A Chinese company has admitted that it intentionally planted spyware on newly manufactured android smartphones. This malware has been used to gather personal information about users, as well as to log calls and other data. The malware was authored by a Chinese company called Shanghai Adups Technology Company, whose software is said to run on more than 700 million devices around the world.
Earlier this week, researchers at Kryptowire discovered that malware was present on phones distributed by U.S.-based smartphone manufacturer, Blu Products. The malware contained on these devices has the ability to track user location data, log calls and spy on sent text messages. The phone-based malware was able to remain undetected by antivirus programs because it was part of the underlying device firmware, which gives it control over all other programs and system updates.
While rightly identified as spyware, Shanghai Adups Technology Company insists that the program was originally written as a customer service tool. The original design called for a program that would help “screen out junk texts and calls from advertisers”. The inherent data collection was supposed to be used solely for the benefit of the customer. Adups claims that the software was designed at the request of an unidentified Chinese manufacturer and was not intended for phones bound for the United States.
Intentional or not, the Adups data mining software has drawn the attention of several security groups, including the Department of Homeland Security. Even if benign in intent, the fact that these devices shipped with a security backdoor opens them up to exploitation from other malicious parties. Hackers or other interested parties could intercept the collected data or piggyback their own malware on the security holes inherent in the firmware. This could lead to further surveillance threats or the spread of malware to other devices.
Since the discovery, Blu Products has acknowledged the presence of the third party spyware on various models of their smartphone line, including: R1 HD, Blu Energy X Plus 2, Studio Touch, Advance 4.0 L2, Neo XL and Energy Diamond. Blu has taken steps to address the issue and has released firmware updates to remove the malware. If you have one of the affected phones, these updates should be applied automatically.
