7 ms·

We found a phone with pre-installed malware via the Lifeline Assistance program

123 points by EMM_386 5y ago

skinnymuch 5y ago
I assumed this was obvious. From my own anecdotal seeing, all three instances of cheap Android devices given to people via Lifeline, Assurance Wirleess had preinstalled stuff. It won’t go away even if you uninstall whatever BS. It’ll be back in a day or two. Slows the already weak phone down to a crawl sometimes.
- hcykb 5y ago
  It's a race to the bottom basically. When you can't skimp anymore on hardware you have to do so on software
- ignoramous 5y ago
  In one case, a husband gift her wife a phone with spyware preinstalled to snoop in on her: https://timesofindia.com/city/bengaluru/karnataka-tailed-by-22-cameras-wife-smashes-hubbys-head/articleshow/69437280.cms https://timesofindia.com/city/bengaluru/karnataka-tailed-by-... Apparently, stalking is a booming business: https://www.bbc.com/news/technology-50166147 https://www.bbc.com/news/technology-50166147
  - exikyut 5y ago
    This sounds like a situation where the husband installed the malware, however, as opposed to a shady provider/operator/carrier.
saagarjha 5y ago
A family member of mine has one of these. Of course, being a good grandson, I tell him to use it for phone calls only and never sign into anything. Soon after setting it up he started complaining that it was showing him ads; I was confused because he had barely touched it but turns out the phone has a hidden carrier “app updater” (read: remote installer) that had silently downloaded several adware packages to his device. It is outrageous that we push these devices to older, frequently technically illiterate people. There has to be a better system behind this than “we gave them a free phone, who cares if it’s actively unsafe to actually use”.
jl6 5y ago
How much do these devices typically cost, e.g. to an end-user acquiring via the assistance programme?
- giantrobot 5y ago
  Assurance Wireless has phones that are given to subscribers at no out of pocket cost. They also sell a number of current-ish phones. The free phones are carrier locked and the SIMs are locked so they're only usable in phones Assurance provides.
baybal2 5y ago
UNIMAX - is that's the same outfit which OEMed for DNS from recent news, and been caught doing the same in India, and few African countries?
- ignoramous 5y ago
  Could you please elaborate what is meant by "OEMed for DNS"?
  - tyingq 5y ago
    DNS is probably a typo of ANS (American Network Solutions). OEM is "Original Equipment Manufacturer", and "OEMed" means "we make the phone but put your brand on the phone so you appear to be the OEM". So they seem to be saying UNIMAX may be the actual manufacturer of ANS phones.
  - baybal2 5y ago
    Manufactured phones under contract for DNS - a retail chain in Russia which got hit by preinstaled malware https://therecord.media/malware-found-preinstalled-in-classic-push-button-phones-sold-in-russia/ https://therecord.media/malware-found-preinstalled-in-classi...
thowaway959125 5y ago
Is this not a national security issue when looked at in a broader scope? The Chinese company behind this seems to solely target the North American market and makes medical devices, IoT devices, and other things. According to their homepage, their LA based office employs engineers from "United Bell Lab, Oracle, Motorola and other well-known international companies". What else are they root-kitting? With this particular Android one they are freely able to brick devices at will, if it was ever necessary. http://www.teleepoch.com/company.html http://www.teleepoch.com/company.html
- DiabloD3 5y ago
  This is a national security issue, but I will tell you the most important thing I've discovered: talking about malware, especially when employed against the technically illiterate, as a national security issue will get you attacked online. People either freak out and shoot the messenger (either because they misunderstand how deep the technical illiteracy goes amongst the aging population or they are a member technical illiterate aging population and resist any effort to be educated), or they directly profit from it (companies that are part of China's spy effort, domestic or foreign), or they're just so goddamned dense they give excuses like "well I've never seen it, so it doesn't exist". Also, as a side note: we probably should start considering advertising platforms a form of malware as well. Given how many systems run a WebView to display their content, and ad systems run Javascript, and it's a pipedream to ever think Javascript in a browser can ever be made to be secure (even if all it does is leak metadata and perform tracking); ads are, fundamentally, a way to inject malware and should be considered a national security issue. And yes, I'm aware two of the largest tech companies are ad platforms that have side gigs (Google and Facebook); I, frankly, don't care. If your business revolves around a criminal enterprise that is claimed to be legal purely because of a loophole, then you should go out of business once that loophole is closed.
  - matheusmoreira 5y ago
    > we probably should start considering advertising platforms a form of malware as well Absolutely! They've been used as malware vectors numerous times in the past. One of infinite reasons to block them unconditionally and make no exceptions.
cascom 5y ago
You’d think this would be good fodder for a class action lawsuit, no?
- matheusmoreira 5y ago
  Against the chinese?
  - hellbannedguy 5y ago
    These Lifeline phones are sold, or given away, by major USA telecoms. You would think they would be partially liable for malware on their phones? They make money counting on low income Americans going over their free rate tier, and advertising.
    - pbhjpbhj 5y ago
      In consumer law in the UK _sellers_ are responsible for what they sell. This seems right as it means you can sue the seller, they can sue their supplier if they too were sold a product that didn't meet the description of what they were sold. That way the seller, who can afford to spend on expertise to make sure products are up to scratch, bears responsibility. It's not perfect, but it makes sense this way IMO.
      - verall 5y ago
        It's the same in America
butz 5y ago
What tools should I use to dump filesystem from Android device and scan it for malware?
- batch12 5y ago
  As far as filesystem goes, it depends if your device is rooted or not. Assuming nonroot, you could use adb to list then download all packages. This would provide copies of most apps. In many cases, these can be decompiled with apktool. You could also use adb to pull other files, though not all, from the phone for inspection.
- ta988 5y ago
  If it is not rooted you may not be able to see everything. And still no warranties that the bootloader isn't full of crap, but that's a bit more rare.
batch12 5y ago
(2020)
blendergeek 5y ago
I see that Malwarebytes calls this malware and from browsing the comments, everyone here seems to agree. What makes this malware while other pre-installed adware from other companies is just "built-in"ads? Why does Google or Amazon get to "use ads to subsisidize their devices" while this company is using "pre-installed malware"? Does this "malware" exfiltrate personal data in violation of a the privacy policy? What does it do (besides annoy the user and show ads) that is malicious? Modern proprietary operating systems come with non-removable adware. That is the world we live in. I don't like. I don't use these operating systems. But they all do it.
- lupire 5y ago
  what adware is preinstalled without consent?
- clemailacct1 5y ago
  One issue in particular that makes it malware is that it attempts to download 3rd party apps from non-Google Play store. That’s a major security risk for introducing malicious APKs onto your phone.
  - blendergeek 5y ago
    Given most Android phone and definitely bMS Windows regularly have third party bundled software I fail to see the difference here. While there is malware distributed outside of Google Play, unless you can point to an actually malicious thing this software did, I have give it a pass. Remember, the world has already decided that nonconsensual updates, ads, tracking, etc is normal if bundled with the OS and therefore not malware.

