5 ms·

Wonder if it's written itself into recovery. Or the SIM card/baseband - SIM card in particular usually includes functionality for triggering a sideload of apps

by paulmd 7y ago

Wonder if it's written itself into recovery. Or the SIM card/baseband - SIM card in particular usually includes functionality for triggering a sideload of apps (eg for carrier apps), sending notifications, etc into the main SOC so it fits. Maybe the second instance of SIM card malware ever. https://www.youtube.com/watch?v=31D94QOo2gY https://www.youtube.com/watch?v=31D94QOo2gY There are only so many places it can be hiding if it's surviving a factory reset. --Guy who is undoubtedly vastly underestimating the problem given that it's resisted AV vendors for a while

imglorp 7y ago
AV vendors have multiple conflicts of interest and should not be trusted.
- haliax 7y ago
  Can you elaborate?
  - explodingcamera 7y ago
    Stories of bad viruses actually help them
    - ggm 7y ago
      This only really goes to the "don't entirely trust their statements regarding their product being the only effective barrier" part of the story. Reputable anti-virus companies do have a huge conflict of interest reporting on viruses they find and can tackle, but they also remain an important source of information about viruses. Disreputable anti-virus companies sell product which could be as simple as a "hollywood OS" green stripe animated GIF which says "virus cleaned" for all they really do: they probably install more malware rather than removing any. Also, an anti virus company saying they can't understand how a virus remains infected after removal is interesting.
    - diminoten 7y ago
      Yeah and fires "help" firefighters... How uselessly cynical.
    - pizza234 7y ago
      If you refer to the theory that AV actually wrote viruses (it's not clear), that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks. I've followed the VX scene for years (it died long ago) and there has never been shortage of new malware. Even if we wanted to give some credit to the theory, which type of virus would the AV companies develop? Something trivial, that requires a variation of a signature to detect? Or something extremely complex, that requires month of work, and that slows down the AV engine because it's algorithmically complex to detect? None of this makes any sense. The truth is very simple - malware has always been an interesting subject, and writing viruses always had a subversive appeal to young rebels.
      - jakeogh 7y ago
        Ya totally nothing to do with APT's and plausible deniability. Darn kids.
      - newnewpdro 7y ago
        > If you refer to the theory that AV actually wrote viruses (it's not clear), that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks. This analogy is not helping your case at all. It's not unheard of for police to plant evidence for such purposes. It's also been proven that law enforcement has been willfully using technology having high rates of false positives for things like drug testing to bring real charges against otherwise innocent people.
      - snarfy 7y ago
        > that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks. https://www.washingtonpost.com/nation/2019/07/11/florida-cop-meth-drugs-arrests-scandal/ https://www.washingtonpost.com/nation/2019/07/11/florida-cop...
      - soulofmischief 7y ago
        As a victim of such a falsified crime, testified by half a dozen police officers who couldn't get their stories straight but whom "somehow" were believed, you're only adding credence to the claim with that analogy.
  - imglorp 7y ago
    Yes, AV is in a position where a) it needs regular full priv access to your files and unencrypted web traffic, b) is in a highly competitive, low-margin field where the players are literally attacking each other on your machine [1] to stay even, and c) have enormous motivation to seek other funding sources based on their desktop position [2-5]. I didn't say they created malware, no, but they certainly wave that flag when someone finds some. And it's certainly in their interest to pursue all of these alternatives, or even have a bad third party violate THEM to do so. The money is on the table. Do they take it? They'd be foolish not to. 1. http://www.techradar.com/us/news/software/security-software/kaspersky-lab-tricked-antivirus-rivals-into-deleting-harmless-files-on-your-pc-1301904 http://www.techradar.com/us/news/software/security-software/... 2. https://news.ycombinator.com/item?id=13079569 https://news.ycombinator.com/item?id=13079569 3. https://www.wsj.com/articles/russian-hackers-scanned-networks-world-wide-for-secret-u-s-data-1507743874 https://www.wsj.com/articles/russian-hackers-scanned-network... 4. https://wiki.mozilla.org/CA:Symantec_Issues https://wiki.mozilla.org/CA:Symantec_Issues 5. https://www.howtogeek.com/199829/avast-antivirus-was-spying-on-you-with-adware-until-this-week/ https://www.howtogeek.com/199829/avast-antivirus-was-spying-... etc...
morbm 7y ago
I'd wager that the firmware came pre-infected by the manufacturer (or an update to the firmware has the infection). Based on the reddit thread at least one of the devices is from a no-name manufacturer. https://www.reddit.com/r/antivirus/comments/bj6isa/xhelper_keeps_installing_itself_on_android_phone/ https://www.reddit.com/r/antivirus/comments/bj6isa/xhelper_k...
- walrus01 7y ago
  a not insignificant portion of generic weird mediatek chipset android phones come rooted from the manufacturer, because the OS is built with a root/developer configuration. This also helps malware like this spread on the sub-$80 android phones sold to non technically sophisticated users in the developing world.
  - cptskippy 7y ago
    I remember reading something about mediatek based phones saving on the BOM by utilizing virtualization on a single SoC to run the baseband RTOS and the Smartphone OS.
    - arcticbull 7y ago
      That’s actually kind of brilliant.
      - londons_explore 7y ago
        Until you get bugs like "3D games lag when in fast moving car due to constant cell handovers" and "4G doesn't work at the same time as playing a 1080p60 video, so netflix/youtube are broken unless on wifi".
        arcticbull 7y ago
        Sure but the phones $80. Getting to that price point requires some compromises. You’d think they’d also set the baseband VM at highest QOS.
thenewnewguy 7y ago
Only semi-related, but I wonder if owning the SIM card could be used as some sort of rooting mechanism?
buildzr 7y ago
All they'd have to do in order to survive a factory reset is to write to the /system partition, which contains the main OS. A factory reset only wipes /data and a few caches. Writing to /system requires it to be mounted read/write and permissions to do so, so they'd need a root exploit in order to pull it off, but there's quite a few to choose from especially as devices age and given that they're doing this outside Play Store where Google won't pick them up. I'm just crossing my fingers advanced users don't lose the ability to side-load apps over bad publicity like this, maybe they should make it harder to enable though.
- hunter2_ 7y ago
  Is side loading the only way that code requiring root can easily get on a phone though? What about USB debugging?
  - buildzr 7y ago
    True, just disabling it via PackageInstaller by default would do the trick, the root community could re-enable it easily and those who only needed to sideload the occasional app could do so via USB debugging. It seems like every time I hope for a reasonable solution like this I get let down substantially though.
  - piracy1 7y ago
    No. The play store does not check very well and is pretty easy to bypass. Up until recently you could just download .dex (android equivalent of .jar) files into your apps resources at run time then call the classloader. Then for their runtime scan you can either just wait to put the real code online or have a hardcoded switch to execute the main function based on like an NTP server saying it's past X day. I think that is why they removed calls to the classloader from android. There's a few other ways to do basically that that still work but I'm not sharing those for free. IMO There is a slight flaw to how this question is worded. It's not that they block you from running code that you need to be root to run (you'll just get insufficient perms errors) it's just that you're not root. You could write the code to write to /system, and it will run it just will not work. Thus, you need to utilize some sort of local privilege escalation. That is it's own equally semi-sticky wicket.
tgsovlerkhgsel 7y ago
While there are theoretically many places it could hide in, the system partition or recovery seem the only realistic ones. And recovery is already a stretch IMO.

