14 ms·

The privacy trade-offs of cheap Android smartphones

171 points by imartin2k 7y ago

unityByFreedom 7y ago
Too true. I'm in the market for a new phone and came across dontkillmyapp.com [1]. I find this ranking lines up pretty well with high privacy risk + low cost given the hardware. For those unaware, a new thing phones do is quietly kill apps in order to extend battery, and the extent to which this is done can vary by device and/or software. [1] https://dontkillmyapp.com https://dontkillmyapp.com
- sschueller 7y ago
  I don't mind this if they let me decide which apps to kill and let me override any app from being killed. Unless it has changed recently on iOS you are very restricted what you can run in the background. I want the freedom to run anything and I have that on Android.
  - unityByFreedom 7y ago
    If you click into the manufacturer you can read details about how they came up with the rankings. For example, > UPDATE: On some phones with EMUI 9+ (Android P+) Huawei introduced a new task killer app called PowerGenie which kills everything not whitelisted by Huawei and does not give users any configuration options. See below how to uninstall it. Previous discussion on HN [1] [1] https://news.ycombinator.com/item?id=18901006 https://news.ycombinator.com/item?id=18901006
- Jonnax 7y ago
  This has nothing to do with privacy. It's battery saving. You can create exceptions for apps.
  - unityByFreedom 7y ago
    > I find this ranking lines up pretty well with high privacy risk + low cost given the hardware. Take it or leave it, that's my comment.
  - noisem4ker 7y ago
    It's a quite dirty way to save battery. It may say something about the tendency of certain manufacturers to cut corners instead of walking the right path.
pmlnr 7y ago
> has apps that can’t be updated or deleted [edit] sell them rooted [original] Root it. Unless it's something like Triada[^1], in which case, it's f'd. Around ~2001, everyone at high school knew how to reinstall windows and find cracks for games. Maybe it's time to be at least that "tech savvy" again with smartphones. [^1]: https://forums.malwarebytes.com/topic/200072-trojantriada https://forums.malwarebytes.com/topic/200072-trojantriada
- milankragujevic 7y ago
  Unfortunately, a majority of new Unisoc (Spreadtrum) chips have bootloaders that cannot be unlocked without a key, which is not provided by the SOC manufacturer, and is beyond the control of the ODM. Many low-end Android smartphones are powered by such chips, and the end result is that root is impossible on those devices, i.e. ZTE Blade A5 2019, Doogee N10, etc. (Unisoc SC9863A) edit: I have obtained the source code of the U-boot bootloader used on those devices, however, the algorithm for the key verification is stored on the Trusted Execution Environment, which means it cannot be extracted (the TEE is a SecureEnclave-like device, with no possible direct access to it's memory or storage, besides de-capping it and reading the bits with an electron microscope) -- more info here: https://source.android.com/security/trusty https://source.android.com/security/trusty
  - pmlnr 7y ago
    I wasn't aware of this, for some reason I thought most of the low-ends are mediatek, and unlocking android 6 mediateks was not a hard feat. EDIT I don't think Doogee N10 falls into low end, at least not by specs. Compare it with Moto C, which is indeed low end.
    - milankragujevic 7y ago
      Oh, Mediatek is so-"friendly" to unlocking, with no verified boot and the ability to flash it with the infamous SP Flash Tool. SC9863A and many other SOCs are flashable with Spreadtrum's ResearchDownload Tool. However, Spreadtrum actually does verify the whole boot process, meaning that booting a modified binary is impossible. If you change the boot partition, it will infinitely reboot with a black screen and vibration. If you leave the boot as-is, but change system, it will get to the splash screen and then reboot. etc. It genuinely does cryptographicaly verify the signature and hash of every partition. Which is great for security, in theory, unless the OS has preloaded spyware, but the secureboot process prevents you from removing it. re-edit: Doogee N10 costs 85$. I don't think you can go much lower-end, without basically giving the manufacturer a huge profit margin (i.e. a phone that costs $60, but has 512 MB RAM, has a bigger profit margin than a phone that costs 85$ but has 3 GB RAM.)
ghgr 7y ago
Wouldn't a solution be to install Lineage OS [1] or similar custom ROM and have the advantages of a cheap phone and the privacy of a high-end one? [1] https://wiki.lineageos.org/devices/ https://wiki.lineageos.org/devices/
- milankragujevic 7y ago
  Unless the phone has an un-unlockable bootloader -- https://news.ycombinator.com/item?id=21178430 https://news.ycombinator.com/item?id=21178430 -- but still has spyware apps.
- the_pwner224 7y ago