123 points by EMM_386 5y ago

I assumed this was obvious. From my own anecdotal seeing, all three instances of cheap Android devices given to people via Lifeline, Assurance Wirleess had preinstalled stuff. It won’t go away even if you uninstall whatever BS. It’ll be back in a day or two. Slows the already weak phone down to a crawl sometimes.

hcykb 5y ago
It's a race to the bottom basically. When you can't skimp anymore on hardware you have to do so on software
ignoramous 5y ago
In one case, a husband gift her wife a phone with spyware preinstalled to snoop in on her: https://timesofindia.com/city/bengaluru/karnataka-tailed-by-22-cameras-wife-smashes-hubbys-head/articleshow/69437280.cms https://timesofindia.com/city/bengaluru/karnataka-tailed-by-... Apparently, stalking is a booming business: https://www.bbc.com/news/technology-50166147 https://www.bbc.com/news/technology-50166147
- exikyut 5y ago
  This sounds like a situation where the husband installed the malware, however, as opposed to a shady provider/operator/carrier.

saagarjha 5y ago

A family member of mine has one of these. Of course, being a good grandson, I tell him to use it for phone calls only and never sign into anything. Soon after setting it up he started complaining that it was showing him ads; I was confused because he had barely touched it but turns out the phone has a hidden carrier “app updater” (read: remote installer) that had silently downloaded several adware packages to his device. It is outrageous that we push these devices to older, frequently technically illiterate people. There has to be a better system behind this than “we gave them a free phone, who cares if it’s actively unsafe to actually use”.

jl6 5y ago

How much do these devices typically cost, e.g. to an end-user acquiring via the assistance programme?

giantrobot 5y ago
Assurance Wireless has phones that are given to subscribers at no out of pocket cost. They also sell a number of current-ish phones. The free phones are carrier locked and the SIMs are locked so they're only usable in phones Assurance provides.

baybal2 5y ago

UNIMAX - is that's the same outfit which OEMed for DNS from recent news, and been caught doing the same in India, and few African countries?

