Android Devices Gets Their Malware Somewhere In The Supply Chain

According to Check Point Software Technologies, Android devices from companies like Samsung, LG, Xiaomi, ZTE, Oppo, Vivo, Asus and Lenovo already have malware present in them before they reach the customer hands.

Check Point discovers various malwares ranging from info-stealers, ransomware like Slocker and Loki, which shows “illegitimate advertisements” to generate revenue while stealing device information and information stealers. The company says it analyzed 36 Android devices, belonging to a large telecommunications company and a multinational technology company.

Interestingly, Check Point researcher, Oren Koriat, says that none of the malware they detected was not downloaded to the device as a result of the users’ use, instead the devices arrived with malwares present in them. The malicious apps were not part of the official ROM supplied by the vendor and they were added somewhere along the supply chain.

According to Koriat, six of the malware instances were added by a malicious actor to the device’s ROM using system privileges, meaning they could not be removed by the user and the device had to be re-flashed.

Pre-installed malware compromise the security even of the most careful users. In addition, a user who receives a device already having malware will not be able to notice any change in the device’s activity, which often occur once a malware is installed.

The malicious package names and devices they were spotted on are listed below. Since they were added after manufacture, vendors are not to blame.

Security in Android devices is a very serious concerns due to its fragmentation. In last years Android security annual report, Google claimed that the company is taking Android security very seriously and now scans around 400 million devices and 6 billion installed apps each day. Recently, WikiLeaks revealed that CIA is working on tools and obtaining zero-day exploits for iOS and various devices including Android and Windows.

Source