Potentially millions of Android TVs and phones come with malware preinstalled. The bane of low-cost Android devices is showing no signs of going away.
Overall, Android devices have earned a decidedly mixed reputation for security. While the OS itself and Google's Pixels have stood up over the years against software exploits, the never-ending flow of malicious apps in Google Play and vulnerable devices from some third-party manufacturers have tarnished its image.
On Thursday, that image was further tarnished after two reports said that multiple lines of Android devices came with preinstalled malware that couldn’t be removed without users taking heroic measures.
The first report came from security firm Trend Micro. Researchers following up on a presentation delivered at the Black Hat security conference in Singapore reported that as many as 8.9 million phones comprising as many as 50 different brands were infected with malware. First documented by researchers from security firm Sophos, Guerrilla, as they named the malware, was found in 15 malicious apps that Google allowed into its Play market.
Guerrilla opens a backdoor that causes infected devices to regularly communicate with a remote command-and-control server to check if there are any new malicious updates for them to install. These malicious updates collect data about the users that the threat actor, which Trend Micro calls the Lemon Group, can sell to advertisers. Guerrilla then surreptitiously installs aggressive ad platforms that can deplete battery reserves and degrade the user experience.
The moral of this story is: do not buy cheap tech devices from brands you've never heard off before! Household brands are fine, such as: Sony, LG, Samsung (other brands are available 😉). If you buy cheap & unbranded tech - you're inviting the thieves to move in with you! Remember - these devices sit on your home and/or work network with access to any data flowing through that network. If these devices are used to log in to your email, bank, etc - they will have access to your credentials... It just isn't worth the risk to save a few quid!
No comments:
Post a Comment