ignoramous 5y ago
Could you please elaborate what is meant by "OEMed for DNS"?
- tyingq 5y ago
  DNS is probably a typo of ANS (American Network Solutions). OEM is "Original Equipment Manufacturer", and "OEMed" means "we make the phone but put your brand on the phone so you appear to be the OEM". So they seem to be saying UNIMAX may be the actual manufacturer of ANS phones.
- baybal2 5y ago
  Manufactured phones under contract for DNS - a retail chain in Russia which got hit by preinstaled malware https://therecord.media/malware-found-preinstalled-in-classic-push-button-phones-sold-in-russia/ https://therecord.media/malware-found-preinstalled-in-classi...

thowaway959125 5y ago

Is this not a national security issue when looked at in a broader scope? The Chinese company behind this seems to solely target the North American market and makes medical devices, IoT devices, and other things. According to their homepage, their LA based office employs engineers from "United Bell Lab, Oracle, Motorola and other well-known international companies". What else are they root-kitting? With this particular Android one they are freely able to brick devices at will, if it was ever necessary. http://www.teleepoch.com/company.html http://www.teleepoch.com/company.html

DiabloD3 5y ago
This is a national security issue, but I will tell you the most important thing I've discovered: talking about malware, especially when employed against the technically illiterate, as a national security issue will get you attacked online. People either freak out and shoot the messenger (either because they misunderstand how deep the technical illiteracy goes amongst the aging population or they are a member technical illiterate aging population and resist any effort to be educated), or they directly profit from it (companies that are part of China's spy effort, domestic or foreign), or they're just so goddamned dense they give excuses like "well I've never seen it, so it doesn't exist". Also, as a side note: we probably should start considering advertising platforms a form of malware as well. Given how many systems run a WebView to display their content, and ad systems run Javascript, and it's a pipedream to ever think Javascript in a browser can ever be made to be secure (even if all it does is leak metadata and perform tracking); ads are, fundamentally, a way to inject malware and should be considered a national security issue. And yes, I'm aware two of the largest tech companies are ad platforms that have side gigs (Google and Facebook); I, frankly, don't care. If your business revolves around a criminal enterprise that is claimed to be legal purely because of a loophole, then you should go out of business once that loophole is closed.
- matheusmoreira 5y ago
  > we probably should start considering advertising platforms a form of malware as well Absolutely! They've been used as malware vectors numerous times in the past. One of infinite reasons to block them unconditionally and make no exceptions.

cascom 5y ago

You’d think this would be good fodder for a class action lawsuit, no?

matheusmoreira 5y ago
Against the chinese?
- hellbannedguy 5y ago
  These Lifeline phones are sold, or given away, by major USA telecoms. You would think they would be partially liable for malware on their phones? They make money counting on low income Americans going over their free rate tier, and advertising.
  - pbhjpbhj 5y ago
    In consumer law in the UK _sellers_ are responsible for what they sell. This seems right as it means you can sue the seller, they can sue their supplier if they too were sold a product that didn't meet the description of what they were sold. That way the seller, who can afford to spend on expertise to make sure products are up to scratch, bears responsibility. It's not perfect, but it makes sense this way IMO.
    - verall 5y ago
      It's the same in America

butz 5y ago

What tools should I use to dump filesystem from Android device and scan it for malware?

batch12 5y ago
As far as filesystem goes, it depends if your device is rooted or not. Assuming nonroot, you could use adb to list then download all packages. This would provide copies of most apps. In many cases, these can be decompiled with apktool. You could also use adb to pull other files, though not all, from the phone for inspection.
ta988 5y ago
If it is not rooted you may not be able to see everything. And still no warranties that the bootloader isn't full of crap, but that's a bit more rare.

batch12 5y ago

(2020)

blendergeek 5y ago

I see that Malwarebytes calls this malware and from browsing the comments, everyone here seems to agree. What makes this malware while other pre-installed adware from other companies is just "built-in"ads? Why does Google or Amazon get to "use ads to subsisidize their devices" while this company is using "pre-installed malware"? Does this "malware" exfiltrate personal data in violation of a the privacy policy? What does it do (besides annoy the user and show ads) that is malicious? Modern proprietary operating systems come with non-removable adware. That is the world we live in. I don't like. I don't use these operating systems. But they all do it.

lupire 5y ago
what adware is preinstalled without consent?
clemailacct1 5y ago
One issue in particular that makes it malware is that it attempts to download 3rd party apps from non-Google Play store. That’s a major security risk for introducing malicious APKs onto your phone.
- blendergeek 5y ago
  Given most Android phone and definitely bMS Windows regularly have third party bundled software I fail to see the difference here. While there is malware distributed outside of Google Play, unless you can point to an actually malicious thing this software did, I have give it a pass. Remember, the world has already decided that nonconsensual updates, ads, tracking, etc is normal if bundled with the OS and therefore not malware.