Slashdot Mirror
Manufacturer's Backdoor Found On Popular Chinese Android Smartphone
Trailrunner7 writes that researchers at Palo Alto Networks have found a backdoor in Android devices sold by Coolpad. "A popular Android smartphone sold primarily in China and Taiwan but also available worldwide, contains a backdoor from the manufacturer that is being used to push pop-up advertisements and install apps without users' consent. The Coolpad devices, however, are ripe for much more malicious abuse, researchers at Palo Alto Networks said today, especially after the discovery of a vulnerability in the backend management interface that exposed the backdoor's control system. Ryan Olson, intelligence director at Palo Alto, said the CoolReaper backdoor not only connects to a number of command and control servers, but is also capable of downloading, installing and activating any Android application without the user's permission. It also sends phony over-the-air updates to devices that instead install applications without notifying the user. The backdoor can also be used to dial phone numbers, send SMS and MMS messages, and upload device and usage information to Coolpad."
... get what you pay for
Just.Saying.
Its just lies and propaganda, there is no backdoor in Coolpads.
[sent from my Coolpad]
Pretty sure that both the iOS and Android systems can do this out of the box, they just have chosen not to. There's also the old Kindle deleting 1984 incident.
I though they were describing Google Play Services, which I understand call do all of those things. Except obivously, that Google is not evil..
It's repulsive the sort of tactics that commie chinamen will stoop to, putting backdoors into their products like that. Why, here in America, those are 'features' that you consent to by opening the package, as documented on page 46 of the EULA, as interpreted in mandatory binding arbitration by the company's legal team! It must suck to live in such a benighted, unfree, country, where your cellphone is probably spying on you and may well come preloaded with malware...
Tester (591)
Wow, don't see those very often. Good to see old-timers still around.
So, which do you prefer, Intellivision or ColecoVision? :)
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Apple can disable software remotely for security reasons but iOS itself cannot install software without asking the user.
Unless Apple disables the software that prevents iOS from installing software without the user. This function would only be used for security reasons of course.
This feature has to be very well hidden though, since nobody found it yet even on jailbroken devices.
But apart from that: All this "I'm pretty sure that x can do y too" is just tiring. I can't even fathom how the world must look to someone who always comes up with that and nothing else. ANY argument that explains everything just explains nothing. It's very much like religion, in which "God" is the ultimate answer to all questions. Like blind faith blind distrust is the ultimate intellectual capitulation.
Asking for evidence and weighting the implications makes you able to deal with the world, just assuming things and doing a lot handwaving does the exact opposite to you. Since there is no total security details matter. A lot.
I had my "obvious/subtle/totally-deadpan" posting filter set too far to the "deadpan" end of things. To anyone who mis-took me for a conspiracy theorist, I apologize for being too deadpan.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Unlike some other countries where it is a top secret, the one who opened it is among the most wanted..
Harumph! Harumph! (I didn't get a Harumph from that guy.....Harumph!)
Verizon and AT&T laugh at your puny "backdoor" and limited scope of abuse available through it.
Why, they opened up their ENTIRE NETWORK to the NSA/CIA/DIA/FBI/any local podunk sheriffs office.
USA! USA! USA!
We are STILL Number One!
More like UnCoolpad.
that no one will care and people will continue to buy their products? They might be right, and if so it's a bigger slam on the market than it is on the company. Makes you wonder if the executives actually coolly weighed the risk of discovery vs potential profits.
Devices now own us. I miss the days when I had control over my devices.
From RealVNC press release:
"27th February 2012: RealVNC’s remote access technology has been integrated in Sony Mobile Communication’s Android based Xperia smartphones, enabling them to connect to vehicle infotainment systems so that drivers can access their smartphone applications safely from the dashboard display. The technology can also be used in customer support services by helpdesk agents to provide better support to Xperia users."
is merely that the back-doors in American products are much more well-hidden - but they are still there.
How is this different than the Uber app AT&T just installed on my phone as part of a software update?
News at 11!
Windows 2000 - from the guys who brought us edlin
Buy your Android devices directly from the Google play store.
Anything cheaper will come with pre-loaded malware that will complicate everything and steal from you.
But if you buy pure android devices directly from Google, you *only* have to deal with Google's evil, and not the additional evil of the manufacturer.
And the additional evil will always be worse. Google, though evil, has direct incentives to keep its devices secure. The tracking data they get on you is more valuable to them if only they have it. Your perception of the security of their devices is also more valuable to them than what they could gain by installing backdoors.
For example, a while back a Motorola device came with a Motorola-hacked-out version of Android that sent back to Motorola *everything* you put on your phone (your passwords, your pics, all of it), and did this over UNENCRYPTED HTTP. Google would never do that, because they don't profit from your passwords, they get all your valuable pictures anyway (and they don't profit from your nekkid selifies), and they don't want the stolen data to be available for re-steal (hence no unencrypted http channel).
So, go with the lesser evil, or get double-screwed.
I don't remember the last time I saw so many members of the 3-digit club in one not-too-long (yet) sub-thread, but it was probably in Bush the 43rd's first term.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Anything Android is SPYWARE and MALWARE (by design) with a backdoor built by Google.
The Neo900 looks even more attractive.
... by updating Play Store itself without any confirmation
where the hell is your Youtube video of this incredible Sony hack, North Korea.....
This is why you don't buy shady things from China directly. There's a reason why coolpad's products aren't on the US export list.