Secret Back Door in Some U.S. Phones Sent Data to China, Analysts Say

NY Slimes ^ | NOV 15, 2016 | MATT APUZZO and MICHAEL S. SCHMIDT

[null and void]

WASHINGTON — For about $50, you can get a smartphone with a high-definition display, fast data service and, according to security contractors, a secret feature: a backdoor that sends all your text messages to China every 72 hours.

Kryptowire, the security firm that discovered the vulnerability, said the Adups software transmitted the full contents of text messages, contact lists, call logs, location information and other data to a Chinese server. The code comes preinstalled on phones and the surveillance is not disclosed to users...

Security experts frequently discover vulnerabilities in consumer electronics, but this case is exceptional. It was not a bug. Rather, Adups intentionally designed the software to help a Chinese phone manufacturer monitor user behavior...

At the heart of the issue is a special type of software, known as firmware, that tells phones how to operate. Adups provides the code that lets companies remotely update their firmware, an important function that is largely unseen by users. Normally, when a phone manufacturer updates its firmware, it tells customers what it is doing and whether it will use any personal information. Even if that is disclosed in long legal disclosures that customers routinely ignore, it is at least disclosed. That did not happen with the Adups software, Kryptowire said.

The software was written at the request of an unidentified Chinese manufacturer that wanted the ability to store call logs, text messages and other data, according to the Adups document. Adups said the Chinese company used the data for customer support.

Because Adups has not published a list of affected phones...

Kryptowire discovered the problem through a combination of happenstance and curiosity. A researcher there bought an inexpensive phone, the BLU R1 HD, for a trip overseas. While setting up the phone, he noticed unusual network activity...

[null and void]

Android=google="Don't be evil"

[Garth Tater]

I don't see how this has anything to do with Android or Google. Adups may be running inside of the Android sandbox but it is not part of Android nor is Android in any way responsible for its inclusion in the phone's software suite.

That being said... yep, Google is evil and Android IS Google's evil stepchild.

[null and void]

At no point in history has any government ever wanted its people to be defenseless for any good reason ~ nully's son

The biggest killer of mankind

Nut-job Conspiracy Theory Ping!

To get onto The Nut-job Conspiracy Theory Ping List you must threaten to report me to the Mods if I don't add you to the list...

[Fungi]

Your most honorable Nullness, please forgive me for not understanding this post. True or not? Can it be verified? As always, may a void never encompass the entirety of your humble nullness.

[Harmless Teddy Bear]

They now have my top secret dry brine recipe for the turkey.

Everyone be very afraid.

[null and void]

AFAIK, absolutely true. The Chinese bugged the phones to report EVERYTHING back to the Mainland.

Found the story on a reputable trade journal web site.

And hey, I you can’t trust the NYT, who can you trust???

[VanShuyten]

Good thing the Chicoms don’t do that with the chips we use in our weapon systems......

[null and void]

Well, your enemies have it.

How’s about sharing it with your FRiends?

[Veggie Todd]

Will this hurt or help my chances of securing a mail-order bride?

[null and void]

That depends entirely on what’s in your texts...

[Veggie Todd]

“That depends entirely on what’s in your texts...”

Well, I’m being coached by Carlos Danger.

[null and void]

Hard to say, then...

[pax_et_bonum]

Guess I just sent China a whole bunch of really stupid memes.

[Fungi]

Your most honorable Nullness, the void has engulfed me. What the hell does AFAIK mean?

[null and void]

As Far As I Know

[Fungi]

Merci beaucoup. The void has lifted, the stars show through, the whales sing, dolphins jump, fungi shed their spores, asci explode through their operculum, flowers effloresce, trilobite beetles find their mate, and the angels sing. All is well your most honorable Nullness.

[Swordmaker]

Also posted previously over here:

http://www.freerepublic.com/focus/f-chat/3494715/posts

[Kellis91789]

Nothing in this article assures users that this firmware based spyware could not send your passwords, electronic banking info, etc. to unknown third parties.

I also find it hard to believe that Android does not have protections to examine itself against a Google master copy and automatically delete any changes third parties have made to it.

[Garth Tater]

Nothing in this article assures users that this firmware based spyware could not send your passwords, electronic banking info, etc. to unknown third parties.

I think this article makes it pretty clear that this spyware DOES send your passwords, electronic banking info, etc to third parties.

I also find it hard to believe that Android does not have protections to examine itself against a Google master copy and automatically delete any changes third parties have made to it.

Android is an open source software project. Android Open Souce Project There are many, many modifications made to it by many, many people and firms. There is absolutely no way that Google can keep a "master copy" and automatically delete any changes third parties have made to it. That would kind of defeat the idea of open source software, if you know what I mean. Further more, Adups is not a modification made to Android, it is a piece of spyware that runs inside Android and possibly inside the firmware of the phone that was placed on the phone by the phone's manufacturer.

[Kellis91789]

That is scary. I didn’t realize Android was open source. I guess I will never own an Android phone. What about the Windows phones ?