Chinese Backdoor Still Active on Many Android Devices (hidden inside a build-in and unremovable app)

[LASER_oneXM]

Many Android users may still have a backdoor on their device, according to new revelations made today by the Malwarebytes' mobile security research team.

The Adups backdoor incident from late 2016
Their discovery is related to the Adups case from last year. Back in mid-November 2016, US cyber-security firm Kryptowire revealed it discovered that firmware code created by a Chinese company called Adups was collecting vasts amount of user information and sending it to servers located in China.

According to Kryptowire, the backdoor code was collecting SMS messages, call history, address books, app lists, phone hardware identifiers, but it was also capable of installing new apps or updating existing ones.

The backdoor was hidden inside a built-in and unremovable app named com.adups.fota, the component responsible for the phone's firmware-over-the-air update (FOTA) system.

At the time, experts believed Adups shipped out the backdoored component to other phone vendors and the component eventually made its way inside over 700 million devices, most of which were low-budget Android phones, and in some cases, some Android Barnes & Noble NOOK tablets.

Some non-recommended ways to remove the app exist
The only way to remove the suspicious component is if users root their devices, something that many phone manufacturers recommend against, as it could open smartphones to even more dangerous threats.

There is also a Windows app named Debloater that is known to remove the UpgradeSys component, but it was not tested on all Android devices and may lead to unexpected behavior.

Malwarebytes says that at the time being, they have not seen any malicious activity being carried out through this app, but this doesn't guarantee that Adups or another threat actor may not use it in the future.

At the time of writing, it is unclear how many phones feature this second component, but Collier says that "there are reports of it being installed on phones bought from legitimate phone carriers in countries such as the UK."

"Hopefully, bringing public attention to this will once again alert Adups to clean things up. If not, we will remain vigilant of any malicious apps it may try to install," says Collier.