  This is not practical for many phones and many people (even those who frequent this site) because you need to unlock the bootloader, which may be impossible, and then port LineageOS, which is probably not too hard in the best case, but is not a trivial undertaking. I tried building LOS from source recently for my OnePlus 7 Pro, which is mainlined into LOS. Installing build prerequisites was easy for me because I use an OS with a package manager and a large catalog of packages. Then, it started downloading the LOS git repos. After a few hours all 58 GB of the free space on my disk was used. I cancelled it and will just stick with the provided LOS builds. Time is worth something too.
  - snaky 7y ago
    > and then port LineageOS All the privacy aware people should actually do is to check the list of officially supported phones on the LineageOS site before buying, then spend 15 minutes to read the installation instruction and follow it.
  - IanSanders 7y ago
    You can download prebuilt images for supported devices. Installation is not always a smooth ride, but once you spend 30 minutes you generally forget about it. Plus you get updates.
    - the_pwner224 7y ago
mwyah 7y ago
>In the United States, these users are mainly made up of economically disadvantaged individuals, who are disproportionately black and Hispanic. I mean you could say the same thing about everything. This affects poor people, and those are "disproportionately black and Hispanic". It's like the writer is trying to trigger someone.
- Angostura 7y ago
  If you look at the data its about race, income educational attainment and age. But race and income are two of the examples with the obvious disparities. Them's the facts.
- nullc 7y ago
  Race, gender and age enjoy stronger legal and social position as protected classes than economic standing, political orientation, or education does. As a result one way to fight for justice for the economically disadvantaged is to make use of the racial correlation. The fact that an issue disproportional impacts the poor and as a result disproportionally impacts people of particular races can also contribute to race-specific second order effects. For example, evidence strongly suggests that some race are treated particularly harshly by the judicial system in the US, leading to increased rates of convictions and harsher sentences-- so having backdoored phones is quite possibly a double whammy, causing additional harm that another population with the same devices wouldn't experience. Ideally we'd also protect the economically disadvantaged from things like this without needing to reference a particular subset of victims, but when someone advocates for the welfare of others they do it in the world we actually live in, not the world that we would ideally have.
- Jonnax 7y ago
  The person that got triggered is you.
  - mwyah 7y ago
    It's more like the writer was saying "nobody cares about poor people, but hey, if we say the victims are blacks and latinos... that's going to get some support from someone". Which is rather sad since being poor is bad for everybody, no matter whether you're black white or green.
sdan 7y ago
Another reason privacy is becoming a commodity. Eventually only the rich will be able to live a "private life" while everyone else can't afford it.
- ekianjo 7y ago
  Thats not what commodity means. What you describe is privacy being a luxury.
  - aesh2Xa1 7y ago
    "Commodity" seems right. "Luxury" carries another sense that I think is fitting, too. - Something useful that can be turned to commercial or other advantage. - Advantage; benefit
    - NeedMoreTea 7y ago
      Surely personal data is the commodity turned to commercial advantage? Personal privacy, or lack of is the symptom or consequence. Privacy is a luxury for those able to opt out, usually via wealth.
  - gyuserbti 7y ago
    I think they meant "commodity" in the general sense of "something you have to pay for" or "something subject to market pricing" as opposed to something always assumed.
  - sdan 7y ago
    What I mean by "commodity" is: Suppose you want privacy: You need to buy your way through to get it Suppose you want something for free: You need to sell your privacy for it Although your point is right; maybe "luxury" is a better term.
- barbs 7y ago
  Has privacy become a privilege?
- SmellyGeekBoy 7y ago
systemtest 7y ago
I have a Ulefone from China, with an American operating system. It was locked with Factory Reset Protection when I got it so I used Albanian hacking software to circumvent that, as it was easier than shipping it back. I do not trust this phone a single bit, luckily I only use it as an emergency phone for outdoors using a separate Google account and a separate SIM-card.
codedokode 7y ago
