Dangerous software on budget Android phones allows remote control of the device

Security researchers have uncovered malicious software preinstalled at the supply chain level on budget Android devices across multiple countries.

Operating with system-level privileges that prevent standard uninstallation, the software enables remote app manipulation, data theft, ad fraud, and residential proxy node activity.

How the threat works

The software allows unknown parties to remotely control the device. The attackers are able to install or delete apps, steal data, and display fraudulent ads, earning illegal money. They also turn phones into nodes of a network used for other activities. To avoid security checks, the software temporarily disables the Google Play Store while it performs its actions.

Bitdefender's research

Bitdefender researchers are tracking the activity, which they have dubbed “Midnight Mimosa.” In addition to the software found pre-installed on the devices, the team identified 13 apps on Google Play that communicate with the same servers used by the perpetrators.

How did the problem arise?

The issue appears to have started during the manufacturing process of the phones. It is not yet clear whether the device manufacturers are involved intentionally or if the malware was added without their knowledge during production or distribution. The problem affects devices in multiple countries, with cases reported in Mexico, France, Italy, and Brazil, among others.

Because the software has system privileges, it is extremely difficult for the average user to remove it. Android's built-in protection mechanisms often have difficulty detecting it, as they consider it part of the device's factory software.

Read the original English article on Hacks.gr