This is not the case.
Instead, an accurate assessment is that a previously active Windows botnet is spreading a Mirai bot variant.
Shanghai Adups Technology Co. claims the software "inadvertently" included a secret backdoor.
A number of budget Android smartphones are suspected of sending text messages to China every 72 hours.
Security firm Kryptowire, which first reported the secret backdoor on Tuesday, blamed a firmware developed by Shanghai Adups Technology Company.
The majority of monitoring activities used Adups' Firmware Over The Air (FOTA) update system, developed in response to user demand to screen out junk texts and calls from advertisers.
"Since its founding, Adups FOTA has taken customer and user privacy very seriously," the organization said in a statement published Wednesday.
But the software, according to Kryptowire, transmits sensitive personal data without disclosure or user consent.
Tech Radar released a list of affected models from Miami-based mobile manufacturer Blu. Owners of the R1 HD, Energy X Plus 2, Studio Touch, Advance 4.0 L2, Neo XL, or Energy Diamond are encouraged to check their phone by navigating to Settings > Apps > Menu > Show System > Wireless Update. If it is running 184.108.40.206.004, you're in the clear, Tech Radar said. If it reads 5.0.x to 5.3.x, however, you should contact Blu immediately.
It remains unclear how many of the handsets were sold in the US.
These devices relay information like text messages, contact lists, call history (with full telephone numbers), and unique device identifiers, Kryptowire explained. The firmware also collected details about the use of installed applications, and is able to remotely program the gadget.
Shanghai Adups, however, claims this is all a misunderstanding; a simple mistake that has since been rectified.
"In June 2016, some Blu Product, Inc. devices applied a version of the Adups FOTA application that inadvertently included the functionality of flagging junk texts and calls," the company statement said. "When Blu raised objections, Adups took immediate measures to disable that functionality on Blu phones."
It also confirmed that no information—text messages, contacts, phone logs—was disclosed, and any data received from a Blu phone during that period was deleted.
"Also, Adups has been working to further improve the privacy protections in its products. Adups sincerely apologizes to its partners and users," it continued. "We will enhance process management and work to improve transparency, and deliver high-quality products and best service to provide the best possible data security for all our customers."
Neither Google nor Blu immediately responded to PCMag's request for comment.
ZTE, meanwhile, maintains that none of its US devices "have ever had the Adups software installed on them, and will not," the mobile manufacturer told Android Headlines.
Google has apparently told the company to also remove its software from any Android phones that run its app store, Google Play. Data collection and transmission on the affected phones are handled by two system applications – com.adups.fota.sysoper and com.adups.fota – neither of which can be disabled by the user. According to Kryptowire, data transmission of text messages and call logs takes place every 72 hours, and all other personally identifiable information is sent every 24 hours. The data is sent to four servers: bigdata.adups.com bigdata.adsunflower.com bigdata.adfuture.cn bigdata.advmob.cn They all resolve to the same IP address – 220.127.116.11 – which belongs to Adups. Further adding to suspicions, communication between phones and the servers included two elements that allow the data sent to be connected to a specific phone number.
In other words, rather than simply collecting data and aggregating it – something a lot of companies do (but disclose), the Adups software purposefully makes it possible to identify and track specific phones. In some respects, the Adups software is even more intrusive than the infamous Carrier IQ spyware, which was revealed in 2011 to be key-logging and transmitting data secretly.
That discovery sparked an outcry.
The technology was recently bought by AT&T. While Adups doesn't grab key logging or email address information, it does something much more worrying – enables apps to be updated and installed, and allows for remote execution and privilege escalation. As such, it would be possible for Adups to identify a specific phone, install additional spyware on it, and grant full access to the phone.
It would also be able to remove that software at a later date – ie, it would be the perfect spying tool. The specific phone that the researchers discovered the firmware on was the BLU R1 HD.
CEO of BLU Products, Samuel Ohev-Zion, said that the company was not aware of the firmware's capabilities, and that the company has now removed it. According to Adups, the software featured on the phone tested by Kryptowire was not intended to be included on phones in the United States market. ® Sponsored: Customer Identity and Access Management
The vulnerability was discovered by a Kryptowire, an American enterprise security firm. According to a New York Times report it wasn’t clear if the information went beyond the recipient of Shanghai Adups Technology Company, but it impacted Blu R1 HD and other phones. On its website, Adups says it builds firmware that runs on more than 700 million phones. Kryptowire concluded that the data sharing included full contexts of text messages, call logs, contact lists, location information, and other data.
