Google Sold Android Phones With Hidden Insecure Feature, Companies Find

Google's master software for some Android phones includes a hidden feature that is insecure and could be activated to allow remote control or spying on users, according to a security company that found it inside phones at a U.S. intelligence contractor. From a report: The feature appears intended to give employees at stores selling Pixel phones and other models deep access to the devices so they can demonstrate how they work, according to researchers at iVerify who shared their findings with The Washington Post. The discovery and Google's lack of explanation alarmed the intelligence contractor, data analysis platform vendor Palantir Technologies, to the extent that it has stopped issuing Android phones to employees, Palantir told The Post.

"Mobile security is a very real concern for us, given where we're operating and who we're serving," Palantir Chief Information Security Officer Dane Stuckey said. "This was very deleterious of trust, to have third-party, unvetted insecure software on it. We have no idea how it got there, so we made the decision to effectively ban Androids internally." The security company said it contacted Google about its findings more than 90 days ago and that the tech giant has not indicated whether it would remove or fix the application. On Wednesday night, Google told The Post that it would issue an update to remove the application. "Out of an abundance of precaution, we will be removing this from all supported in-market Pixel devices with an upcoming Pixel software update," said company spokesperson Ed Fernandez. He said distributors of other Android phones would also be notified.

Google sells spyware? You don't say!

[Rosco P. Coltrane]

I'm utterly shocked. My illusion are shattered...

Re:

[Tablizer]

Now nail them via Sueware!

Re: Google sells spyware? You don't say!

[TuballoyThunder]

It is not spyware--it is freedom. You freely chose to use a product that pimps you out to ABC's customers, the advertisers.

Pot calling Kettle...

[david.emery]

Listening to Palantir complain about spyware installed on Android does have a certain "pot calling the kettle black" sense to it.

Re:

[srg33]

Yes. How about "It takes one to know one"?

Re:

[haruchai]

Listening to Palantir complain about spyware installed on Android does have a certain "pot calling the kettle black" sense to it.

Peter Thiel doesn't like having his secrets exposed

Re:

[Darinbob]

Mostly complaining because they thought they had an exclusivity contract for spying.

Re:

[bill_mcgonigle]

Didn't they dump iPhone too after the GPU hardware backdoor was disclosed?

Pine64 ftw?

Re:

[thegarbz]

I'm more curious about their statement of "unvetted insecure software". Are they saying they've had access to and gone through all of Android's code base? If not, are they saying they implicitly trust Google for some software but not for others?

This entire story reeks of virtue signalling.

Re:

[omnichad]

It's easy to say it's unsecure. It connects to a remote server for provisioning/instructions. And it does that over HTTP, so it's vulnerable to MITM attacks.

Re: Pot calling Kettle...

[paul_engr]

Having pre-exploited units eats into their bottom line

Re:

[david.emery]

Obviously I can't mod your comment, but it's funny!

OOPS my bad: CORRECTED non-paywalled link

[SpzToid]

http://archive.today/DeMZg [archive.today] Sorry for my initial error folks.

Endless CAPTCHAs

[_merlin]

Both your links give me endless CAPTCHAs and never show the actual page.

Hidden insecure features?

[MooseTick]

Are they usually not hidden?

Another reason to try CalyxOS or LineageOS

[schwit1]

The Pixel hardware is excellent. A Googled OS can never be trusted. Same for Samsung or any phone from Verizon or ATT.

CalyxOS is not that difficult.

Re:

[Big Hairy Gorilla]

I was going to say the same thing ... Billion dollar company can't get a few techies to install Lineage or Graphene... or just create a de-googled software manifest ... like I did for my clients??

Also, GrapheneOS for Google phones is very well thought out, minimal, private, and secure, plus ultra easy to install. Actually, Graphene is probably the most secure and private phone OS you can get. I'd use it myself, but I like the Samsung hardware, and had a nice sammy thrown at me last time I renewed my contrac

Re:

[Big Hairy Gorilla]

The company doing this deep analysis is called "iVerify" .... so... Yup, they switched to Apple.
Soooo much more secure!!

https://www.theguardian.com/technology/2022/aug/18/apple-security-flaw-hack-iphone-ipad-macs
https://www.macrumors.com/2022/08/18/vpns-for-ios-are-broken-says-researcher/
https://arstechnica.com/information-technology/2022/04/a-year-after-apple-enforces-app-tracking-policy-covert-ios-tracking-remains/
https://techcrunch.com/2024/07/10/apple-alerts-iphone-users-in-98-countries-to-mercenary-spy

Fear mongering

[war4peace]

"Exploitation of this application on a user phone requires both physical access to the device and the user’s password."

Well, if you have that, then all bets are off.

Re:

[LodCrappo]

I have read a few places that it also only applies to Pixel phones sold by Verizon

Showcase.apk = Package in Question

[JakFrost]

"The application, called Showcase.apk, is normally dormant. But iVerify was able to enable it on a device in its possession, and the company believes skilled hackers could also enable it from afar. It cannot be removed from phones through the normal uninstall process."

