Such as we mentioned yesterday, researchers ασφαλείας από την Kryptowire ανακάλυψαν ένα backdoor στο firmware πολλών smartphones Android sold in the USA. The backdoor secretly collects information from mobile owners and sends it to a server in China.
According to Kryptowire, the server belongs to a company called Shanghai Adups Technology Co. Ltd, which manufactures and sells a FOTA (Firmware Over The Air) software update system used by many manufacturers on their devices.
This malware update system for Android devices, FOTA behaves just like any backdoor trojan. Communicates with the Chinese company's server by requesting instructions and based on the received orders, it can perform multiple functions, described below:
- Collect and send SMS text messages to the Chinese server every 72 hours
- It collects and sends call log information to the Chinese server every 72 hours
- Collects and sends the user personally identifiable information to the Chinese server every 24 hours
- Collects and sends IMSI and IMEI on the phone
- Collects and sends geo-location information
- Collects and sends a list of applications installed on the user's device
- It downloads and installs applications without the user's consent or knowledge
- Updates or deletes applications
- Updates the phone firmware and reprograms the device
- It performs remote commands with increased management rights on the user's device
How can you protect yourself:
Check your device (you'll need root privileges) and look for the following two system apps:
com.adups.fota.sysoper com.adups.fota
If you find the packages you can delete them using an application that allows deleting system packages. One of them is System App Remover by Jumobile.
Image by Stavros Anagnostopoulos
Adups reports on her website that her firmware is running over 700 million Android devices. The company does not clear whether all these devices run the FOTA update system.
We thank our friend Stavros Anagnostopoulos for the information he gave us.
Update: Removing the above packages will disable control over software updates. Proceed only if you are not interested.