There was other identifiable information, like each phone’s Mobile Subscriber Identity (IMSI) and the International Mobile Equipment Identity (IMEI). Blu Products told the Times that 120,000 of its phones were affected, but the leak was plugged through a software update.
Blu is known primarily for low-cost phones, such as the Blu R1 HD, which recently was part of a special offered by Amazon for $50. Adups provides software for ZTE and Huawei, although it’s unclear if the scope of the data-mining effort extends to other products as well.
According to the report, Adups assured Blu that all customer information had been destroyed and was not part of any intentional effort to keep the data or send to a government agency. The purpose of saving the information, according to Adups, was to identify client junk text messages and calls. Kryptowire shared its findings with the U.S. government, Blu, and Google. You can check out the full report for details about what it uncovered. Why this matters: The episode illustrates that data can often pass through many different companies as part of the process of creating a smartphone. While any crisis may have been averted here, it may give you pause about where you buy your next smartphone and which companies have hands in creating all of the software. This story, "Report: Backdoor access in the Blu R1 HD and other phones sent data to China" was originally published by Greenbot.
The backdoor software, initially discovered on the BLU R1 HD, sent massive amounts of personal data about the phones and their users’ activities back to servers in China that are owned by a firmware update software provider.
The data included phone number, location data, the content of text messages, calls made, and applications installed and used. The company, Shanghai AdUps Technologies, had apparently designed the backdoor to help Chinese phone manufacturers and carriers track the behavior of their customers for advertising purposes.
AdUps claims its software runs updates for more than 700 million devices worldwide, including smartphones, tablets, and automobile entertainment systems.
It is installed on smartphones from Huawei and ZTE sold in China. A lawyer for the company told The New York Times that the data was not being collected for the Chinese government, stating, “This is a private company that made a mistake.” The backdoor was part of the commercial Firmware Over The Air (FOTA) update software installed on BLU Android devices provided as a service to BLU by AdUps.
In a report on the finding, a Kryptowire spokesperson said: These devices actively transmitted user and device information including the full-body of text messages, contact lists, call history with full telephone numbers, unique device identifiers including the International Mobile Subscriber Identity (IMSI) and the International Mobile Equipment Identity (IMEI).
The firmware could target specific users and text messages matching remotely defined keywords.
The firmware also collected and transmitted information about the use of applications installed on the monitored device, bypassed the Android permission model, executed remote commands with escalated (system) privileges, and was able to remotely reprogram the devices...
The firmware that shipped with the mobile devices and subsequent updates allowed for the remote installation of applications without the users' consent and, in some versions of the software, the transmission of fine-grained device location information. The transmissions were discovered by Kryptowire in lab testing.
The data collection and transmission capability is spread across different applications and files.
Text message data (encrypted with DES, which Kryptowire researchers were able to recover the key for) and call log information were sent back every 72 hours. Other data, including location data and app use, was sent every 24 hours. A BLU spokesperson told Ars that the software backdoor affected a “limited number of BLU devices” and that the “affected application has since been self-updated and the functionality verified to be no longer collecting or sending this information.” According to The New York Times report, BLU reported about 120,000 devices were affected and patched.
Image from When CSI Meets Public WiFi To force the target to send CSI to the base station, the attack sends an ICMP (Internet Control Message Protocol) request to the victim, which sends back an ICMP Reply. WindTalker only needs to gather 800 packets per second of replies to analyse the user's keystrokes. As well as the signal analysis, the Wi-Fi base station was modified with a panel antenna for better sensitivity, and the researchers wrote WindTalker's software to watch out for HTTPS sessions (since that might alert them to when the user was hitting a payments site – AliPay was chosen for this experiment). The researchers note that there's a simple way to block WindTalker: companies crafting payment apps should randomise their keypad layouts.
