“The Check Point Mobile Threat Prevention has recently detected a severe infection in 36 Android devices, belonging to a large telecommunications company and a multinational technology company. While this is not unusual, one detail of the attacks stands out,” Oren Koriat reports for Check Point. “In all instances, the malware was not downloaded to the device as a result of the users’ use, it arrived with it.”
“According to the findings, the malware were already present on the devices even before the users received them. The malicious apps were not part of the official ROM supplied by the vendor, and were added somewhere along the supply chain,” Koriat reports. “Six of the malware instances were added by a malicious actor to the device’s ROM using system privileges, meaning they couldn’t be removed by the user and the device had to be re-flashed.”
“Most of the malware found to be pre-installed on the devices were info-stealers and rough ad networks, and one of them was Slocker, a mobile ransomware. Slocker uses the AES encryption algorithm to encrypt all files on the device and demand ransom in return for their decryption key,” Koriat reports. “The discovery of the pre-installed malware raises some alarming issues regarding mobile security. Users could receive devices which contain backdoors or are rooted without their knowledge.”
More info, including the full list of Samsung, Oppo, Lenovo, Asus, and Xiaomi Android phones, in the full article here.
MacDailyNews Take: iOS unaffected.
Anyone who values their security and privacy would be foolish to use any device that fails to sport the Apple logo. — MacDailyNews, March 22, 2016
SEE ALSO:
The cost of free: More than one million Google Android devices hit by malware – November 30, 2016
Secret backdoor in U.S. Android phones sent location, text, contact data to China – November 15, 2016
Google to pay $5.5 million for sneaking around Apple’s privacy settings to collect user data – August 31, 2016
Cybersecurity researchers: Fitness trackers vulnerable to tracking, privacy breaches – but not Apple Watch – February 2, 2016
EFF files complaint asking for federal investigation; says Google broke privacy pledge, tracked students – December 1, 2015
Tim Cook gets privacy and encryption: We shouldn’t surrender them to Google – June 4, 2015
Apple CEO Tim Cook champions privacy, blasts ‘so-called free services’ – June 3, 2015
How Google aims to delve deeper into users’ lives – May 29, 2015
Apple CEO Cook: Unlike some other companies, Apple won’t invade your right to privacy – March 2, 2015
Edward Snowden’s privacy tips: ‘Get rid of Dropbox,” avoid Facebook and Google – October 13, 2014
Apple CEO Tim Cook ups privacy to new level, takes direct swipe at Google – September 18, 2014
U.S. NSA watching, tracking phone users with Google Maps – January 28, 2014
U.S. NSA secretly infiltrated Yahoo, Google data centers worldwide, Snowden documents say – October 30, 2013
Google has already inserted some U.S. NSA code into Android – July 10, 2013
Court rules NSA doesn’t have to reveal its semi-secret relationship with Google – May 22, 2013
Google Street View cars grabbed locations of cellphones, computers – July 26, 2011
Consumer Watchdog calls for probe of Google’s inappropriate relationship with Obama administration – January 25, 2011
Wired: Google, CIA Invest in ‘future’ of Web monitoring – July 29, 2010
37 states join probe into Google’s questionable Wi-Fi data collection – July 22, 2010
Google Street View Wi-Fi data included passwords and email – June 18, 2010
[Thanks to MacDailyNews Reader “Dan K.” for the heads up.]