Summary Points
- Preinstalled malware on low-cost Android devices, particularly MediaTek-based models, allows covert installation of malicious apps, ad fraud activities, and the transformation of devices into residential proxies and botnets.
- The malware disables Google Play Store to bypass safeguards, then re-enables it post-installation, making removal difficult without firmware-level intervention.
- Most affected devices are in Mexico, with a supply chain compromise linked to Chinese manufacturers, highlighting a significant threat to device integrity and user security.
Threat Overview, Attack Techniques, and Targets
Low-cost Android smartphones have been found with malicious software built into the firmware. This malware, known as "com.android.system.lite," operates with system-level permissions. It can install or uninstall apps, grant itself extra access to services like SMS and notifications, and load code from remote servers.
This malware fetches configurations from external servers and downloads additional payloads. These payloads perform ad fraud and silently install or remove partner apps. These apps contain features such as proxyware, ad fraud, and remote code execution. The malware can also grant itself permissions to any app on the device, which gives bad actors control over the device.
The attack mainly targets Android devices built on MediaTek platforms. Researchers have found at least 13 apps on Google Play that communicate with the same control servers as the malware. Some of these apps include weather, music, and utility tools.
Operators likely use these methods to turn infected devices into part of large botnets. They carry out activities like ad click fraud, collecting device data, and turning devices into proxies for hiding malicious activity.
Impact, Security Implications, and Remediation Guidance
The malware can disable the Google Play Store before installing payload apps to avoid detection by security safeguards like Play Protect. It then re-enables the store after the malware is installed. This process helps the malware avoid detection and removal.
Most infected devices are in Mexico, but devices in France, Italy, the U.S., and other countries are also affected. The malware appears to come from the supply chain of certain Chinese Android device manufacturers, though it’s not clear if the manufacturers knew or approved of the infection.
This threat shows how preinstalled malware can bypass normal security defenses. Since the malware is part of the system firmware, users cannot remove it through regular uninstallation. Fixing this issue requires firmware updates or cleanup at the device level, which most users cannot perform easily.
Remediation guidance should be obtained from the device vendor or relevant authority. The affected owners should contact their device makers or authorized service providers for help.
Discover More Technology Insights
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
