Attention Those Using Cheap Android Phones: Malware Found

Experts warn users that some cheap Android phones are sold with malware at the firmware level.

Some cheap Android phones sold at affordable prices in the market contain malware that is installed at the firmware level right out of the box. Security researchers state that these devices can be controlled by cyber attackers without the users' knowledge.

Investigations by Bitdefender reveal that these interventions carried out at the supply chain stage affected thousands of devices in 150 countries around the world. This situation creates a serious security vulnerability while preventing users from using their devices safely.

Security Breach in Supply Chain

Researchers found that budget-friendly and durable models such as Doogee S200 X, Doogee Fire 3 Max and Cubot KINGKONG X were affected by this situation. It has also been reported that counterfeit devices imitating Samsung and Apple products pose similar risks.

The majority of these devices are equipped with MediaTek processors. Using this hardware structure, attackers can gain authority over applications and perform remote code execution attacks without the user's knowledge.

The affected devices are spread over a wide geography around the world. The highest case density was observed in countries such as Mexico, France, Italy, the United States, Germany, Brazil and Spain.

Infecting devices at the firmware level makes it very difficult to remove malware. A standard application deletion is not enough to eliminate this threat.

Bitdefender experts emphasize that the cleaning process should be done at the firmware level. Although it is recommended to disable malicious components using Android Debug Bridge (ADB) as an alternative, this method constitutes a very technical process for many users.

Ad Fraud and Proxy Network

So far, 32 different malicious applications have been detected, hiding under names such as weather applications, file managers, application lockers and OCR tools. These applications enable fake advertising revenue to be generated by loading ads in the background that users do not see.

The system app does not directly record ad clicks. Instead, invisible windows are opened through installed fake applications and the information that ads are displayed is transmitted to ad networks.

Some applications include TCP proxy elements to register devices to a remote command server. In this way, attackers can turn captured phones into residential proxy services.

This proxy network can be used for malicious purposes such as conducting DDoS attacks or spamming activities. It is stated that there are more than a dozen applications with a similar code structure on the Google Play Store.

These applications differ from infections at the firmware level of the device as they require users to install them manually. However, in both scenarios, the result is a complete compromise of the device.

Experts state that the most effective way to avoid such problems is to choose devices from reliable brands. Do you think security criteria are taken into consideration sufficiently when purchasing a smartphone?