A new vulnerability has been discovered in hundreds of thousands of Android devices, which experts say is sending data back to China for unknown reasons.
The software was created by a Chinese company called Shanghai Adups Technology Company, and according to a representative for the tech developer, it has been installed on at least 700,000 devices worldwide. Security experts at the Virginia-based Kryptowire found the software running in the background when searching for more traditional vulnerabilities.
You Wouldn’t Know It Was There
This is not a bug, nor is it a software that was made to be found. Rather, it is a hidden feature that was put in specifically to mine information without the user knowing it was being collected. It collects call logs, user location, text messages, and other data in full, before sending it directly to a Chinese server.
The creation and placement was deliberate, and Android devices that are cheaper, or prepaid, are the most likely to hold the software. For as long as they have been running the device, they may have been unknowingly sending this info through the backdoor. But to who?
The Unknown Motivations Of China
No one knows why this software has been installed. On the more innocent (but still violating and sleazy) side, it could be an advertising measure meant to give Chinese markets a leg up on developing new products for the masses interested in lower cost products, of which China produces most.
On the more alarming hand, it could be a measure by the Chinese government to gather intelligence from foreign markets. But what could they want with text messages from Betty Lou in El Paso, Texas? That isn’t clear, nor is the scope of the data mining itself. So far the experts at Kryptowire are still investigating the matter, and have only found some of the potential applications for the software.
A Simple Mistake
Adups is already on the defensive. According to Lily Lim, a California lawyer they hired to represent them in the US, it was a mistake. A statement from the company claims that it was a software only meant to go into Chinese devices in order to track purchasing patterns for a local company.
One company that manufactures US phones, of which 120,000 devices have been compromised, claim that they have corrected the mistake. Their software has been given a patch that will remove the firmware, and they say that Adups has destroyed all information from US customers on the server.
But users with ZTE and Huawei in particular may want to get something new.
Source: NY Times
