Someone who has run out of real oppression, and has to fake it.
No user intervention, IT JUST WORKS
"I use a Mac because I'm just better than you are."
The software in question was an autorun file, so it wasn't installed on the phone, it was just present on the phone's flash drive waiting to try to infect any OS stupid enough to automatically run programs from untrusted devices. It's not like the phone was running a botnet client and using up your data allowance sending spam, it was just a carrier.
I am TheRaven on Soylent News
I'm personally getting fed up with companies that allow this to happen. If companies that distribute devices that come pre-loaded with malware were fined heavily for each instance, they'd likely hire a few good devs and QA people to ensure that this sort of thing doesn't happen again.
There's absolutely no excuse for this. If you contract out development or manufacturing and that leads to this kind of security risk, there's still no excuse. Unfortunately as of right now there are few if any consequences associated with this type of negligence -- which means that companies aren't going to do much to improve their security practices.
Facts have a liberal bias.
Linux is not a malware. Such smear tactic at slashdot must stop.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
When people are trying to slander it. They're blaming everyone under the sun, when the most likely vector is a store employee who simply plugged the device into a computer and copied the file to the flash drive.
Enough said.
Queue the parade of iPhone drummers.
BTW, I wonder if this is one of the patents Apple is suing over
iPhone users still waiting on the port, but Android does.
Since this appears to be a lone incident, it’s obvious that it didn’t come “straight” from the manufacturer, and it might not even be their fault.
Then again... if a lot more of these infected phones start turning up, there probably is an infected computer somewhere at the manufacturer and the phones are being plugged into it in the process of setting them up.
First order of importance, of course, is to send somebody to the end of the assembly line and start checking random phones right before they’re boxed.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
You know, I find it amazing. China continues to load this spy bots on goods destined for the west. Yet, SO many westerners continue to buy it. Here is a thought. QUIT BUYING IT, or SUE THEM. If you start suing the company for infecting your window systems, then companies will quit producing in China OR they will start caring about SECURITY.
I prefer the "u" in honour as it seems to be missing these days.
As a long-term customer of vodafone I never experienced or even expected this level of incompetence from them before. I also bought a HTC Magic from them and feel like suing them right now.
Windows malware preinstalled on a Linux device?
Is it WINE-compatible, and can WINE even be installed on Android phones?
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Windows for phones is malware?
What can these Malware possibly do to my phone?
Hotel,Resort,Accommodation, Package Tour
So, is THIS what Apple was suing HTC over at the International Trade Commission? Does Apple have a patent on preloaded malware on smartphones?
Learning HOW to think is more important than learning WHAT to think.
Following the linked article, and following that to the original post, we find that first off, it's a single phone, not more than one that had this malware, and we are informed of the software that detected this, coincidentally the commercial product the researchers are working on:
I'm rushing out today to buy this software that can do such feats as detecting this malware. They have a Linux version, right?
I agree it has nothing to do with Android, but that case had most certainly something to do with Apple. They use those crappy manufacturing facilities to save a few bucks and then save even more by not doing proper QA.
And before you claim how innocent and harmless this is, consider what is happening to Toyota. Or the numerous quality issues with products from China and god knows how many more places. In order to maximize profits (because you can't claim cost savings are passed onto to the consumer with Apple products) they cut corners everywhere and sooner or later something has to give.
And long after guy who got the bonus for cutting costs has left, the shit starts to happen. Toyota used to be the largest and fast growing, with the economy not affecting it nearly as much as the other car makers. Now it can't shift its cars. And the money for huge cash injections has already been spent. This might end up hurting Toyota, and for what? A few cents more to the stock holders.
It will be interesting to find out how this phone got its extra payload, but ultimately the story will be, lack of quality control. And someday your life may depend on cut rate QA.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Dont go the way of kdawson, soulskill.
Next we'll be reading stuff like "My best friend's sister's boyfriend's brother's girlfriend heard from this guy who knows this kid who's going with the girl who saw Ferris pass out at 31 Flavors last night. I guess it's pretty serious. He might have Mariposa, or Confiker or something. Better get Ferris some AntiVirus software from PandaAV"
meep
Excellent point. Do you think anyone will pay attention to common sense though? Let's see how many they shipped and how many had the same little package installed. This should be relatively easy to trace.
I'm always torn on these sorts of things. I agree with the idea of adding a grain of salt to these sorts of things. But at the same time, it gives us all a chance to weigh in and/or be exposed to stories that might make the rounds through other channels (I know, I know, "Other-news-aggregation-site had it first"). And while I sometimes tire of the noise, I also tend to find it more useful to be forearmed when said noise makes it in to some meeting or discussion and I don't feel broadsided by it.
When was the last time you saw a Blackberry, Palm, Nokia, LG, Windows Mobile, or iPhone distributed with Malware from the store?
It has happened before. And on a much bigger and worst scale.
Today's situation is only about 1 single infected phone (Did it got plugged into an infected machine at the store ? Was it deliberate by one employee ?)
On /. we already did have stories of virus pre-loaded Apple iPods and and McDonalds MP3 players.
They got windows machine infected which were used a part of their standard QA/Test procedure to test the hardware before shipping it.
Thus *whole batches* of product got infected from that windows testing machine.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
That's a really bad headline.
The story says ONE phone had an infected MEMORY CARD.
That's not even close to the implications made by the story's headline wording.
Shame on you, /. editors.
The virus itself was on the SD card. Anyone who uses android know that the storage an unhacked Android device connects to your PC is the SD card (Samba mounts /SDCARD/ this cannot be modified without rooting your phone). The virus is not the responsibility of HTC or Vodafone unless HTC or Vodafone but the person who put the software on the SD card. Seeing as this only seems to affect Vodafone Magic's I think Voda should be singled out, not HTC and this is probably just an 3rd world nation factory worker using an infected PC to create the master image.
Calling someone a "hater" only means you can not rationally rebut their argument.