Unremovable malware found preinstalled on low-end smartphone sold in the US

https://www.zdnet.com/article/unremovable-malware-found-preinstalled-on-low-end-smartphone-sold-in-the-us/

by fortran77 • 7 years ago

146 55 7 years ago

This is very common for low-end Android phones. I have seen and used many models from different companies (eg, Micromax, Gionee) (mostly Chinese) that remotely install apps or inject ads into the OS (notifications, home screen or lock screen).

They also almost certainly are used to collect personal user data and sell it.

Another bad thing is that these apps often come installed as "system apps", so you can't uninstall or disable them, or change permissions :(

tandr• 7 years ago

https://www.xda-developers.com/uninstall-carrier-oem-bloatwa...

I have used these instructions in the past to remove things I don't need from Samsung phone.

(There is also xda threads that talking about it as well, pointing what apps could be removed)

I am not 100% sure if "cheap" phones would allow to do this though.

pmlnr• 7 years ago

I hope people remember when Kindles were possible to be bought with burned-in ads for cheaper.

Jeff_Brown2• 7 years ago

In which case the buyer knew what they were getting into, yes?

jzwinck• 7 years ago

I too hope people remember that, because it was the case one minute ago. You save $20 or so by having ads on your Kindle when it is sleeping. The ads are not burned in, they are delivered via WiFi the same as other Kindle content. I don't see the problem with it.

jabbany• 7 years ago

This. In fact this is quite common in Chinese domestic market phones too. E.g. The Vivo branded (subsidiary of BBK who is also the parent of Oppo and Oneplus) phones are generally domestic market targeted and use FuntouchOS which has arguably adware/spyware built in to the OS level. It's also impossible to flash a custom ROM as it has a locked bootloader.

cs702• 7 years ago

...and on high-end smartphones too, arguably. Consider how difficult it would be to remove from any smartphone any piece of software that you as a consumer don't want (e.g., baseband firmware, call-home components, data-collection services, etc.).

xfitm32• 7 years ago

Personally I consider this to be all phones: the baseband firmware is a blob that does who knows what, and is likely the weakest component of nearly every phone on the market. Most baseband processors are connected via DMA.

Prior discussion from 2016: https://news.ycombinator.com/item?id=10905643

mirimir5• 7 years ago

I'm reminded of the 90s joke about Windows PCs being pwned within minutes after going online. That is, going online directly via dial-up modem, rather than through a router.

So yeah, the baseband firmware is a huge vulnerability. But if you use a separate modem/router, and disable the onboard baseband, that's far less of an issue.

And with the PinePhone, it's easy: https://wiki.pine64.org/index.php/PinePhone#Killswitch_confi...

teruakohatu• 7 years ago

It was not a joke. I once saw a new WinXP install get hacked soon after being plugin into a modem.

The Register reported the avaerge time to infection was 20 minutes.

https://www.theregister.co.uk/2004/08/19/infected_in20_minut...

danielheath• 7 years ago

No iphone currently sold is connected to its modem via DMA. They've all got some type of iommu.

Given that most traffic is encrypted (eg any major website via https, or mail provider with smtp-over-tls, or most apps via https), a baseband vulnerability isn't a great deal of help without an iommu bypass (AFAIK only one has ever been publicly disclosed for ios, and it took the researchers over 6 months).

IIRC correctly (from a few years back) the pixel phones also have one, but most Samsung phones did not.

deogeo2• 7 years ago

I've found that information on which phones have a directly connected baseband is incredibly hard to come by.

butz• 7 years ago

Is it really unremovable? What about flashing custom AOSP build?

droithomme2• 7 years ago

Sure, why don't you buy these figure out how to do it then publish easy to understand instructions for the average purchaser to follow. Thanks!

kick• 7 years ago

"Requires domain knowledge" is not the same as "unremovable," so it's a valid question.

kop3162• 7 years ago

This assumes you can unlock the bootloader and make an AOSP build.

droithomme2• 7 years ago

Is this too much different than the unremovable malware found preinstalled in high-end smartphones sold in the US? Even big brands like Samsung are riddled with insidious malware these days, all which you consent to when clicking through the registration screens.

We need regulation banning all this. Will never happen since malware benefits those who crave endemic surveillance.

ggggtez2• 7 years ago

That's not "malware". Adware maybe, but malware does assume something more ... malicious. Asking for consent is annoying, but we are talking about stuff that doesn't ask for your consent.

jenkstom• 7 years ago

I bought three of these for my 8 year old triplets from twigby.com. I was really upset with twigby, but I guess they weren't the ones that did it. These phones would continuously install weird apps no matter what I did. I even had them locked down with the google family app and they still did their thing. I upgraded to to Moto G7 Plays and they are not only faster, they don't continuously install malware.

swiley• 7 years ago

I had a similar experience with a track phone I bought as a cheap balloon tracker: As soon as I put it on WiFi it pulled down maybe a gigabyte of random crap (it looked like mostly games but also “facebook” and some other things like that.) It refused to install termux until it had installed a dozen or so worthless things.

