Such as we mentioned yesterday, researchers security από την Kryptowire ανακάλυψαν ένα backdoor στο firmware πολλών smartphones Android που πωλούνται στις USA. The backdoor secretly collects information from mobile owners and sends it to a server in China.
According to Kryptowire, the server belongs to a company called Shanghai Adups Technology Co. Ltd, η οποία κατασκευάζει και πωλεί ένα σύστημα ενημέρωσης λογισμικού FOTA (Firmware Over The Air) που χρησιμοποιείται από πολλούς κατασκευαστές στις συσκευές τους.
This malicious update system for Android devices, FOTA behaves just like any backdoor trojan. It communicates with the server of the Chinese company asking for instructions and with base commands received, it can perform multiple functions, described below:
- Collect and send SMS text messages to the Chinese server every 72 hours
- It collects and sends call log information to the Chinese server every 72 hours
- Collects and sends the user personally identifiable information to the Chinese server every 24 hours
- Collects and sends IMSI and IMEI on the phone
- Collects and sends geo-location information
- Collects and sends a list of applications installed on the user's device
- It downloads and installs applications without the user's consent or knowledge
- Updates or deletes applications
- Updates the phone firmware and reprograms the device
- It performs remote commands with increased management rights on the user's device
How can you protect yourself:
Check your device (you'll need root privileges) and look for the following two system apps:
com.adups.fota.sysoper com.adups.fota
If you find the packages you can delete them using an application that allows deleting system packages. One of them is System App Remover by Jumobile.
Adups reports on her website that her firmware is running over 700 million Android devices. The company does not clear whether all these devices run the FOTA update system.
We thank our friend Stavros Anagnostopoulos for the information he gave us.
Update: Removing the above packages will disable control over software updates. Proceed only if you are not interested.