The authors don't know much about cheap smartphones. I examined a cheap Android tablet's ROM dump and it had a backdoor that would allow manufacturer to install any application remotely and an adware that would activate about 2 weeks after turning the tablet on and show ads above browser window (so that the user thinks that it is an ad from a website). If the user tried to delete adware, the backdoor would reinstall it. The backdoor would not activate if the phone is in China. I downloaded ROM from the link at the manufacturer's website to make sure it is really built-in into the ROM and the tablet was not infected by virus. Either manufacturer or those who made the ROM pre-installed backdoor to earn money from clicking on the ads. Also on a Russian forum about smartphones I saw similar reports about other cheap models. UPD: I googled around and it seems that the backdoor (named Cosiloon) has been found and described by antivirus vendors: - https://news.drweb.com/show/?i=10345&lng=en https://news.drweb.com/show/?i=10345&lng=en - https://www.androidauthority.com/cosiloon-malware-android-devices-869407/ https://www.androidauthority.com/cosiloon-malware-android-de... - https://blog.avast.com/android-devices-ship-with-pre-installed-malware https://blog.avast.com/android-devices-ship-with-pre-install... When I found it, there was no information about it anywhere.
- pmlnr 7y ago
  Yep. I had a Nomu S10 which got a Triada infected OTA (!) from the manufacturer. For those unfamiliar with this: Triada, and it's relatives infect zygote, the java bootstrap system on Android. From there on rooting on it's own can't help, because the process binary is changed, so unless you can replace it with an uninfected one, it's gone. If there are ROMs out there without the infection, flashing helps.
  - milankragujevic 7y ago
    It's also kind-of not fair to blame only the brand/manufacturer, they are complicit -- yes -- but no the only party to blame. I work for a company that, in between other things, develops and sells Android devices (TVs, tablets, phones, watches, etc.) We buy a design from a Chinese developer, customize it, add apps and other "value-add" bulls*it, and then import the manufactured products and sell them. The problem is, we recently found malware in the OS images which were provided by the manufacturer/developer, and traces back to Mediatek themselves, but we were not made aware of it. On request, the developer removed the malware and we sent an OTA to all devices of most models that removes the malware. The point I'm making is that in many cases, the backdoors and spyware aren't even provided by the company that sells the phones, they are usually secretly put in much closer to the actual manufacturer/developer of the device and/or SoC.
Integrity 7y ago
I suppose privacy is a premium now.
- HenryBemis 7y ago
  We return to the same adage(s): -there is no such thing as a free lunch -if it is free then you are the product. As always I suggest NoRoot Firewall for everything-Android. But yes it's called a trade-off, like accepting a "free" security software from your ISP which technically invalidates all your encryption efforts.
  - tcd 7y ago
    Except even if you pay you're still the product. Data is a currency, they'll happily take it if you offer it :)
meerita 7y ago
I'm using a Xiaomi A2 Lite. The cheapest one I think (160€) and so far I am ok with it. To my eyes, this is like the only phone I see it has Android One OEM installed, and nothing on top of it. I am no expert, but this is how I've chose when buying a phone. Should I be concerned? Privacy became important to me (I've quit all social media) and I am setting up every single privacy feature I can. I'm also considering moving to Apple since they offer more layers of privacy than Android One.
- milankragujevic 7y ago
  Generally speaking, Android One devices cannot ship with malware, even invisible, because Google has to inspect the software. In any case, a manufacturer COULD put malware after Google approves the software, but they would certainly lose Android One license, and possibly the ability to get ANY phone certified as Google Play compatible, EVER. So, they won't do it, no matter the incentives and possible revenue in stealing user data.
  - snagglegaggle 7y ago
    >and possibly the ability to get ANY phone certified as Google Play compatible, EVER. Not so sure about this. The Chinese money is too great.
    - milankragujevic 7y ago
      I mean, you don't need Google Play in China, given that it's blocked. You DO need China-specific services, that consumers in China will not buy your phone without. i.e. all Tencent things...
- mariushn 7y ago
  +1 for Xiaomi A2 as well. I would never buy a non-Android One device again, after seeing the experience on this one. My only complaints is lack of NFC on this device, and that A3 is worse performance/weight wise.
  - 7y ago
strooper 7y ago
All android smartphones data are exploited by Google through google services, by manufacturers through uninstallable bloatwares and by app providers through apps. If a user disables a permission, the app refuses to work. The cheap smartphones are sold mostly in the Asian and African markets where the mass can afford that, and data privacy means nothing to those users. So, Your data, my data, all are up there somewhere, no matter how cheap or expensive devices we use. Why do we still live in the illusion of data privacy? Is there any?
tannhaeuser 7y ago