TrueDuality2• 7 years ago

A lot of the comments here are complaining about trash software that exists on other phones that isn't removable. The difference here is that it isn't just garbage ware that might have vulnerabilities like the stuff Samsung puts on its phone, this is actively malicious.

This especially sucks because the people who can't afford a good phone will pay not only in having a poorer user experience but they'll have their financial and social media information stolen as soon as its used on these devices.

That means the people who can least afford (via both time and money) to deal with identity theft will be the ones hit the hardest.

kop3162• 7 years ago

Heh, it's funny you say that. I just broke my phone and had to go get a new one. I was holding out for the PinePhone/Librem 5 to be useful enough that I wouldn't need another Android device.

The cheapest device that I trusted was the Pixel 3a, and that's because I can cleanly install GrapheneOS and not have google play install. That was $400. It was very tempting to get a $100 phone, but this was my exact worry.

dathinab• 7 years ago

The problem is that it's increasingly harder to run a non Google certified Android phone.

For example many German (EU?) Banks now have some form of 2FA system for credit card payments which requires a Android/iPhone app which does only run on non rooted certified phones. (Through it should be noted that in Germany credit card is not the major payment method and many people don't even have one, instead dbit cards with V-Pay, giropay, etc. are dominant. )

As a site note this is also the case for their online banking Apps, but you can just use their website instead.

TrueDuality2• 7 years ago

I really wish this was more than just a privacy concern. Google for all the shady, immoral, and frankly weird data collection they do on people; Google doesn't actively discriminate against classes of people with their services. They'll track a high income individual the same as a homeless one.

These low-end phones, preloaded with malware, and likely running and outdated and vulnerable version of the base OS with no hope of patches...

Having a hope of being successful in our society right now in any meaningful way requires some level of access to the internet and these bare-minimum phones are it for a lot of people. Security online is a massive social issue that we can't rely on end-user awareness to solve.

This is a supply chain attack that only hurts the worse off. You're on this site which in its own way gives you a certain baseline technical merit; You're actively are aware of the threat of these low-end phones so you don't fall into that potential trap.

The people that can't make that jump between the $100 and $400 phone shouldn't have to deal with additional ongoing personal and financial repercussions from trying to participate in our modern society.

jimmaswell• 7 years ago

There's no malware here that I can see, simply an auto-update mechanism that could theoretically be abused, like every auto-update mechanism (Chrome, Windows 10..)

JohnFen4• 7 years ago

I pretty much consider all auto-update (and telemetry, for that matter) mechanisms that I can't disable to be malware.

awinter-py• 7 years ago

the department of the interior made disabling all phone-home (including auto updates) a condition of their DJI drone buy

and cautioned that the level of testing they need to do for future updates is a large expense of the project

JohnFen4• 7 years ago

In my opinion, the prevalence of software that I consider to be malware has become so extreme that I don't consider any smartphone to be safe enough to use anymore.

Although I'm marginally OK with my current one (an antique that I have a google-free ROM and a lot of security installed on), it will probably die within the next couple of years. At or (hopefully) before that time, I'll have completed my move out of smartphones entirely.

makerofspoons• 7 years ago

The PinePhone will be launching soon, and you could install any flavor of mobile Linux you want if you are still interested in owning a smart phone: https://www.pine64.org/pinephone/

JohnFen4• 7 years ago

Yes, I've already investigated the PinePhone. I have nothing against it -- there are a great many things about it that are wonderful -- but I don't find it particularly appealing on the whole.

My escape plan is to use the dumbest feature phone I can find and also carry a pocket computer (running standard Linux) that lacks cell capability.

ggggtez2• 7 years ago

I thought malware was the business model of low-end smart phones. Random game company pays them to install their game on x000 devices. It's really a question of when, not if, those companies would ship malware. You can't imagine they are actually vetting any of that stuff they install.

w3bshark• 7 years ago

I know one of the companies who ships the software embedded with privileges which then installs the garbageware apps (designated by the carrier). The garbageware apps are definitely not vetted to my knowledge.

userbinator2• 7 years ago

Actually unremovable, i.e. unrootable and with a locked bootloader? That's pretty bad. On the other hand, when I looked into the Android community a few years ago, it was almost "common knowledge" that a lot of the cheap and unbranded ones come with preinstalled crap, but they're unlocked by default and easily rootable so you can remove it, and there's various guides on how to do that and make a custom ROM.

hpoe• 7 years ago

People keep focusing on how these Chinese phones have malware and are being used in the West but I tend to believe that is more of a nice side effect, the real purpose is for China to keep a tight leash on those inside it's borders. I mean if we think about it they have to monitor, survail and keep in check more people than the entire US and EU combined.

apta• 7 years ago

Yep, people keep buying Chinese phones without thinking. How does the government allow them to be imported?

Unremovable malware found preinstalled on low-end smartphone sold in the US

Related Stories