- Budget Android phones shipped with firmware-level malware preinstalled before reaching customers
- Malware generated fraudulent ad revenue and turned infected devices into residential proxies
- Victims spanned 150 countries, with cleanup often requiring firmware-level remediation
Imagine buying a brand new, sealed Android phone, and later realizing it came with preinstalled malware rooted deeply into the firmware and thus almost impossible to remove - generating fraudulent ad clicks for a malicious third party, and even turning the phones into residential proxies to be used for whatever sinister purposes.
Security researchers Bitdefender found an unidentified threat actor managed to compromise the supply chain of multiple smartphone manufacturers and added malware on a firmware level before the devices were even shipped to stores.
A number of brands were mentioned, including Doogee S200 X, Doogee Fire 3 Max, and Cubot KINGKONG X - both Chinese smartphone manufacturers building budget, rugged Android phones.
The reports also mention ripoff devices impersonating Samsung and Apple products. In general, these are devices using MediaTek chipsets, which were infected in a way that allowed the attackers to tamper with applications, grant themselves higher privileges, and even do remote code execution (RCE) attacks without the victim’s knowledge.
Victims across the world
Unfortunately, these devices were shipped all over the world, and Bitdefender claims “thousands” of people were victims, scattered across some 150 countries around the world, with the highest concentration found in Mexico, France, Italy, United States, Germany, Brazil, and Spain.
The malware comes in different shapes and sizes. So far, Bitdefender uncovered 32 malicious apps, including those pretending to be weather apps, file managers app lockers, OCR tools, and audio editors. All of these do the same thing - create an invisible overlay over different apps and register an ad being viewed, despite the fact that the user never actually saw it.
That way, whoever installed the malware scams the ad network into thinking the ad was served to thousands of users which, in turn, generates profit. We don’t know exactly how many devices are compromised this way, or how much money the crooks stole this way.
"The system app itself doesn’t register the fraudulent impressions and clicks," Bitdefender said. "The revenue engine is driven by the dropped cover apps, including real-looking weather, app-lock, note, and OCR apps, which load genuine ads through a legitimate ad SDK. The goal is simple: to load an invisible window on top of apps that registers ads being shown."
Spilling into the Play Store
Bitdefender also said that one of the uncovered applications (the app locker one), contained a TCP proxy element that registered the compromised phones with a remote command server. After successful registration, the attackers were able to forward traffic through the phone, essentially creating a residential proxy service that criminals can use for different things, from launching DDoS attacks to participating in spam and wire fraud.
They also found more than a dozen applications on the Google Play Store with the same fraudulent advertising code, as well as the same communications infrastructure. These, however, required manual installation and required users to grant them the requested permissions, which might have raised flags with the users.
Removing the malware isn’t as easy as simply uninstalling the app. The researchers said that many of the devices require cleanup on the firmware level, or disabling the malicious component using Android Debug Bridge (ADB), which could be too technical for many victims.
The easier and more elegant solution is also a more expensive one - don’t buy devices from brands with a shady reputation.