Security firm Check Point has recently detected a severe infection in 38 Android devices, belonging to a large telecommunications company and a multinational technology company. Interestingly, the malware was pre-installed.
According to the findings, the malware were already present on the devices even before the users received them. The malicious apps were not part of the official ROM supplied by the vendor, and were added somewhere along the supply chain. Six of the malware instances were added by a malicious actor to the device's ROM using system privileges, meaning they couldn't be removed by the user and the device had to be re-flashed, Check Point said.
Most of the malware found to be pre-installed on the devices were info-stealers and rough ad networks, and one of them was Slocker, a mobile ransomware. Slocker uses the AES encryption algorithm to encrypt all files on the device and demand ransom in return for their decryption key. Slocker uses Tor for its C&C communications.
Among the "pre-infected" smarphones are the following:
- Galaxy S4
- Galaxy S7
- Galaxy Note 2
- Galaxy Note 3
- Galaxy Note 4
- Galaxy Note 8
- Galaxy Note 2
- Galaxy Note Edge
- Galaxy A5
- Galaxy Tab S2
- Galaxy Tab 2
- Xiaomi Mi 4i
- Xiaomi Redmi
- vivo X6 plus
- Asus Zenfone 2
The most notable rough adnet which targeted the devices is the Loki Malware. This complex malware operates by using several different components; each has its own functionality and role in achieving the malware's malicious goal. The malware displays illegitimate advertisements to generate revenue. As part of its operation, the malware steals data about the device and installs itself to system, allowing it to take full control of the device and achieve persistency.
As a general rule, users should avoid risky websites and download apps only from official and trusted app stores. However, following these guidelines is not enough to ensure their security. Pre-installed malware compromise the security even of the most careful users. In addition, a user who receives a device already containing malware will not be able to notice any change in the device's activity which often occur once a malware is installed.
The discovery of the pre-installed malware raises alarming issues regarding mobile security. Users could receive devices which contain backdoors or are rooted without their knowledge.