US government-funded phones come pre-installed with unremovable malware

https://blog.malwarebytes.com/android/2020/01/united-states-government-funded-phones-come-pre-installed-with-unremovable-malware/

by ajay-d • 7 years ago

117 36 7 years ago

blog.malwarebytes.com

samstave• 7 years ago

One can take the sim and install it any phone you like though...

cyberbanjo• 7 years ago

Recommended imo

jdsully2• 7 years ago

If the government is giving you a free phone, I'd hope its because you couldn't otherwise afford one.

https://www.fcc.gov/general/lifeline-program-low-income-cons...

function_seven• 7 years ago

With a hand-me-down phone from a friend, the device is still free, and you're getting the subsidy on the monthly service charges.

SlowRobotAhead• 7 years ago

The only difference between the two codes are their variable names. The more discernible variant of this malware uses Chinese characters for variable names. Therefore, we can assume the origin of this malware is China.

I mean... that’s possible and not an unlikely scenario - I guess. But it’s hardly anything but an anecdote. If I was a Russian or American hacker, I would have Chinese variable names swapped out with mine before I released the code.

whitecream• 7 years ago

For what it's worth, if the image they used is representative of the other variable names they found, then that line of reasoning doesn't make sense - the names are just gibberish characters in Chinese, and some even have random radicals and other characters thrown in. This seems more like the type of strings you get when you take a bunch of random valid UCS-2 code points.

jtl999• 7 years ago

Pretty sure I've seen Chinese or other "strange" characters as an artifact of certain code obfuscation in the past.

perl4ever2• 7 years ago

I had an issue on my Windows computer with some UTF-something text displaying as Chinese characters a while back...

herpderperator• 7 years ago

The article shows how to uninstall it. How does that make it unremovable? The uninstall procedure is fully stock, just a slightly different path than most are used to. Most people hold the icon and drag it to the uninstall text. This goes into the app's info screen from where you can click uninstall.

darkkindness• 7 years ago

The article definitely a little confusing. It starts with an edit that gives new info about how to remove "Android/Trojan.HiddenAds.WRACT" which is auto-installed by the Settings app replacement they call "Android/Trojan.Dropper.Agent.UMX" preinstalled on the phone.

But uninstall the Settings app, and you just made yourself a pricey paper weight.

staplers• 7 years ago

Chinese malware on a Chinese phone given to US citizens at a massive discount..

Sounds like a brilliant cyber-espionage tactic.

Someone12342• 7 years ago

What intelligence would be gained from the poorest 10% of the US? I'd imagine it is more useful to marketers than actual intelligence agencies (which is in fact who is doing it).

These seem like imaginings based on too little thought and too much paranoia. But whenever "China" comes up, even if it is just a company located there, we get these exact same popular statements without justification.

gregoryl• 7 years ago

Those people can vote.

ARandomerDude• 7 years ago

The scenarios are obvious and virtually limitless. For example:

This low-income person drives to Langley, VA every night at 11pm. He might be a janitor at the CIA. We already know he's poor because he has this phone. Can we find out more and potentially bribe him to leave this ordinary-looking pen in a conference room?

stygiansonic• 7 years ago

If the devices have Bluetooth or similar, couldn’t they function as some distributed monitoring network for other Bluetooth devices, building a database over time of devices?

Maybe I’m just being paranoid.

oefrha• 7 years ago

The only evidence to classify this as “Chinese malware” (unless I missed something) is this:

The more discernible variant of this malware uses Chinese characters for variable names. Therefore, we can assume the origin of this malware is China.

But the screenshot showing “Chinese characters for variable names” clearly displays gibberish; some of those “characters” aren’t even valid characters. Anyone who can read some Chinese can confirm this. Therefore, it’s more likely an obfuscation technique designed to trick people who don’t bother to verify anything and quickly jump to conclusions.

Edit: Or just an obfuscating technique that replaces variable names with random code points. Otherwise non-gibberish would be used, presumably.

jupp0r3• 7 years ago

Most corporate issued phones and computers come with lots of pre installed malware too. Apple bakes this into MacOS too (MDM).

AmericanChopper2• 7 years ago

A computer program knowingly installed by the owner of the device, functioning to the expected specifications of the owner of the device, is just called software.

jupp0r3• 7 years ago

For me, whether it respects users privacy is where I’d draw the line, but I see your point.

Ericson2314• 7 years ago

They should buy pine phones!

kbumsik• 7 years ago

I'm not American but what are "United States government-funded phones" for? Why anyone wants to use it? The article doesn't give much context...

tmpz22• 7 years ago

In California there’s at least one major program which straight up gives phones to the homesless. I imagine it could also be fore low income households.

chillax• 7 years ago

https://en.m.wikipedia.org/wiki/Lifeline_(FCC_program)

liopleurodon• 7 years ago

Obama phone

NewsAware• 7 years ago

Reagan phone rather

ryanlol2• 7 years ago

Am I just super jet lagged, or does Malwarebytes seem to avoid talking about what this “malware” actually does?

Is it just click fraud like the malware names suggest? That would hardly hurt the users.

Some might even think that click fraud fucking over online advertising platforms is a good thing...

post_below2• 7 years ago

Click fraud doesn't fuck over online advertising platforms, if it goes undetected it fucks over advertisers who use the platform. If it's detected, no one pays for it.

ryanlol2• 7 years ago

Click fraud doesn't fuck over online advertising platforms, if it goes undetected it fucks over advertisers who use the platform.

Sounds like the same thing to me!

hoppla• 7 years ago

But, what does the malware do?

dang• 7 years ago

https://news.ycombinator.com/item?id=22015231

US government-funded phones come pre-installed with unremovable malware

Related Stories