I find it ironic (for lack of a better word) that Android is based on Linux, yet it's the single largest spyware vector in the world. There's maybe a story to be told here about how an altruistic motive or dont-care liberalism or whatever contributes to its own demise and the enslavement of large parts of the populace behind addictive spam devices and into cloud dystopies, tragedy of the commons and all. But at least a discussion about Linux licensing wrt proprietary drivers and boot loaders, as well as mandatory apps seems about time.
- Nasrudith 7y ago
  It brings to mind paradox of tolerance, how knowledge includes the ability to abuse it and the morality of hammers and knives - it is fundamentally up to the user if they want to build a house, prepare a meal, remove a tumor, or murder and any attempt to limit it only sabotages the purpose. Blame would be misplaced - even the most zealous licensing wouldn't have made a bit of difference in the end. Linux itself was a free rederived fork of Unix. If Google had to rederive their own fork of Linux they could have easily done so with only a little more early expense and reputation damage. At the cost of another proprietary fork gaining influence and control over free software or even open source.
  - rrix2 7y ago
    Yeah, I doubt Fuschia, for example, will magically make mobile malware disappear
squarefoot 7y ago
Using an old unpatched version of Android might also suggest the hardware could be older and easier to support by other systems. Did anyone attempt at flashing a free OS + free drivers on one of those cheap phones, that is, removing entirely the factory software/firmware? If doable that would turn them into interesting devices.
- pm7 7y ago
  Main issue is that drivers are only in binary form and not compatible with recent linux (kernel) versions.
nobrains 7y ago
Solution: Android One devices
hu3 7y ago
I wonder if Xiaomi's Redmi Note 7 is affected. It costs around $180 and is quite popular in Europe. I ask because I've seen some users complaining about ads. https://www.amazon.com/s?k=redmi+note+7 https://www.amazon.com/s?k=redmi+note+7
- dylz 7y ago
  The Xiaomis are kind of interesting in that if you buy a legitimate one direct from the official store it's likely to be in Chinese but also somewhat-clean (for a questionable definition of clean - expect bullshit battery saver / storage cleaner apps that to me would border on malware). If you have the misfortune to buy through a reseller (gearbest, dx, unofficial stores, amazon, etc) out of several phones I've purchased from resellers, they have all come with malware on them. This may partially be why Xiaomi is enforcing up to 180 day minimums before they allow a bootloader unlock (to prevent flashing/sideloading system malware apps) by shitty resellers for $ before they ship. It does piss me off once I get the device that I have to go sign up on their forum and beg for a "possible approval" for a bootloader unlock.
panpanna 7y ago
I think the main issue here is that resellers may modify perfectly fine phones to include adware. This was pretty common with eBay resellers of xiaomi phones a while back untill xiaomi stepped in and added some method to verify device integrity. I assume same thing could happen on iOS if one could find a way to make the adware to survive system updates.
- ljf 7y ago
  Exactly this - I bought a Xiaomi Mi Note Pro and found is was packed with malware - I went to the Xiaomi site and got the right ROM and all was good - it was obviously the reseller who stuck it on. The issue was the malware was pretty ropey looking, it was easy to spot - if they had been cleverer I wouldn't have guessed or updated the phone...
  - panpanna 7y ago
    I feel the device should refuse to register a new user from anything but the clean state. This is pretty straightforward on modern hardware. If any Google engineers are reading this: maybe something to consider for Android 11?
    - UncleMeat 7y ago
      I can see the angry HN comments now. "Google bans reselling. Do you really own your phone?"
      - dylz 7y ago
        I think clean slate here means "factory image" - resellers if you buy on gearbest or other Chinese sites often will preload with malware and adware before giving you the device.
        ljf 7y ago
        My Mi Note Pro was indeed from gearbest...
egdod 7y ago
How much can the private data of poor people really be worth? The whole point is to send them ads, right?
Tepix 7y ago
By 2025, WARC estimates that 3.7 billion people, or over 72% of projected internet users, will be smartphone-only internet users. Things will get so much worse, it's frightening!
qazqwert 7y ago
BULLSHIT no nyet nada.... thoes apps can very very easily be uninstalled with a pc without root or with root it's just that most people don't know how/... that's why there are techs... simply go to a technician ask to remove this and that and pay 15-20 bucks.... it dosen't take long it's not hard at all... and u end up saving a lot... but i don't suggest u buy cheep phones in general.. there are many fakes and.... but still.. bullshit

