Slashdot Mirror
Malware Found Preinstalled On 38 Android Phones Used By 2 Companies (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: An assortment of malware was found on 38 Android devices belonging to two unidentified companies. This is according to a blog post published Friday by Check Point Software Technologies, maker of a mobile threat prevention app. The malicious apps weren't part of the official ROM firmware supplied by the phone manufacturers but were added later somewhere along the supply chain. In six of the cases, the malware was installed to the ROM using system privileges, a technique that requires the firmware to be completely reinstalled for the phone to be disinfected. Most of the malicious apps were info stealers and programs that displayed ads on the phones. One malicious ad-display app, dubbed "Loki," gains powerful system privileges on the devices it infects. Another app was a mobile ransomware title known as "Slocker," which uses Tor to conceal the identity of its operators. Check Point didn't disclose the names of the companies that owned the infected phones. Padon said it's not clear if the two companies were specifically targeted or if the infections were part of a broader, more opportunistic campaign. The presence of ransomware and other easy-to-detect malware seems to suggest the latter. Check Point also doesn't know where the infected phones were obtained. One of the affected parties was a "large telecommunications company" and the other was a "multinational technology company."
this is exactly why I *only* buy android products supported by LineageOS, and often I don't bother with gapps too...
There's no reason why Checkpoint software would know the supply chain history of devices their software protects. They wouldn't know if the phones were fresh from the supplier, or their software had been installed later onto devices already in use. 38 devices does not sound like a lot either.
IMHO, given the current fake news president, they should name the companies and put some plausible details around their claim.
Then most likely it's yet another case of three-letter agencies doing it. They're not exactly fond of things that remove their rootkits after all.
I realize the extra physical exertion of a "swipe" versus a "tap" is just too much work for some, but at least I know my credit card doesn't come with malware preinstalled.
I thought all Android phones had spyware pre-installed by Google.
Buying devices, opening them up and altering them, then returning to store has been popular for decades. Is called 'pre-p0wnd'.
while putting in adverts and collecting user browsing habbits is technically malware, it's far less worse than the NSA or CIA literally controlling your phone or device for malicious purposes, which could potentially be to frame you or otherwise hurt you.
My MetroPCS ZTE ZMAX Pro came with Lookout preinstalled and it has been a pretty good app. I'm hoping that I won't pick up a piece of malware but Android and iOS are moving targets. It's not a matter of if, it's a matter of when.
"We won't name the companies or devices"... because this is a FUD driven ad campaign for our services.
So obvious.
???
This is getting old.
I don't care if it's old, I just want want something that handle simple daily tasks and doesn't have 500 backdoors and 5000 agencies/hackers spying on it.
I'd think it'd be nice to know what companies and models it pertains to. A lot of people trust their phones for things like banking. I don't but I'm a little paranoid about money.
just watching the data gping through the Wifi router suggests how bad a Android is and something has been crashing my Noroot Firewall apk that I wonder what goes through.
It has been suggested that CIA installs backdoors it plausibly denies as owning simply because they lease backdoors just like how computer owners lease Microsoft Windows.
A prior article about CIA installing backdoors into OpenBSD also had a reference to a security firm Kryptos Logic that sells exploits worldwide to anyone with money.
I really tired of reading this stuff. Since the PHONE companies are not named I see this as fake, a way to sell a product.
Alternatively, "the presence of ransomware and other easy-to-detect malware seems to suggest" an attempt to obscure the purpose and origins of the infection.
Ulefones was found to have malware in the official stock rom in 9/2016, including the official downloadeble updates, and "only" took them 2 months to remove it. :/
But for sub $100 phones with all these feature where can you expect they are cutting corners.
A total non story, some company somewhere bought Android phones from some other company ...
It's called eating you own dog food isn't it?
When I try to uninstall Uber, I'm warned that since it's part of the core system I may lose stability if I uninstall it. What BS is that?