Experts warn that cheap Android phones ship with malware embedded, so be on your guard
- Budget Android phones ship with firmware-level malware preinstalled before reaching customers
- Malware generated revenue from fraudulent advertising and turned infected devices into residential proxies
- Victims spanned 150 countries and cleanup often required firmware-level remediation.
Imagine purchasing a new, sealed Android phone and then realizing that it comes with pre-installed malware deeply embedded in the firmware and therefore almost impossible to remove, generating fraudulent ad clicks for a malicious third party and even turning the phones into residential proxies to be used for any sinister purpose.
Bitdefender security researchers discovered that an unidentified threat actor managed to compromise the supply chain of several smartphone manufacturers and added firmware-level malware before the devices were even shipped to stores.
Several brands were mentioned, including Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG
Latest videos ofTechnologyRadar
Reports also mention fraudulent devices posing as Samsung and Apple products. These are generally devices using MediaTek chipsets, which were infected in a way that allowed attackers to manipulate applications, grant themselves increased privileges, and even conduct remote code execution (RCE) attacks without the victim’s knowledge.
Victims around the world
Unfortunately, these devices were shipped all over the world, and Bitdefender claims that “thousands” of people were victims, spread across about 150 countries around the world, with the highest concentration in Mexico, France, Italy, the United States, Germany, Brazil, and Spain.
Malware comes in different shapes and sizes. So far, Bitdefender has discovered 32 malicious apps, including those pretending to be weather apps, file management app blockers, OCR tools, and audio editors. They all do the same thing: create an invisible overlay on top of different apps and record the viewing of an ad, even though the user never saw it.
That way, whoever installed the malware tricks the ad network into believing that the ad was shown to thousands of users, which, in turn, generates profits. We don’t know exactly how many devices are compromised this way, or how much money the criminals stole this way.
“The system app itself does not record fraudulent impressions and clicks,” Bitdefender said. “The revenue engine is driven by dropped cover apps, including real-looking weather apps, app lock, notes, and OCR, which load genuine ads through a legitimate ad SDK. The goal is simple: load an invisible window on top of the apps that records which ads are displayed.”
Coming to Play Store
Bitdefender also said that one of the discovered apps (the app locker one) contained a TCP proxy element that registered compromised phones with a remote command server. After successful registration, the attackers were able to forward traffic through the phone, essentially creating a residential proxy service that criminals can use for different things, from launching DDoS attacks to engaging in spam and phishing.
They also found more than a dozen apps on the Google Play Store with the same fraudulent ad code, as well as the same communications infrastructure. These, however, required manual installation and required users to grant them the requested permissions, which could have raised alerts among users.
Removing malware is not as easy as simply uninstalling the application. Researchers said many of the devices require a firmware-level wipe or disabling the malicious component using Android Debug Bridge (ADB), which could be too technical for many victims.
The simplest and most elegant solution is also more expensive: do not buy devices from brands with bad reputations.
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment