Don't be greedy and cheap. More than 40 cheap Android phones are pre-installed with bank malware

Don't be greedy and cheap. More than 40 cheap Android phones are pre-installed with bank malware

In the current situation, the cost of a smart phone is already quite transparent. From the mobile phone market in China, although many mobile phones are mainly cost-effective, however, the difference between mobile phones with the same positioning is not big, that is to say, the cost of smartphones has been compressed to almost the limit. There is really a kind of "super cheap" mobile phone, one is letv's so-called "Hardware free" (you can see the ending ), another possibility is the "trap series" described in this article ".

According to Dr. Web, a Russian antivirus software company, more than 40 cheap Android smartphones are currently sold with Triada.231 Trojans and published a list of mobile phone models.

Triada is a very powerful Android banking Trojan program found in early 2016. It can be a root device and then infect Zygote. It is a core Android operating system process, the device cannot be deleted without erasing the entire device and re-installing the operating system.

Infected smartphones are sold worldwide

Dr. Web said it has found many new shipment devices, such as Leagoo and Doogee, that are not well-known brands (most in China. Vertex, Advan, and Cherry Mobile.

"Not only in Russia, malware exists in devices sold across the globe by these brands, such as Poland, Indonesia, China, the Czech Republic, Mexico, Kazakhstan, and Serbia ." Dr. Web spokesman told the media by email earlier today.

In July 2017, researchers found the same Triada Trojan Horse on four low-cost Android smartphones: Leagoo M5 Plus, Leagoo M8, Nomu S10, and Nomu S20. The researchers continued to investigate the issue and eventually found 42 smartphone models with random pre-installed malware.

Trojan originated from a software developer in Shanghai

The kill software company said it contacted all affected suppliers and considered one of their co-dealers to be behind the scenes and injected Trojans before launching the device. At the same time, researchers found that software developers in Shanghai are most likely to be the source of Triada infection.

The study said: "The company provided Leagoo with one of its applications to include it in images of mobile operating systems and add third-party code to the system library before compilation. "Unfortunately, this controversial requirement has not aroused any doubt from the manufacturer. Eventually, Android. Triada.231 has no obstacle to entering the smartphone ."

The company is also behind the scenes of other malware activities

The researchers said that after analyzing the application, we found that it used the same certificate as the MulDrop.924 malware (more than 1 million downloads in the Google Play Store, presumably, the hackers behind the scenes are the same person.

The list of Android smartphone models infected with Triada Trojan is as follows:

Leagoo M5
Leagoo M5 Plus
Leagoo M5 Edge
Leagoo M8
Leagoo M8 Pro
Leagoo Z5C
Leagoo T1 Plus
Leagoo Z3C
Leagoo Z1C
Leagoo M9
ARK Benefit M8
Zopo Speed 7 Plus
UHANS A101
Doogee X5 Max
Doogee X5 Max Pro
Doogee Shoot 1
Doogee Shoot 2
Tecno W2
Homtom HT16
Umi London
Kiano Elegance 5.1
ILife Fivo Lite
Mito A39
Vertex Impress InTouch 4G
Vertex Impress Genius
MyPhone Hammer Energy
Advan S5E NXT
Advan S4Z
Advan i5E
STF AERIAL PLUS
STF JOY PRO
Tesla SP6.2
Cubot Rainbow
EXTREME 7
Haier T51
Cherry Mobile Flare S5
Cherry Mobile Flare J2S
Cherry Mobile Flare P1
NOA H6
Pelitt T1 PLUS
Prestigio Grace M5 LTE
BQ 5510

The mobile phone models listed by the company may be just the tip of the iceberg, and more mobile phones with potential risks are still active in the global market. Wool comes out of the goat. When the mobile phone cost is limited, further low prices may only be due to cutting corners somewhere or other means to benefit suppliers. Price/performance ratio is only one of the considerations when purchasing mobile phones, but do not neglect other important factors.

* Reference Source: BleepingComputer

This article permanently updates link: https://www.bkjia.com/Linux/2018-03/151283.htm