Back in mid-November 2016, US cyber-security firm Kryptowire revealed it discovered that firmware code created by a Chinese company called Adups was collecting vasts amount of user information and sending it to servers located in China.According to Kryptowire, the backdoor code was collecting SMS messages, call history, address books, app lists, phone hardware identifiers, but it was also capable of installing new apps or updating existing ones.
[…]
At the time, experts believed Adups shipped out the backdoored component to other phone vendors and the component eventually made its way inside over 700 million devices, most of which were low-budget Android phones, and in some cases, some Android Barnes & Noble NOOK tablets.Following the revelations, many online stores reacted by refusing to sell phone models known to be vulnerable. With pressure from smartphone manufacturers and even the DHS, Adups eventually shipped out a version of the FOTA component without the backdoor and data collection code, even if in a presentation at the Black Hat 2017 security conference held in Las Vegas in August, Kryptowire researchers said that some devices were still sending data to the Adups servers.
[…]
But Malwarebytes says it found another Adups component doing bad things. Just like the previous Adups backdoor, this app is also unremovable, and users can’t disable it either.This second component is found on phones under two names, such as com.adups.fota.sysoper or com.fw.upgrade.sysoper, which appear in the phone’s app list with the name UpgradeSys (FWUpgradeProvider.apk).
The good news is that this one does not collect user data, but instead only includes the ability “to install and/or update apps without a user’s knowledge or consent,” according to Nathan Collier, Senior Malware Intelligence Analyst.
[…]
The only way to remove the suspicious component is if users root their devices, something that many phone manufacturers recommend against, as it could open smartphones to even more dangerous threats
Source: Chinese Backdoor Still Active on Many Android Devices
Robin Edgar
Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft