Slashdot Mirror
Malware Found In the Firmware of 26 Low-Cost Android Models (bleepingcomputer.com)
An anonymous reader writes: Security researchers have found malware hidden in the firmware of several low-end Android smartphones and tablets, malware which is used to show ads and install unwanted apps on the devices of unsuspecting users. 26 Android device models have been found to be vulnerable. The common link between all these devices is that all are low-cost devices, mostly marketed in Russia, and which run on MediaTek chipsets.
According to security researchers from Dr.Web, a Russian antivirus vendor, the malware appears to have been added to the firmware by "dishonest outsourcers who took part in [the] creation of Android system images decided to make money on users." The security firm has informed MediaTek and the device vendors about this issue so the affected companies can inspect their distribution chain and find the possible culprits.
According to security researchers from Dr.Web, a Russian antivirus vendor, the malware appears to have been added to the firmware by "dishonest outsourcers who took part in [the] creation of Android system images decided to make money on users." The security firm has informed MediaTek and the device vendors about this issue so the affected companies can inspect their distribution chain and find the possible culprits.
These were cheaper than cheap. No well known brand such as Samsung or even cheaper brands such as Huawei, ZTE and Xiaomi.
MegaFon Login 4 LTE
Irbis TZ85
Irbis TX97
Irbis TZ43
Bravis NB85
Bravis NB105
SUPRA M72KG
SUPRA M729G
SUPRA V2N10
Pixus Touch 7.85 3G
Itell K3300
General Satellite GS700
Digma Plane 9.7 3G
Nomi C07000
Prestigio MultiPad Wize 3021 3G
Prestigio MultiPad PMT5001 3G
Optima 10.1 3G TT1040MG
Marshal ME-711
7 MID
Explay Imperium 8
Perfeo 9032_3G
Ritmix RMD-1121
Oysters T72HM 3G
Irbis tz70
Irbis tz56
Jeka JK103
It's like trying to make their chips out as a bad, unsafe product. You might as well bring up that they're made of plastic and have touch-screens, or something else irrelevant. And by definition, every Android phone has malware, given how Google basically owns all your data.
Why is Mediatek installing malware to extract and send the owner's data to China?
I just bought the latest BN Nooks as Christmas gifts. Now I have to tell EVERYONE who receives these gifts to use burner accounts, no credit cards, no sensitive gmail.
None of these companies can be trusted.
Shouldn't DT Ignite also be considered malware because it installs unwanted apps? If so, there is malware in the firmware of many US phones, too.
Only LUDDITES think that extra apps are "malware". Modern app appers know that these are simply bonus apps added to App Phones as an extra feature!
Apps!
There is no need to say "Low Cost Android Phones".... Mainly because there are no "Low Cost Apple Phones", and we already know that all "Low Cost Windows Phones" contain malware by virtue of being Windows.
I mean you can pick up a number of decent name-brand mid-range devices that can be fully unlocked for less than $30.
Google needs to get a grip on Android, somehow. They are ultimately responsible for this mess. Stop fucking around with self-driving cars and do your job.
Google needs to start working with vendors in the markets that use these lower end phones to make secure and reliable hardware. If there are a couple vendors making reliable phones for the ultra low end, with Googles official support and endorsement, it could go a long way in killing the market for these sorts of devices and win them a lot of favor in places where they might not be so highly regarded.
Who came up with that brand name?!?!
Makes no fucking sense either.
Malware mines your contact list, emails, photos, and text messages. It also tracks your location. Google mines your contact list, emails, photos, and text messages. Google also tracks your location. I don't really see a difference. Oh yeah, one of them makes you "agree" to a multi-page contract written by their legal department (300 lawyers) for their own benefit.
If you're going to insist on using proprietary closed source software, I don't want to hear you complaining.
Russian clickfarms were conspiring with cellphone network staff since prehistoric times (first heard of paid sms scams around year 2002, 2003 or so).
Now they mostly sell access on sms validation market.
For a second I read the "Android" in the headline as talking of a humanoid robot instead of the smartphone OS, and it was a really good base for a sci-fi story
This shouldn't be a surprise. I mean, it's called Landfill Android for a reason. Landfills are riddled with god-knows what diseases. These devices are simply extending the metaphor.
They were caught red handed.
DO NOT BUY EQUIPMENT WITH MEDIATEK CPUS!
Quote from OP: "The security firm has informed MediaTek and the device vendors about this issue so the affected companies can inspect their distribution chain and find the possible culprits."
How about updating the OS in these cheap phones, even the ones already sold, with an uninfected OS. Why waste time looking for the miscreants, who may be well hidden? Just fix the OS.
In a time of universal deceit, telling the truth is a revolutionary act. George Orwell
Can we start calling all the preloaded crap that isn't stock android malware?
all the shit that vendors load that spy on you all the time?
tmobile
verison
att
etc etc etc
I can't uninstall that stuff
Sorry but if you buy a crap-tacular phone you can not expect it to be even safe to turn on. These companies are known for selling flash media pre loaded with malware.
Do not look at laser with remaining good eye.
It's probably the case for generic low end devices here in Brazil too, and probably most other countries.
Bought one of those earlier this year, something like 50 bucks for a quadcore tablet that performed pretty decently.
If you try to root it, the whole thing factory resets itself after power down.
It has several suspicious stuff pre-installed into it, and they'll always be back no matter which way you try to uninstall or delete them.
Some apps are simply shovelware, but there's plenty of stuff that apparently had no purpose there.
Crapshoot. I wanted a tablet to read some comics and do some of the basics, and also to experiment on rooting and making a device secure... ended up in the trash, going for a reputable brand instead.
I would assume none of them can load apps from the Play store. Based on the now common wisdom - you're (more or less) safe if you only ever install apps from the Google Play Store, and if not, you're not ever going to get software updates, so consider yourself hacked - these things are all malware vectors from the get go. Their vendors just gave them a head start...
Posted from my Android phone. Oh, I can change this? There, that's better...
...I thought that I could trust BN. They would have been better served with a Sitara.
I just checked the new tablet and found:
/system/app/AdupsFota/AdupsFota.apk
Is this the Mediatek malware in question?