171 points by imartin2k 7y ago

Too true. I'm in the market for a new phone and came across dontkillmyapp.com [1]. I find this ranking lines up pretty well with high privacy risk + low cost given the hardware. For those unaware, a new thing phones do is quietly kill apps in order to extend battery, and the extent to which this is done can vary by device and/or software. [1] https://dontkillmyapp.com https://dontkillmyapp.com

sschueller 7y ago
I don't mind this if they let me decide which apps to kill and let me override any app from being killed. Unless it has changed recently on iOS you are very restricted what you can run in the background. I want the freedom to run anything and I have that on Android.
- unityByFreedom 7y ago
  If you click into the manufacturer you can read details about how they came up with the rankings. For example, > UPDATE: On some phones with EMUI 9+ (Android P+) Huawei introduced a new task killer app called PowerGenie which kills everything not whitelisted by Huawei and does not give users any configuration options. See below how to uninstall it. Previous discussion on HN [1] [1] https://news.ycombinator.com/item?id=18901006 https://news.ycombinator.com/item?id=18901006
Jonnax 7y ago
This has nothing to do with privacy. It's battery saving. You can create exceptions for apps.
- unityByFreedom 7y ago
  > I find this ranking lines up pretty well with high privacy risk + low cost given the hardware. Take it or leave it, that's my comment.
- noisem4ker 7y ago
  It's a quite dirty way to save battery. It may say something about the tendency of certain manufacturers to cut corners instead of walking the right path.

pmlnr 7y ago

> has apps that can’t be updated or deleted [edit] sell them rooted [original] Root it. Unless it's something like Triada[^1], in which case, it's f'd. Around ~2001, everyone at high school knew how to reinstall windows and find cracks for games. Maybe it's time to be at least that "tech savvy" again with smartphones. [^1]: https://forums.malwarebytes.com/topic/200072-trojantriada https://forums.malwarebytes.com/topic/200072-trojantriada

milankragujevic 7y ago
Unfortunately, a majority of new Unisoc (Spreadtrum) chips have bootloaders that cannot be unlocked without a key, which is not provided by the SOC manufacturer, and is beyond the control of the ODM. Many low-end Android smartphones are powered by such chips, and the end result is that root is impossible on those devices, i.e. ZTE Blade A5 2019, Doogee N10, etc. (Unisoc SC9863A) edit: I have obtained the source code of the U-boot bootloader used on those devices, however, the algorithm for the key verification is stored on the Trusted Execution Environment, which means it cannot be extracted (the TEE is a SecureEnclave-like device, with no possible direct access to it's memory or storage, besides de-capping it and reading the bits with an electron microscope) -- more info here: https://source.android.com/security/trusty https://source.android.com/security/trusty
- pmlnr 7y ago
  I wasn't aware of this, for some reason I thought most of the low-ends are mediatek, and unlocking android 6 mediateks was not a hard feat. EDIT I don't think Doogee N10 falls into low end, at least not by specs. Compare it with Moto C, which is indeed low end.
  - milankragujevic 7y ago
    Oh, Mediatek is so-"friendly" to unlocking, with no verified boot and the ability to flash it with the infamous SP Flash Tool. SC9863A and many other SOCs are flashable with Spreadtrum's ResearchDownload Tool. However, Spreadtrum actually does verify the whole boot process, meaning that booting a modified binary is impossible. If you change the boot partition, it will infinitely reboot with a black screen and vibration. If you leave the boot as-is, but change system, it will get to the splash screen and then reboot. etc. It genuinely does cryptographicaly verify the signature and hash of every partition. Which is great for security, in theory, unless the OS has preloaded spyware, but the secureboot process prevents you from removing it. re-edit: Doogee N10 costs 85$. I don't think you can go much lower-end, without basically giving the manufacturer a huge profit margin (i.e. a phone that costs $60, but has 512 MB RAM, has a bigger profit margin than a phone that costs 85$ but has 3 GB RAM.)

