Slashdot Mirror
Second Chinese Firm In a Week Found Hiding a Backdoor In Android Firmware (bleepingcomputer.com)
An anonymous reader quotes Bleeping Computer:
Security researchers have discovered that third-party firmware included with over 2.8 million low-end Android smartphones allows attackers to compromise Over-the-Air (OTA) update operations and execute commands on the target's phone with root privileges.
This is the second issue of its kind that came to light this week after researchers from Kryptowire discovered a similar secret backdoor in the firmware of Chinese firm Shanghai Adups Technology Co. Ltd.. This time around, the problem affected Android firmware created by another Chinese company named Ragentek Group.
It apparently affects more than 55 low-end/burner phones from BLU, Infinix Mobility, DOOGEE, LEAGOO, IKU Mobile, Beeline, and XOLO. According to the article, the binary performing the insecure updates "also includes code to hide its presence from the Android OS, along with two other binaries and their processes... Without SSL protection, this OTA system is an open backdoor for anyone looking to take control of it." Even worse, three domains were hard-coded into the binaries, two of which were unregistered, according to the researchers. "If an adversary had noticed this, and registered these two domains, they would've instantly had access to perform arbitrary attacks on almost 3,000,000 devices without the need to perform a Man-in-the-Middle attack."
It apparently affects more than 55 low-end/burner phones from BLU, Infinix Mobility, DOOGEE, LEAGOO, IKU Mobile, Beeline, and XOLO. According to the article, the binary performing the insecure updates "also includes code to hide its presence from the Android OS, along with two other binaries and their processes... Without SSL protection, this OTA system is an open backdoor for anyone looking to take control of it." Even worse, three domains were hard-coded into the binaries, two of which were unregistered, according to the researchers. "If an adversary had noticed this, and registered these two domains, they would've instantly had access to perform arbitrary attacks on almost 3,000,000 devices without the need to perform a Man-in-the-Middle attack."
Will the companies be fined? If not, they won't change anything.
Stop the fake conspiracy bullshit. Ragenteck is a diversified manufacturing firm. http://english.ragentek.com/plus/list.php?tid=14
This seems like a non issue if this only affects phones with over the air updates. Everyone knows Android phones don't have this capability anyway.
... many eyes would better catch the most blatant attempts at such shenanigans.
iPhone users experience a different sort of "backdooring". Now put your man bag down and taste my latte.
It's in all of them. If it hasn't been found in your Android, it just hasn't been found - yet.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Not your iPhone. You are just licensing it from Apple. You can't modify it in any way without their permission. You had nothing to do with its creation. You have no reason to be smug.
Goodbye Chinese!
~~Happy Kwanzaa~~
Over/under on Chinese gov't backing this? I'm betting it's... high.
They are in their counting room, of course.
Does anyone actually believe that Google didn't know about this?
and as long as they profit, they could care less.
Google even makes Microsoft look honorable.
That's because you have a real phone.
We just have to avoid all phones built in China.
Oh, wait...
I really appreciate my Lumia phone more and more. Great OS and hardware and hardly any apps which keeps my chances of having these issues very small. 0 userbase + 0 apps = no reason for hackers to mess with me :)
I just checked for this binary, and it was not on my phone. I did have a binary file called debuggerd but it was not the same as debugs.
1) "By determining that it utilized Rui Maciel’s JSON library, it was straightforward to reverse the expected data structure of the server response. As shown below:"
... "Wait... I could run a remote command to fix the problem and make it a non-issue".
What the hell did this have to do with anything... it forced me to hate reading the entire rest of the article. I mean it was like reading "It's a UNIX machine, I know this!" If this sentence has any meaning what-so-ever to the author other than to show off that he could identify linked libraries... well never mind... not worth writing a book on it here.
2) It's an oob updater
It's very likely that if the intent of this code was to be malicious, it would have been hidden better. From what I can see, it looks like they were trying to keep the software installed and operating even through shutting down most of android and bringing it back up.
By using a fixed process id, it makes it easier to identify numerically and by removing the code which appears to be clearly marked as debugging code from the process output, it might even be possible that the process will survive cycling through run levels. It's also clear that it should allow the external server to bring the phone back up.
3) Likely a development tool more than an updater.
It is very likely that the developer who was making the firmware base image made a series of tools that would allow pushing and testing a lot of changes remotely. It feels like a "poor man's version" of RSH on top of a REST API.
4) Six month timer?
In other words, it probably just means "go to sleep... I'm done". Indefinite is more appropriate for production code.
If they were really trying to hide something, do you think they would have made it so obvious?
This was just the case of a programmer dropping his/her image building and debugging code into the production image. He/she was probably also asked to add some possibility to update the firmware of the image remotely for tech support reasons. He/she probably just figured "I already have something".
At the end of the article I take this away
DANGER!!!! Some developer left highly insecure debugging code in the firmware used on a gazillion phones.
DANGER!!!!!!! There's some publicity loving series of security losers trying to make headlines and sound important trying to scare everyone when in reality, they no have their own backdoor to a gazillion phones and didn't even consider
Yes... instead of trying to make headlines and run a fund raiser, you didn't even need to actually tell us about it, you could have just simply pushed a patch that any phone connecting to one of those URLs would be patched.
I haven't noticed this kind of problem with my iPhone 5S...
What, you can't afford a more recent iPhone?
lucm, indeed.
i'm sure they're (whoever they are) are going to love the data they retrieve from the people who use low-end phones ;-)
You can modify an iPhone all you want, you just void the warranty.
Apple isn't the first company nor will it be the last to void warranty for opening a device up and messing with it.
"Well kids, you tried your best, and you failed. The lesson is, never try." -Homer Simpson
Another Chinese piece of shit. What a shocker. Why anybody would purposefully buy any Chinese insecure, cheaply built, or toxic garbage products is beyond me. The Chinese govt also forces vendors and companies to open up their source code to do business in China. How convenient for them that these obvious backdoors "slip" through.
Wait; we have burner smartphones now? When did this happen? 1) Buy burner 2) Deal !@#$ 3) Toss burner 4) Profit!
It's called Dragon Day and it's about how the US is held hostage because China has put backdoors in all the tech we buy from them.
One of the most poorly written articles that I've ever read. I feel stupid after reading it.
The CEO of apple might disagree. Now bend over and get ready to be backdoored.
I was warned here that ES File was probably phoning home to China, so I removed it and my devices actually work better now. Is there any analysis of precisely what ES File Explorer is doing?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
okay so they are simple back three versions things that can't do 80% of the things current phones can but if you are in the US i would bet that 80% of the PONFA folks have smart phones now.
Oh yes you can. It is called jailbreak
Better that than another full 4 years of monkeys in the white house, or a couple of decrepit sexual maniacs.
enough said. those fuckers even block phone calls to my mobile.
Sometimes I've got a feeling that Google actively encourages security vulnerabilities considering that this particular local ROOT vulnerability affects at least 99% of all existing Android devices and Google skipped it in its latest security update.
Welcome rootkits and unremovable trojans.
I wonder if this is the work of the Chinese intelligence agencies? That would almost certainly be everyone's explanation if it happened in a phone from a US company.
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
I got a cheap 10 inch Android No name Chinese tablet ,about 6 months ago It had a Virus in its firmware , Detected by 4 Major Antivirus solutions, and since it was in the firmware , No way to get rid of it ,factory restore therefore restored Virus The antivirus software said, Cant be removed As infection is in a system File Unable to remove system file It served up Hundreds of ads and did hundreds of false system updates at every restart
timothy likes it in the back door from kdawson. That's why they left slashdong. To practice more gay anal sex on each other. Boom!
It's not a matter of the device being secure it's a matter of being step #1 to securing our devices. The way things are done right now is utterly terrible.
See subject lucm sockpuppet (that I've crushed before too Khyber see below) - it is a hardware card w/ 4gb RAM on it, not software ramdisk you dumb fuck (criminal & liar too).
* It is NOT placing a pagefile onto a software ramdisk (lucm's blunder, lol - or, should I say YOURS since you show up 'suddenly' to 'defend him' (if YOU are his defense? You're a KNOWN liar & scumbag, proof's below)).
APK
P.S.=> Still "stinging" loser Khyber https://tech.slashdot.org/comm... where you called my ware a "virus" stupid & I proved otherwise? Yes, obviously -
You're a KNOWN fucking liar right there!
(You are also a KNOWN loon & criminal from what I understand Mr. A. Marshall McQuown http://www.cadailysun.com/news... )... apk
That is the cornerstone of the problem with smartphones: We don't control the software, and the OS software and the modem software are often intimately connected, just as often via tightly coupled hardware as tightly coupled software. Neither of which are good for user data security. And that does not take into account signed bootloaders and OS images which disallow the end user/owner of the hardware from installing custom patched updates which may be needed to work around vendor shortcomings in updating the software for their particular device.
Trustzone and non-user servicable consumer hardware need to die painful deaths. It looks like there are many more years of government and corporate exploitation even if the sheeple decide to rebel and demand change.
then google will be required to put one there. Of course, open firmware would allow you to replace firmware you do not trust, and a PROPER lock down would let you change the firmware and lock that in no matter what the manufacturer wanted, and is 100% compatible with open source. It's only lockdowns that lock YOU, the owner of the device, out that is incompatible with openness.
it helps.
Now it would be stereotyping to direct the cheat intention at the Chinese... but the numerous occassions related to them is undeniable. First Lenovo, then other smaller fishes...
My propossal to this problem is: To ban the brands indefinitely from the US and to permanently bar all executives at those companies from entering the US. This way, they learn their lesson... corporations stealilng from consumers is a crime that should not go unpunished. Phucking cheaters!!!