The attacker can still infer the finger's position – but won't know what key was pressed. ® Sponsored: Customer Identity and Access Management
This release also includes additional improvements and bug fixes. • Adds support for pairing multiple Apple Watches to one iPhone • Adds Nearby in Maps to browse for places around you by category, including Food, Shopping, and more • Adds support for system language in Catalan, Croatian, Slovak, Romanian, and Ukrainian • Adds support for dictation in Catalan, Croatian, Slovak, Romanian, Ukrainian, and English (Saudi Arabia, UAE, and Indonesia) • Adds support for Siri in Malay, Finnish, and Hebrew • Increases frequency of background heart rate measurements when you are stationary For information on the security content of this update, please visit this website: http://support.apple.com/kb/HT1222 watchOS 2.1 This update includes new language support and bug fixes. Adds support for system language in Arabic, Czech, Greek, Hebrew, Hungarian, Malay, Portuguese (Portugal), and Vietnamese Adds support for Right-to-Left user interface Adds ability to switch between Latin and Hindi numerals for Arabic Adds a new complication for Islamic and Hebrew Calendars Adds support for Siri and dictation in Arabic (Saudi Arabia, United Arab Emirates) Adds support for dictation in English (Malaysia), Czech, Greek, Hebrew, Hungarian, Portuguese (Portugal), and Vietnamese Resolves an issue that could prevent events from updating in the Calendar complication Fixes an issue that could prevent the time from displaying in Power Reserve mode Addresses issues that could prevent third party apps from launching Fixes an issue that could prevent third-party app icons from displaying correctly Fixes an issue that could cause instability when changing the system language For information on the security content of this update, please visit this website: watchOS 2.0.1 This update contains new emoji characters, performance improvements, and bug fixes, including: Fixes an issue that could cause software updates to stall Fixes issues that were impacting battery performance Resolves an issue that prevented a managed iPhone from syncing iOS Calendar events to Apple Watch Addresses an issue that could prevent location information from properly updating Fixes an issue that could cause Digital Touch to send from an email address instead of a phone number Addresses an issue that could cause instability when using a Live Photo as a watch face Resolves an issue that allows the sensors to stay on indefinitely when using Siri to measure heart rate For information on the security content of this update, please visit this website: watchOS 2.0 This update contains new features and capabilities for users and developers, including the following: New watch faces and timekeeping features Time-lapse videos of Hong Kong, London, Mack Lake, New York, Shanghai, and Paris Photo and Photo Album so you can see your favorite images every time you raise your wrist, including support for Live Photos Time Travel with the Digital Crown to see what’s coming in the future or what’s happened in the past Nightstand Mode so your Watch can be used as a bedside alarm clock 9 new colors to customize your watch face, and a new multicolor Modular face Support for third-party apps to create complications Siri improvements Start a specific workout, get transit directions, or ask to see a glance Support for FaceTime audio calling and replying to email Support for HomeKit to control supported devices in your home using Siri New support for Austria, Belgium (French and Dutch), and Norway Activity and Workout improvements Workouts from third party apps on the Watch can be included in your Activity rings Activity rings, workouts, and achievements can be shared from the Activity app on iPhone Interactive achievements On-demand weekly summary Mute Activity notifications for one day Workouts saved automatically Apple Pay and Wallet improvements Support for Discover cards Support for rewards cards and store credit and debit cards Add passes to Wallet directly from third party apps on your Watch Friends and Digital Touch improvements Add more than 12 Friends directly from Apple Watch Multiple Friends’ groups that you can name Send sketches using multiple colors New options for animated emoji Maps improvements Transit view, showing transit lines, stations and intermodal connections in select major cities View the list of directions for your current route View station placards with departure information Music improvements New Beats 1 button to start playing the 24/7 radio station New Quick Play button to play a variety of songs from Apple Music Reply to emails using dictation, emoji, or smart replies customized specifically for email Make and receive calls using FaceTime audio Support for Wi-Fi calling without iPhone in proximity on participating carriers Activation Lock prevents anyone from activating your Apple Watch without your Apple ID and password New developer capabilities including Native SDK to build faster and more powerful apps running natively on Apple Watch Access to accelerometer to more granularly track your motion Access to heart rate sensor for use during a workout Access to microphone and speaker to record and play audio Access to the Taptic Engine with 8 different types of Haptic feedback Access to the Digital Crown for more precise controls Ability to play video directly on Apple Watch Support for running apps without iPhone in proximity, including access to networking capabilities when connected to known Wi-Fi networks Complications on the watch face Workouts from apps can be counted towards Activity rings Workouts from apps can be included in Activity app on iPhone New support for system language in English (India), Finnish, Indonesian, Norwegian, and Polish New support for dictation in Dutch (Belgium), English (Ireland, Philippines, South Africa), French (Belgium), German (Austria), Spanish (Chile, Colombia) New support for smart replies in Traditional Chinese (Hong Kong, Taiwan), Danish, Dutch, English (New Zealand, Singapore), Japanese, Korean, Swedish, Thai Some features may not be available for all countries or all areas.For information on the security content of this update, please visit this website:http://support.apple.com/kb/HT1222