by paulmd 7y ago

imglorp 7y ago

AV vendors have multiple conflicts of interest and should not be trusted.

haliax 7y ago
Can you elaborate?
- explodingcamera 7y ago
  Stories of bad viruses actually help them
  - ggm 7y ago
    This only really goes to the "don't entirely trust their statements regarding their product being the only effective barrier" part of the story. Reputable anti-virus companies do have a huge conflict of interest reporting on viruses they find and can tackle, but they also remain an important source of information about viruses. Disreputable anti-virus companies sell product which could be as simple as a "hollywood OS" green stripe animated GIF which says "virus cleaned" for all they really do: they probably install more malware rather than removing any. Also, an anti virus company saying they can't understand how a virus remains infected after removal is interesting.
  - diminoten 7y ago
    Yeah and fires "help" firefighters... How uselessly cynical.
  - pizza234 7y ago
    If you refer to the theory that AV actually wrote viruses (it's not clear), that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks. I've followed the VX scene for years (it died long ago) and there has never been shortage of new malware. Even if we wanted to give some credit to the theory, which type of virus would the AV companies develop? Something trivial, that requires a variation of a signature to detect? Or something extremely complex, that requires month of work, and that slows down the AV engine because it's algorithmically complex to detect? None of this makes any sense. The truth is very simple - malware has always been an interesting subject, and writing viruses always had a subversive appeal to young rebels.
    - jakeogh 7y ago
      Ya totally nothing to do with APT's and plausible deniability. Darn kids.
    - newnewpdro 7y ago
      > If you refer to the theory that AV actually wrote viruses (it's not clear), that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks. This analogy is not helping your case at all. It's not unheard of for police to plant evidence for such purposes. It's also been proven that law enforcement has been willfully using technology having high rates of false positives for things like drug testing to bring real charges against otherwise innocent people.
    - snarfy 7y ago
      > that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks. https://www.washingtonpost.com/nation/2019/07/11/florida-cop-meth-drugs-arrests-scandal/ https://www.washingtonpost.com/nation/2019/07/11/florida-cop...
    - soulofmischief 7y ago
      As a victim of such a falsified crime, testified by half a dozen police officers who couldn't get their stories straight but whom "somehow" were believed, you're only adding credence to the claim with that analogy.
- imglorp 7y ago
  Yes, AV is in a position where a) it needs regular full priv access to your files and unencrypted web traffic, b) is in a highly competitive, low-margin field where the players are literally attacking each other on your machine [1] to stay even, and c) have enormous motivation to seek other funding sources based on their desktop position [2-5]. I didn't say they created malware, no, but they certainly wave that flag when someone finds some. And it's certainly in their interest to pursue all of these alternatives, or even have a bad third party violate THEM to do so. The money is on the table. Do they take it? They'd be foolish not to. 1. http://www.techradar.com/us/news/software/security-software/kaspersky-lab-tricked-antivirus-rivals-into-deleting-harmless-files-on-your-pc-1301904 http://www.techradar.com/us/news/software/security-software/... 2. https://news.ycombinator.com/item?id=13079569 https://news.ycombinator.com/item?id=13079569 3. https://www.wsj.com/articles/russian-hackers-scanned-networks-world-wide-for-secret-u-s-data-1507743874 https://www.wsj.com/articles/russian-hackers-scanned-network... 4. https://wiki.mozilla.org/CA:Symantec_Issues https://wiki.mozilla.org/CA:Symantec_Issues 5. https://www.howtogeek.com/199829/avast-antivirus-was-spying-on-you-with-adware-until-this-week/ https://www.howtogeek.com/199829/avast-antivirus-was-spying-... etc...