ghgr 7y ago

Wouldn't a solution be to install Lineage OS [1] or similar custom ROM and have the advantages of a cheap phone and the privacy of a high-end one? [1] https://wiki.lineageos.org/devices/ https://wiki.lineageos.org/devices/

milankragujevic 7y ago
Unless the phone has an un-unlockable bootloader -- https://news.ycombinator.com/item?id=21178430 https://news.ycombinator.com/item?id=21178430 -- but still has spyware apps.
the_pwner224 7y ago
This is not practical for many phones and many people (even those who frequent this site) because you need to unlock the bootloader, which may be impossible, and then port LineageOS, which is probably not too hard in the best case, but is not a trivial undertaking. I tried building LOS from source recently for my OnePlus 7 Pro, which is mainlined into LOS. Installing build prerequisites was easy for me because I use an OS with a package manager and a large catalog of packages. Then, it started downloading the LOS git repos. After a few hours all 58 GB of the free space on my disk was used. I cancelled it and will just stick with the provided LOS builds. Time is worth something too.
- snaky 7y ago
  > and then port LineageOS All the privacy aware people should actually do is to check the list of officially supported phones on the LineageOS site before buying, then spend 15 minutes to read the installation instruction and follow it.
- IanSanders 7y ago
  You can download prebuilt images for supported devices. Installation is not always a smooth ride, but once you spend 30 minutes you generally forget about it. Plus you get updates.
  - the_pwner224 7y ago

mwyah 7y ago

>In the United States, these users are mainly made up of economically disadvantaged individuals, who are disproportionately black and Hispanic. I mean you could say the same thing about everything. This affects poor people, and those are "disproportionately black and Hispanic". It's like the writer is trying to trigger someone.

Angostura 7y ago
If you look at the data its about race, income educational attainment and age. But race and income are two of the examples with the obvious disparities. Them's the facts.
nullc 7y ago
Race, gender and age enjoy stronger legal and social position as protected classes than economic standing, political orientation, or education does. As a result one way to fight for justice for the economically disadvantaged is to make use of the racial correlation. The fact that an issue disproportional impacts the poor and as a result disproportionally impacts people of particular races can also contribute to race-specific second order effects. For example, evidence strongly suggests that some race are treated particularly harshly by the judicial system in the US, leading to increased rates of convictions and harsher sentences-- so having backdoored phones is quite possibly a double whammy, causing additional harm that another population with the same devices wouldn't experience. Ideally we'd also protect the economically disadvantaged from things like this without needing to reference a particular subset of victims, but when someone advocates for the welfare of others they do it in the world we actually live in, not the world that we would ideally have.
Jonnax 7y ago
The person that got triggered is you.
- mwyah 7y ago
  It's more like the writer was saying "nobody cares about poor people, but hey, if we say the victims are blacks and latinos... that's going to get some support from someone". Which is rather sad since being poor is bad for everybody, no matter whether you're black white or green.

sdan 7y ago

Another reason privacy is becoming a commodity. Eventually only the rich will be able to live a "private life" while everyone else can't afford it.

ekianjo 7y ago
Thats not what commodity means. What you describe is privacy being a luxury.
- aesh2Xa1 7y ago
  "Commodity" seems right. "Luxury" carries another sense that I think is fitting, too. - Something useful that can be turned to commercial or other advantage. - Advantage; benefit
  - NeedMoreTea 7y ago
    Surely personal data is the commodity turned to commercial advantage? Personal privacy, or lack of is the symptom or consequence. Privacy is a luxury for those able to opt out, usually via wealth.
- gyuserbti 7y ago
  I think they meant "commodity" in the general sense of "something you have to pay for" or "something subject to market pricing" as opposed to something always assumed.
- sdan 7y ago
  What I mean by "commodity" is: Suppose you want privacy: You need to buy your way through to get it Suppose you want something for free: You need to sell your privacy for it Although your point is right; maybe "luxury" is a better term.
barbs 7y ago
Has privacy become a privilege?
SmellyGeekBoy 7y ago

systemtest 7y ago

I have a Ulefone from China, with an American operating system. It was locked with Factory Reset Protection when I got it so I used Albanian hacking software to circumvent that, as it was easier than shipping it back. I do not trust this phone a single bit, luckily I only use it as an emergency phone for outdoors using a separate Google account and a separate SIM-card.

