Some Low-Cost Android Phones Shipped With Malware Built In (techcrunch.com) 49
More than 100 different low-cost Android models from manufacturers such as ZTE, Archos, and myPhone ship with malware pre-installed, researchers at Avast Threat Labs reported on Thursday. Users in more than 90 countries, including the U.S., are affected by this, the researchers said. From a report: The malware, called called Cosiloon, overlays advertisements over the operating system in order to promote apps or even trick users into downloading apps. The app consists of a dropper and a payload. "The dropper is a small application with no obfuscation, located on the /system partition of affected devices. The app is completely passive, only visible to the user in the list of system applications under 'settings.' We have seen the dropper with two different names, 'CrashService' and 'ImeMess,'" wrote Avast.
The dropper then connects with a website to grab the payloads that the hackers wish to install on the phone. "The XML manifest contains information about what to download, which services to start and contains a whitelist programmed to potentially exclude specific countries and devices from infection. However, we've never seen the country whitelist used, and just a few devices were whitelisted in early versions. Currently, no countries or devices are whitelisted. The entire Cosiloon URL is hardcoded in the APK."
The dropper then connects with a website to grab the payloads that the hackers wish to install on the phone. "The XML manifest contains information about what to download, which services to start and contains a whitelist programmed to potentially exclude specific countries and devices from infection. However, we've never seen the country whitelist used, and just a few devices were whitelisted in early versions. Currently, no countries or devices are whitelisted. The entire Cosiloon URL is hardcoded in the APK."
iPhones ship with iTunes. (Score:1, Troll)
Abracadabra. I define iTunes as Malware, 100% of iPhones ship with malware.
Re: (Score:1)
But iPhones doesn't ship with iTunes.
Mac does though.
Re: (Score:2)
iPhones don’t ship with iTunes. iPhones also haven’t needed iTunes in years to do anything.
Re: (Score:2)
Wait, are you saying I can drag and drop MP3s onto an iPhone now?
Apple hasn't had any innovations that make me want to switch back from Android, but that's good to know.
reluctant fan (Score:5, Insightful)
You may get some cheap Android phone that works, but what do you give up? You don't even know till it's too late.
I don't give up anything (Score:4, Insightful)
Also Apple talks big, but they'll comply with any subpoena they get. Androids have the same levels of encryption on $200 phones. Yeah, if you go _really_ cheap you get corners cut like this, but you don't have to spend $800 (what my kid's iPhone 8 cost) just to get a modicum of security....
Re: (Score:2)
Apple fairly famously fought a subpoena recently. And while they (obviously) will comply if they were to lose the fight, they've also taken steps to minimize how much they will/can do.
..and you can't even delete it. (Score:1)
Post all the insults and angry comments you want, they're like candy to me.
Re: (Score:2)
Sure, and you can avoid car accidents by never driving a car.
Every technology comes with risks. For most of us, the benefits of smartphones far outweigh the risks of buying a smartphone that happens to be pre-installed with malware.
And that malwares name is.... (Score:1)
Google.
Far more evil than any malware.
Re: (Score:2)
I just bought a big box of recertified ZTE Trek 2s to give to my friends' kids. These are 8" tablets meant to be sold as AT&T phones, originally. Inspecting the software load via ADB does not reveal the software in question and scans from Lookout, Avast and BitDefender all come up perfectly clean.
I can absolutely believe some crappy Android devices have Malware on them but even with poorly regarded ZTE, it does not appear to be an issue with all devices. Since I don't see any signs of the malware wrapp
Re: (Score:3)
Re: (Score:2)
Inspecting the software load via ADB does not reveal the software in question
How does this prove anything if the device malware got root?
ADB is just talking to a service on the phone (that happens to be available over USB) which is serviced by software. If Malware achieved root access and can modify any software on the device, it could easily modify whatever bits are handling ADB to conveniently remove any package from the listing sent out.
If you think this is paranoid, read about the state of the art in Windows malware. Many will modify the kernel hooks that list files/processes/so
Pro-tip: read out loud before posting (Score:2)
...called called...
speaking of Avast... (Score:1)
Vs. Carrier Apps (Score:2)
In that case, your information goes to advertisors instead of hackers. Not sure who I would trust more.The person who wants your eyeballs, to sell you stuff and your information, to make money, or the hacker? Ha! (...who also wants to sell your information and make money.)
Re:Vs. Carrier Apps (Score:4, Interesting)
Re: (Score:2)
Those all sound bad. I recommend none of those. So don't put up with any of that shit either
Re: (Score:2)
As opposed to the whole device? Apple or Android if you don't have root and have ultimate control then the device itself is the malware. Malware is anything that works to the detriment of the owners wishes.
Re: (Score:2)
So the real security fault is the security itself and not allowing the owner of the phone to readily access and alter the core operating system files to readily remove this shit. So secure is insecure by design, root access on smart phones by the owner should be required by law.
What is the origin (Score:3)
What is the origin of the affected devices? I never heard of myPhone but Archos and ZTE are long established companies who have established reputations by offering products with, respectively, excellent multimedia capability and relatively high end specs at relatively modest price. They don't seem like the kind of no-name companies or desperate rebranding enterprisesd who would deliberately play the malware/gouging the customer game. I haven't owned an Archos phone but I did own several of their older Android devices dedicated to video and audio playback and they definitely did not load up their custom Android versions with bloatware, scamware, adware etc. In fact they did some great stuff that Google was very bad at doing at the time (think back to Eclair, Froyo, Gingerbread era) such as really slick smb and upnp browsing and playback integration into their custom file browser and multimedia apps, support for streaming flac, ogg vorbis and so on.
I just find it hard to believe that they would risk a niche position and a decent reputation like this. Absolutely anywhere in the supply chain from the factory to the retail outlet could be the weak link, it is not necessarily the brand name/designer/enterprise who commissioned the goods.
One big same (Score:3)
manufacturers such as ZTE, Archos, and myPhone
The Chinese city of Shenzhen is for all practical purposes one giant factory with different company names over different loading dock doors. But it's all the same conglomerate inside.
"manufacturers such as ZTE" (Score:2)
Crap, now they're going to have to give Trump another $500 million bribe.
To quote a fairly old Captain Picard theme... (Score:2)
I just shat myself with surprise.
Sounds like ZTE deserves to go under (Score:2)
I am in awe of just how stupid the ZTE leadership is. It's like they're having a "Hey Blackberry! Hold my beer!" moment.
Up until recently, I was basically ambivalent about ZTE. Based on the recent news I'm seeing, I now won't touch them with a 10 foot pole even if their devices were readily available.