morbm 7y ago

I'd wager that the firmware came pre-infected by the manufacturer (or an update to the firmware has the infection). Based on the reddit thread at least one of the devices is from a no-name manufacturer. https://www.reddit.com/r/antivirus/comments/bj6isa/xhelper_keeps_installing_itself_on_android_phone/ https://www.reddit.com/r/antivirus/comments/bj6isa/xhelper_k...

walrus01 7y ago
a not insignificant portion of generic weird mediatek chipset android phones come rooted from the manufacturer, because the OS is built with a root/developer configuration. This also helps malware like this spread on the sub-$80 android phones sold to non technically sophisticated users in the developing world.
- cptskippy 7y ago
  I remember reading something about mediatek based phones saving on the BOM by utilizing virtualization on a single SoC to run the baseband RTOS and the Smartphone OS.
  - arcticbull 7y ago
    That’s actually kind of brilliant.
    - londons_explore 7y ago
      Until you get bugs like "3D games lag when in fast moving car due to constant cell handovers" and "4G doesn't work at the same time as playing a 1080p60 video, so netflix/youtube are broken unless on wifi".
      - arcticbull 7y ago
        Sure but the phones $80. Getting to that price point requires some compromises. You’d think they’d also set the baseband VM at highest QOS.

thenewnewguy 7y ago

Only semi-related, but I wonder if owning the SIM card could be used as some sort of rooting mechanism?

buildzr 7y ago

All they'd have to do in order to survive a factory reset is to write to the /system partition, which contains the main OS. A factory reset only wipes /data and a few caches. Writing to /system requires it to be mounted read/write and permissions to do so, so they'd need a root exploit in order to pull it off, but there's quite a few to choose from especially as devices age and given that they're doing this outside Play Store where Google won't pick them up. I'm just crossing my fingers advanced users don't lose the ability to side-load apps over bad publicity like this, maybe they should make it harder to enable though.

hunter2_ 7y ago
Is side loading the only way that code requiring root can easily get on a phone though? What about USB debugging?
- buildzr 7y ago
  True, just disabling it via PackageInstaller by default would do the trick, the root community could re-enable it easily and those who only needed to sideload the occasional app could do so via USB debugging. It seems like every time I hope for a reasonable solution like this I get let down substantially though.
- piracy1 7y ago
  No. The play store does not check very well and is pretty easy to bypass. Up until recently you could just download .dex (android equivalent of .jar) files into your apps resources at run time then call the classloader. Then for their runtime scan you can either just wait to put the real code online or have a hardcoded switch to execute the main function based on like an NTP server saying it's past X day. I think that is why they removed calls to the classloader from android. There's a few other ways to do basically that that still work but I'm not sharing those for free. IMO There is a slight flaw to how this question is worded. It's not that they block you from running code that you need to be root to run (you'll just get insufficient perms errors) it's just that you're not root. You could write the code to write to /system, and it will run it just will not work. Thus, you need to utilize some sort of local privilege escalation. That is it's own equally semi-sticky wicket.

tgsovlerkhgsel 7y ago

While there are theoretically many places it could hide in, the system partition or recovery seem the only realistic ones. And recovery is already a stretch IMO.