codedokode 7y ago

The authors don't know much about cheap smartphones. I examined a cheap Android tablet's ROM dump and it had a backdoor that would allow manufacturer to install any application remotely and an adware that would activate about 2 weeks after turning the tablet on and show ads above browser window (so that the user thinks that it is an ad from a website). If the user tried to delete adware, the backdoor would reinstall it. The backdoor would not activate if the phone is in China. I downloaded ROM from the link at the manufacturer's website to make sure it is really built-in into the ROM and the tablet was not infected by virus. Either manufacturer or those who made the ROM pre-installed backdoor to earn money from clicking on the ads. Also on a Russian forum about smartphones I saw similar reports about other cheap models. UPD: I googled around and it seems that the backdoor (named Cosiloon) has been found and described by antivirus vendors: - https://news.drweb.com/show/?i=10345&lng=en https://news.drweb.com/show/?i=10345&lng=en - https://www.androidauthority.com/cosiloon-malware-android-devices-869407/ https://www.androidauthority.com/cosiloon-malware-android-de... - https://blog.avast.com/android-devices-ship-with-pre-installed-malware https://blog.avast.com/android-devices-ship-with-pre-install... When I found it, there was no information about it anywhere.

pmlnr 7y ago
Yep. I had a Nomu S10 which got a Triada infected OTA (!) from the manufacturer. For those unfamiliar with this: Triada, and it's relatives infect zygote, the java bootstrap system on Android. From there on rooting on it's own can't help, because the process binary is changed, so unless you can replace it with an uninfected one, it's gone. If there are ROMs out there without the infection, flashing helps.
- milankragujevic 7y ago
  It's also kind-of not fair to blame only the brand/manufacturer, they are complicit -- yes -- but no the only party to blame. I work for a company that, in between other things, develops and sells Android devices (TVs, tablets, phones, watches, etc.) We buy a design from a Chinese developer, customize it, add apps and other "value-add" bulls*it, and then import the manufactured products and sell them. The problem is, we recently found malware in the OS images which were provided by the manufacturer/developer, and traces back to Mediatek themselves, but we were not made aware of it. On request, the developer removed the malware and we sent an OTA to all devices of most models that removes the malware. The point I'm making is that in many cases, the backdoors and spyware aren't even provided by the company that sells the phones, they are usually secretly put in much closer to the actual manufacturer/developer of the device and/or SoC.

Integrity 7y ago

I suppose privacy is a premium now.

HenryBemis 7y ago
We return to the same adage(s): -there is no such thing as a free lunch -if it is free then you are the product. As always I suggest NoRoot Firewall for everything-Android. But yes it's called a trade-off, like accepting a "free" security software from your ISP which technically invalidates all your encryption efforts.
- tcd 7y ago
  Except even if you pay you're still the product. Data is a currency, they'll happily take it if you offer it :)

meerita 7y ago

I'm using a Xiaomi A2 Lite. The cheapest one I think (160€) and so far I am ok with it. To my eyes, this is like the only phone I see it has Android One OEM installed, and nothing on top of it. I am no expert, but this is how I've chose when buying a phone. Should I be concerned? Privacy became important to me (I've quit all social media) and I am setting up every single privacy feature I can. I'm also considering moving to Apple since they offer more layers of privacy than Android One.

milankragujevic 7y ago
Generally speaking, Android One devices cannot ship with malware, even invisible, because Google has to inspect the software. In any case, a manufacturer COULD put malware after Google approves the software, but they would certainly lose Android One license, and possibly the ability to get ANY phone certified as Google Play compatible, EVER. So, they won't do it, no matter the incentives and possible revenue in stealing user data.
- snagglegaggle 7y ago
  >and possibly the ability to get ANY phone certified as Google Play compatible, EVER. Not so sure about this. The Chinese money is too great.
  - milankragujevic 7y ago
    I mean, you don't need Google Play in China, given that it's blocked. You DO need China-specific services, that consumers in China will not buy your phone without. i.e. all Tencent things...
mariushn 7y ago
+1 for Xiaomi A2 as well. I would never buy a non-Android One device again, after seeing the experience on this one. My only complaints is lack of NFC on this device, and that A3 is worse performance/weight wise.
- 7y ago

strooper 7y ago

All android smartphones data are exploited by Google through google services, by manufacturers through uninstallable bloatwares and by app providers through apps. If a user disables a permission, the app refuses to work. The cheap smartphones are sold mostly in the Asian and African markets where the mass can afford that, and data privacy means nothing to those users. So, Your data, my data, all are up there somewhere, no matter how cheap or expensive devices we use. Why do we still live in the illusion of data privacy? Is there any?

tannhaeuser 7y ago

I find it ironic (for lack of a better word) that Android is based on Linux, yet it's the single largest spyware vector in the world. There's maybe a story to be told here about how an altruistic motive or dont-care liberalism or whatever contributes to its own demise and the enslavement of large parts of the populace behind addictive spam devices and into cloud dystopies, tragedy of the commons and all. But at least a discussion about Linux licensing wrt proprietary drivers and boot loaders, as well as mandatory apps seems about time.

