Slashdot Mirror
Second Chinese Firm In a Week Found Hiding a Backdoor In Android Firmware (bleepingcomputer.com)
An anonymous reader quotes Bleeping Computer:
Security researchers have discovered that third-party firmware included with over 2.8 million low-end Android smartphones allows attackers to compromise Over-the-Air (OTA) update operations and execute commands on the target's phone with root privileges.
This is the second issue of its kind that came to light this week after researchers from Kryptowire discovered a similar secret backdoor in the firmware of Chinese firm Shanghai Adups Technology Co. Ltd.. This time around, the problem affected Android firmware created by another Chinese company named Ragentek Group.
It apparently affects more than 55 low-end/burner phones from BLU, Infinix Mobility, DOOGEE, LEAGOO, IKU Mobile, Beeline, and XOLO. According to the article, the binary performing the insecure updates "also includes code to hide its presence from the Android OS, along with two other binaries and their processes... Without SSL protection, this OTA system is an open backdoor for anyone looking to take control of it." Even worse, three domains were hard-coded into the binaries, two of which were unregistered, according to the researchers. "If an adversary had noticed this, and registered these two domains, they would've instantly had access to perform arbitrary attacks on almost 3,000,000 devices without the need to perform a Man-in-the-Middle attack."
It apparently affects more than 55 low-end/burner phones from BLU, Infinix Mobility, DOOGEE, LEAGOO, IKU Mobile, Beeline, and XOLO. According to the article, the binary performing the insecure updates "also includes code to hide its presence from the Android OS, along with two other binaries and their processes... Without SSL protection, this OTA system is an open backdoor for anyone looking to take control of it." Even worse, three domains were hard-coded into the binaries, two of which were unregistered, according to the researchers. "If an adversary had noticed this, and registered these two domains, they would've instantly had access to perform arbitrary attacks on almost 3,000,000 devices without the need to perform a Man-in-the-Middle attack."
... many eyes would better catch the most blatant attempts at such shenanigans.
iPhone users experience a different sort of "backdooring". Now put your man bag down and taste my latte.
It's in all of them. If it hasn't been found in your Android, it just hasn't been found - yet.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
We just have to avoid all phones built in China.
Oh, wait...
I just checked for this binary, and it was not on my phone. I did have a binary file called debuggerd but it was not the same as debugs.
1) "By determining that it utilized Rui Maciel’s JSON library, it was straightforward to reverse the expected data structure of the server response. As shown below:"
... "Wait... I could run a remote command to fix the problem and make it a non-issue".
What the hell did this have to do with anything... it forced me to hate reading the entire rest of the article. I mean it was like reading "It's a UNIX machine, I know this!" If this sentence has any meaning what-so-ever to the author other than to show off that he could identify linked libraries... well never mind... not worth writing a book on it here.
2) It's an oob updater
It's very likely that if the intent of this code was to be malicious, it would have been hidden better. From what I can see, it looks like they were trying to keep the software installed and operating even through shutting down most of android and bringing it back up.
By using a fixed process id, it makes it easier to identify numerically and by removing the code which appears to be clearly marked as debugging code from the process output, it might even be possible that the process will survive cycling through run levels. It's also clear that it should allow the external server to bring the phone back up.
3) Likely a development tool more than an updater.
It is very likely that the developer who was making the firmware base image made a series of tools that would allow pushing and testing a lot of changes remotely. It feels like a "poor man's version" of RSH on top of a REST API.
4) Six month timer?
In other words, it probably just means "go to sleep... I'm done". Indefinite is more appropriate for production code.
If they were really trying to hide something, do you think they would have made it so obvious?
This was just the case of a programmer dropping his/her image building and debugging code into the production image. He/she was probably also asked to add some possibility to update the firmware of the image remotely for tech support reasons. He/she probably just figured "I already have something".
At the end of the article I take this away
DANGER!!!! Some developer left highly insecure debugging code in the firmware used on a gazillion phones.
DANGER!!!!!!! There's some publicity loving series of security losers trying to make headlines and sound important trying to scare everyone when in reality, they no have their own backdoor to a gazillion phones and didn't even consider
Yes... instead of trying to make headlines and run a fund raiser, you didn't even need to actually tell us about it, you could have just simply pushed a patch that any phone connecting to one of those URLs would be patched.
Will the companies be fined? If not, they won't change anything.
In a better universe where ponies grow on trees the companies would get class action sued...
