As we reported yesterday, security researchers from Kryptowire discovered a backdoor in the firmware of many Android smartphones sold in the U.S. The backdoor secretly collects information from phone owners and sends it to a server in China.
According to Kryptowire, the server belongs to a company called Shanghai Adups Technology Co. Ltd, which manufactures and sells a FOTA (Firmware Over The Air) software update system used by many manufacturers on their devices.
This malicious Android FOTA update system behaves exactly like any backdoor trojan. It communicates with the Chinese company's server requesting instructions and based on the commands received, it can perform multiple functions, which are described below:
- Collect and send SMS text messages to the China server every 72 hours
- Collects and sends call log information to China server every 72 hours
- Collects and sends user personally identifiable information to Chinese server every 24 hours
- Collects and sends the phone's IMSI and IMEI
- Collects and sends geo-location information
- Collects and sends a list of applications installed on the user's device
- Downloads and installs applications without the user's consent or knowledge
- Updates or deletes applications
- Updates the phone's firmware and reprograms the device
- Executes remote commands with elevated administrative privileges on the user's device
How can you protect yourself:
Check your device (you will need root privileges) and look for the following two system apps:
com.adups.fota.sysoper com.adups.fota
If you find the packages, you can delete them using an application that allows you to delete system packages. One of them is Jumobile's System App Remover.
Adups says on its website that its firmware runs on over 700 million Android devices. The company doesn't clarify whether all of these devices run the FOTA update system.
We thank our friend Stavros Anagnostopoulos for the information he gave us.
Update: Removing the above packages will disable checking for software updates. Proceed only if you are not interested.
