Why it matters to you
A number of budget Android devices are still being linked to Chinese spyware. Here are the best tips to keep your data secure and avoid affected products.
The last thing you want your smartphone doing is sending your text messages, contacts, and location history to a server in China. But according to mobile security firm Kryptowire, a particularly nasty brand of Android software did just that, transmitting text, data, call, location, and app data to a Chinese server every 72 hours.
Researchers began to raise red flags last fall, when it was discovered the the data mining tool in question — called Adups — had been living inside hundreds of millions of devices produced by more than 40 manufacturers. Florida-based Blu Products was one of the affected parties, and assured at the time that the problem had been identified and every trace of the spyware had been removed from its phones.
Now, nearly 10 months since the initial report, Amazon has suspended the sale of several Blu devices from its Prime Exclusive lineup over re-emerging security concerns. Kryptowire appeared at July’s Black Hat security conference in Las Vegas to say the spyware still existed on some of Blu’s current phones, which led to Amazon’s decision the following week.
The code, which comes preinstalled on certain Android devices, sends the data surreptitiously. “Even if you wanted to, you wouldn’t have known about it,” Kryptowire vice president of product Tom Karygiannis told The New York Times last year.
How to know if you’ve been affected, and what to do
An investigation conducted by mobile security researchers at Trustlook in December found that as many as 43 manufacturers, including brands like Lenovo and Gionee, contained similar spyware. According to the firm’s report, the software collects serial numbers, software version numbers, operator information, and texting and call data from infected phones; the company found traces in All Win Tech smartphones in Taiwan, Archos devices in France, DEXP phones in Russia, and Prestigio hardware in the Czech Republic.
Here’s a list of manufacturers with affected devices:
At this time, there’s no sure way to know if Adups is sending your personal information. However, some phone makers use Adups, rather than Google, to push over-the-air system updates, which is a clear indicator that the software is at least present on your device. The offending file, com.adups.fota, typically appears as “System Update” or “Wireless Update” within your phone’s list of apps in the settings menu. These are system apps, so they cannot be uninstalled — though they can be disabled. At the moment, disabling is the only known way to prevent Adups from running without rooting or installing custom firmware, which are riskier measures that will void your manufacturer’s warranty.
In November, Trustlook updated its Antivirus & Mobile Security app on the Google Play Store to check for Adups’ presence. The firm says it has updated the app continually to search for new Adups system programs linked to data collection as they’ve been discovered.
Specific phones known to include Adups more recently are the Blu Grand M and Cubot X16S. In addition to discovering the spyware in those two devices, Kryptowire’s Ryan Johnson told CNET he hasn’t found it in any handsets priced over $300. Additionally, only MediaTek chipsets have thus far been linked to the scheme. It would seem Adups is targeting low-cost hardware, predominantly from manufacturers that don’t sell phones in the U.S.
For those reasons, at this time we recommend staying away from budget smartphones powered by MediaTek processors built by any of the companies listed above.