Also, no one would picnic under trees...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
I still have my Nokia N900, real keyboard, battery lasts days, too old and obscure to be target platform.
Security through obscurity ???
Damn right. Why have a Chinese backdoor when you can have an American backdoor instead?
The iPhone is not American. It's designed by Indian rental employees and manufactured by Chinese slaves.
lucm, indeed.
Also, no one would picnic under trees...
I'm quite averse enough to arboreal detritus to avoid this already, but yeah.
Someone had to do it.
Same here, my N900 still works great and I will keep using it until it dies, my carrier makes a change that means I cant use it anymore or I can somehow afford something better (which basically at this point means a Neo900)
i'm sure they're (whoever they are) are going to love the data they retrieve from the people who use low-end phones ;-)
You can modify an iPhone all you want, you just void the warranty.
Apple isn't the first company nor will it be the last to void warranty for opening a device up and messing with it.
"Well kids, you tried your best, and you failed. The lesson is, never try." -Homer Simpson
Wait; we have burner smartphones now? When did this happen? 1) Buy burner 2) Deal !@#$ 3) Toss burner 4) Profit!
What, you can't afford a more recent iPhone?
Wait until you find out that some of us are still using 5+ year old smart phones. Mine works(everywhere), does what it needs to, and I see no reason to upgrade. If I could have gotten away with a simple dumb cell phone I would have, but they sell them quick and usually only with limited stock numbers.
Om, nomnomnom...
I was warned here that ES File was probably phoning home to China, so I removed it and my devices actually work better now. Is there any analysis of precisely what ES File Explorer is doing?
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
The 5s is 3 years "old", and still work fine after 3 years if you take care of it a little. Same for a 3 year old high end Android phone, I suspect. If you buy cheap rubbish however, you do need to replace it a lot sooner.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
They don't have it for the OS itself, but there are firmware components for OEM-specific software that receives OTA updates.
The iPhone is not American. It's designed by Indian rental employees and manufactured by Chinese slaves.
And the profits go to an Irish company.
...and there in a nutshell we have capitalism at work. Now stop bitching about it and get over it. The system is working as intended.
Yeap, let's hail the privacy hero, Microsoft!
Yup. Motorola Razor flip phone. Gotta love it.
okay so they are simple back three versions things that can't do 80% of the things current phones can but if you are in the US i would bet that 80% of the PONFA folks have smart phones now.
Sometimes I've got a feeling that Google actively encourages security vulnerabilities considering that this particular local ROOT vulnerability affects at least 99% of all existing Android devices and Google skipped it in its latest security update.
Welcome rootkits and unremovable trojans.
I wonder if this is the work of the Chinese intelligence agencies? That would almost certainly be everyone's explanation if it happened in a phone from a US company.
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
Glad I have a BLU windows phone... phew...
But on the actual topic: is it possible that said "uneregistered domains" in the binaries are there as a convenience for dns-spoof exploits? I.e. if they resolve, the phone software knows the mitm state is active?
That's not a bad end run for activation...
You have the right to remain sentient. If you give up the right to remain sentient, you will be elected to public office
Funny, it explicitly says in listing "GIGABYTE - PC Components - - Legacy - GC-RAMDISK"
That's the iram. I own two. It is exactly both an HDD and software RAMDISK.
Who's the sockpuppet, here?
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Deep in the bowel of Fort Meade, some Deputy Director of the NSA is saying "God Damn those fucking Chinese, who told them to put an extra backdoor into those cheap-assed burner phone? We paid for exclusivity!"
Apocalypse Cancelled, Sorry, No Ticket Refunds
APK,
do you know what all those arguments you're having with other people have in common? You.
I did a quick search and it appears that more than 80% of what you post is a reply to other people where you call them liars and sockpuppet - and you frequently post in the wrong threads. That makes you a net negative for this community.
Why do you spend so much time and energy spamming the forum with your bitter, confused accusations? Are you one of those people who thrive on misery and anger?
You're not a victim, APK. You're a nuisance.
lucm, indeed.
Now it would be stereotyping to direct the cheat intention at the Chinese... but the numerous occassions related to them is undeniable. First Lenovo, then other smaller fishes...
My propossal to this problem is: To ban the brands indefinitely from the US and to permanently bar all executives at those companies from entering the US. This way, they learn their lesson... corporations stealilng from consumers is a crime that should not go unpunished. Phucking cheaters!!!