WashingtonPost.com - Google sold Android phones with hidden insecure feature, companies find [washingtonpost.com]

The story blurb forgot to mention the actual package name from the article.

Re:

[JakFrost]

"The issue relates to a software package called "Showcase.apk" that runs at the system level and lurks invisible to users. The application was developed by the enterprise software company Smith Micro for Verizon as a mechanism for putting phones into a retail store demo mode—it is not Google software. Yet for years, it has been in each Android release for Pixel and has deep system privileges, including remote code execution and remote software installation. Even riskier, the application is designed to

Showcase.apk = com.customermobile.preload.vzw

[JakFrost]

This is the info below on my Google Pixel 6 running Android 14. It shows up as "Retail Demo Mode" with timestamp of 2008-12-31 18:00:00 and has permissions to install and delete packages along with the ability to run on start-up, in the background, and to manage tasks in the foreground and background, and ability to write secure and external storage, along with reboot and pretty much do whatever it wants.

You can check for this package yourself on your own device with the Android SDK Platform Tools using the adb.exe utility.

Android SDK Platform Tools [android.com]

1. 1.Install Android SDK Platform Tools.
2. 2. Enable Developer Mode on your phone by going to Settings -> System -> Press the Build Number section a few times, enter the PIN code.
3. 3. Go to the Settings -> System -> Developer Options and enable USB Debugging.
4. 4. Connect your phone to the USB cable to your computer.
5. 5. Answer the prompt on your phone to accept the hash key to your computer.
6. 6. Execute the command to see if your device is listed, and if not troubleshoot the USB connection: adb.exe devices -l
7. 7. Execute the command to start the shell: adb.exe shell
8. 8. Execute the command to check if the package exists: pm list packages -f -U --show-versioncode com.customermobile.preload.vzw
9. 9. Execute the command to get package details: pm dump-package com.customermobile.preload.vzw

oriole:/ $ pm list packages -f -U --show-versioncode com.customermobile.preload.vzw

package:/product/priv-app/Showcase/Showcase.apk=com.customermobile.preload.vzw versionCode:26 uid:10094

Below is the information about the package.

255|oriole:/ $ pm dump-package com.customermobile.preload.vzw

Receiver Resolver Table:
Non-Data Actions:
com.customermobile.preload.ManualStart:
66c0adf com.customermobile.preload.vzw/com.customermobile.preload.StartOnBoot filter 3d4b1f5
Action: "com.customermobile.preload.ManualStart"
android.intent.action.BOOT_COMPLETED:
66c0adf com.customermobile.preload.vzw/com.customermobile.preload.StartOnBoot filter ecac32c
Action: "android.intent.action.BOOT_COMPLETED"
Category: "android.intent.category.DEFAULT"
com.customermobile.preload.StartOnBoot:
66c0adf com.customermobile.preload.vzw/com.customermobile.preload.StartOnBoot filter 8469b8a
Action: "com.customermobile.preload.StartOnBoot"

Domain verification status:

Permissions:
Permission [com.customermobile.preload.StartOnBoot.PERMISSION] (8da7e30):
sourcePackage=com.customermobile.preload.vzw
uid=10094 gids=[] type=0 prot=signature
perm=PermissionInfo{fdcd538 com.customermobile.preload.StartOnBoot.PERMISSION}
flags=0x0

Permissions:
Permission [com.customermobile.preload.vzw.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION] (9a8aa9):
sourcePackage=com.customermobile.preload.vzw
uid=10094 gids=[] type=0 prot=signature
perm=PermissionInfo{b233a76 com.customermobile.preload.vzw.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION}
flags=0x0

Regi

Re:

[Equuleus42]

Thanks for the info. I looked into how to disable it on a stock Pixel without root privileges, and the following command appears to suspend it via adb shell:

      cmd package suspend com.customermobile.preload.vzw

I followed up with the following commands to verify it was suspended:

      dumpsys package com.customermobile.preload.vzw | grep -i "suspended"

The suspend setting seems to persist across a reboot as well.

That's a nice change of pace.

[nightflameauto]

A hidden feature that's insecure is a lot nicer than the out in the open stuff that's insecure. Thanks, Google! You're doing your part to keep the pain out of our eyes!

SSDD

[mmell]

You know, that adorable "E.T. phone home" behavior all the pay-for-players have tried to bake into their hardware and software? They don't mind your desire for privacy, but that's only because they don't care, although I will admit I'm shocked - shocked - to hear that Google would ever aspire to such low heights. Here, I thought they were better somehow because they were sticking their hands into someone else's pockets.

As it says...

[nospam007]

..Android. :-)

Three-letter agency

[NotEmmanuelGoldstein]

... intelligence contractor ...

It's a problem when other people can spy too: Sucks to be you.

... upcoming Pixel software update ...

Why would Google rent out ROM-space like a Chinese discount brand? I say Chinese but it's actually the Korean brands doing this, the most. Back to the topic, Google providing the same lack of security as their competitors, is nonsensical: Surely, they weren't thinking it's THEIR hardware, they can do whatever for an extra dollar?

Maybe a three-letter agency demanded a security-hole: You know, exactly what the USA assumes China did.