Bitdefender Warns Budget Android Phones Shipped With Firmware-Level Malware
Bitdefender researchers say budget Android phones from several brands were shipped with firmware-level malware that generated fraudulent ad revenue and turned infected devices into residential proxies across about 150 countries.
Bitdefender said an unidentified threat actor compromised the supply chain of multiple smartphone manufacturers and added the malicious code at the firmware level before the devices reached stores. The affected models named in the research include the Doogee S200 X, Doogee Fire 3 Max and Cubot KINGKONG X, all budget, rugged Android phones made by Chinese manufacturers. The findings also mention counterfeit devices impersonating Samsung and Apple products. In general, the devices used MediaTek chipsets, and the infection allowed attackers to tamper with applications, grant themselves higher privileges and carry out remote code execution without the victim's knowledge.
Victims were spread worldwide. Bitdefender said the compromised devices shipped to about 150 countries, with the highest concentrations in Mexico, France, Italy, the United States, Germany, Brazil and Spain. The researchers uncovered 32 malicious apps, including programs posing as weather apps, file managers, app lockers, OCR tools and audio editors.
All of those apps performed the same core function, according to Bitdefender: they created an invisible overlay on top of other apps and registered an ad as viewed even though the user never saw it. That trick misled ad networks into believing an ad had been served to thousands of users, generating revenue for whoever installed the malware. The exact number of compromised devices and the amount of money stolen were not known.
Bitdefender described the system app as not registering the fraudulent impressions and clicks itself. It said the revenue engine was driven by the dropped cover apps, including realistic-looking weather, app-lock, note and OCR apps, which loaded genuine ads through a legitimate ad software development kit. The goal was to load an invisible window on top of apps and register ads as shown.
The researchers also found that one uncovered app, an app locker, contained a TCP proxy element that registered compromised phones with a remote command server. After registration, the attackers could forward traffic through the phone, creating a residential proxy service that criminals could use for purposes ranging from distributed denial-of-service attacks to spam and wire fraud.
More than a dozen applications on the Google Play Store were found with the same fraudulent advertising code and the same communications infrastructure, Bitdefender said. Those apps, however, required manual installation and required users to grant the requested permissions, which might have raised suspicion.
Removing the malware is not as simple as uninstalling an app. Bitdefender said many devices require cleanup at the firmware level or disabling the malicious component using Android Debug Bridge, which may be too technical for many victims. The easier and more elegant solution is also more expensive: do not buy devices from brands with a shady reputation.