Nasrudith 7y ago
It brings to mind paradox of tolerance, how knowledge includes the ability to abuse it and the morality of hammers and knives - it is fundamentally up to the user if they want to build a house, prepare a meal, remove a tumor, or murder and any attempt to limit it only sabotages the purpose. Blame would be misplaced - even the most zealous licensing wouldn't have made a bit of difference in the end. Linux itself was a free rederived fork of Unix. If Google had to rederive their own fork of Linux they could have easily done so with only a little more early expense and reputation damage. At the cost of another proprietary fork gaining influence and control over free software or even open source.
- rrix2 7y ago
  Yeah, I doubt Fuschia, for example, will magically make mobile malware disappear

squarefoot 7y ago

Using an old unpatched version of Android might also suggest the hardware could be older and easier to support by other systems. Did anyone attempt at flashing a free OS + free drivers on one of those cheap phones, that is, removing entirely the factory software/firmware? If doable that would turn them into interesting devices.

pm7 7y ago
Main issue is that drivers are only in binary form and not compatible with recent linux (kernel) versions.

nobrains 7y ago

Solution: Android One devices

hu3 7y ago

I wonder if Xiaomi's Redmi Note 7 is affected. It costs around $180 and is quite popular in Europe. I ask because I've seen some users complaining about ads. https://www.amazon.com/s?k=redmi+note+7 https://www.amazon.com/s?k=redmi+note+7

dylz 7y ago
The Xiaomis are kind of interesting in that if you buy a legitimate one direct from the official store it's likely to be in Chinese but also somewhat-clean (for a questionable definition of clean - expect bullshit battery saver / storage cleaner apps that to me would border on malware). If you have the misfortune to buy through a reseller (gearbest, dx, unofficial stores, amazon, etc) out of several phones I've purchased from resellers, they have all come with malware on them. This may partially be why Xiaomi is enforcing up to 180 day minimums before they allow a bootloader unlock (to prevent flashing/sideloading system malware apps) by shitty resellers for $ before they ship. It does piss me off once I get the device that I have to go sign up on their forum and beg for a "possible approval" for a bootloader unlock.

panpanna 7y ago

I think the main issue here is that resellers may modify perfectly fine phones to include adware. This was pretty common with eBay resellers of xiaomi phones a while back untill xiaomi stepped in and added some method to verify device integrity. I assume same thing could happen on iOS if one could find a way to make the adware to survive system updates.

ljf 7y ago
Exactly this - I bought a Xiaomi Mi Note Pro and found is was packed with malware - I went to the Xiaomi site and got the right ROM and all was good - it was obviously the reseller who stuck it on. The issue was the malware was pretty ropey looking, it was easy to spot - if they had been cleverer I wouldn't have guessed or updated the phone...
- panpanna 7y ago
  I feel the device should refuse to register a new user from anything but the clean state. This is pretty straightforward on modern hardware. If any Google engineers are reading this: maybe something to consider for Android 11?
  - UncleMeat 7y ago
    I can see the angry HN comments now. "Google bans reselling. Do you really own your phone?"
    - dylz 7y ago
      I think clean slate here means "factory image" - resellers if you buy on gearbest or other Chinese sites often will preload with malware and adware before giving you the device.
      - ljf 7y ago
        My Mi Note Pro was indeed from gearbest...

egdod 7y ago

How much can the private data of poor people really be worth? The whole point is to send them ads, right?

Tepix 7y ago

By 2025, WARC estimates that 3.7 billion people, or over 72% of projected internet users, will be smartphone-only internet users. Things will get so much worse, it's frightening!

qazqwert 7y ago

BULLSHIT no nyet nada.... thoes apps can very very easily be uninstalled with a pc without root or with root it's just that most people don't know how/... that's why there are techs... simply go to a technician ask to remove this and that and pay 15-20 bucks.... it dosen't take long it's not hard at all... and u end up saving a lot... but i don't suggest u buy cheep phones in general.. there are many fakes and.... but still.. bullshit