Your New Budget Phone Might Come With an Unwanted Extra
Buying a new phone normally means removing a few unwanted apps, changing the wallpaper and wondering why you agreed to quite so many notifications.
Some owners of low-cost Android phones have been getting something rather less welcome: malware already installed inside the device firmware.
Researchers at Bitdefender are tracking the activity as Midnight Mimosa.
The malware has been discovered on Android devices using MediaTek platforms and appears particularly common among inexpensive, white-label and counterfeit smartphones.
Thousands of affected devices have been identified across more than 150 countries, including the UK.
Malware With the Best Seat in the House
The malicious component operates with system-level privileges.
That gives its operators considerably more control than an ordinary malicious application.
It can remotely install and remove applications, grant permissions, access notifications and SMS capabilities, and load additional code supplied by its operators.
Additional applications installed through the malware can be used for advertising and click fraud. Devices can also be turned into residential proxies, meaning criminals can route internet traffic through an innocent owner’s phone.
That makes the traffic appear to originate from a genuine household internet connection rather than criminal infrastructure.
Researchers also found 13 applications previously available through Google Play communicating with infrastructure associated with the campaign. Those applications are no longer available from the store.
Why Preinstalled Malware Is Different
Normally, removing malware starts with uninstalling the offending application.
That becomes considerably more complicated when the malicious component is sitting inside the phone’s system partition.
A normal factory reset may not solve the problem. Removing the infection can require firmware-level intervention or technical steps that most consumers would not realistically undertake.
The findings highlight the cyber security risks within technology supply chains, particularly around extremely cheap or counterfeit hardware.
Buying a bargain smartphone can be tempting.
Buying one that secretly moonlights as somebody else’s proxy server is rather less appealing.