US Government-funded phones found pre-installed with Chinese malware

Nathan Collier, a senior malware intelligence analyst at Malwarebytes published a blog detailing the firm’s findings on US government-funded smartphones

Malware is perhaps the most common way for hackers to compromise devices, leading to untold repercussions. They could be benign, simply triggering popup ads, but more often than not they’re a lot more sinister, harvesting your data, tracking your location, or invading your personal privacy. Malwarebytes has announced a startling discovery – they found US government-funded smartphones carrying pre-installed malicious applications.

The device itself is offered by a US-funded carrier that offers cellphones through the Lifeline Assistance Program, an FCC (Federal Communications Commission) backed initiative which lowers the monthly cost of smartphones and internet through government subsidies, making them affordable for low-income consumers.

In the blog, Collier reports on two malicious applications which, worryingly, come pre-installed on the UMX U686CL, a low-cost Android smartphone.

Malicious, pre-installed and unremovable

The first malicious application found by the American internet security firm acts under the guise of an operating system updater, named Wireless Update. It is the only way that the smartphone’s device can be updated and was found to be able to auto-install apps without user consent.

Collier said that Malwarebytes for Android customers would be acutely aware of the Wireless Update app. The previous iteration, developed by Chinese firm Adups, was last year caught transmitting location, SMS, call and app data to a server in China. The company is behind other auto-installer apps, spyware and malicious software, discovered on a range of Android devices from over 40 manufacturers.

READ MORE: Addressing the IoT Security Challenge

“From the moment you log into the mobile device, Wireless Update starts auto-installing apps,” Nathan Collier said. “There is no user consent collected to do so, no buttons to click to accept the installs, it just installs apps on its own.”

Collier points out that this updater opens the potential for surreptitious installations of malware in future updates, effectively leaving a backdoor open to the user’s device and, as a result, their personal and private data.

The second malicious application found on the UMX U686CL was the operating system’s very own Settings app, which “functions as a heavily-obfuscated malware”. The removal of the Settings app would leave the device effectively unusable. 

The UMX U686CL, manufactured in China, was found to carry two pre-installed malicious apps / Credit: Malwarebytes

Over the Great Firewall and into your pocket?

In the blog, Malwarebytes conclude that the malware is of Chinese origin, also noting that the device itself is manufactured by a company in China. They do stress, however, that this could merely be a coincidence, and that they could not confirm whether or not the device manufacturer is aware of the pre-installed malicious applications. 

AV-TEST, an independent IT security institute, examine and classify the growing number of malicious programs. Since 2011, the number of malicious programs has risen dramatically from 65 million to over 1 billion, a sizeable chunk of which is thought to have originated behind the Great Firewall.

As malicious software proliferates, reported findings from companies like Malwarebytes become more important, and solutions to catch and remove any unwanted applications or programs become necessary and valuable tools to ensure the safeguarding of one’s personal data. The affordability of such programs is also key to ensure the adoption of privacy measures, a sentiment echoed by Malwarebytes.

“Budget should not dictate whether a user can remain safe on his or her mobile device,” Nathan Collier said. “Shell out thousands for an iPhone, and escape pre-installed maliciousness. But use government-assisted funding to purchase a device and pay the price in the malware? That’s not the type of malware-free existence we envision at Malwarebytes.”

Malwarebytes made their findings clear to Assurance Wireless, one of the Lifeline Assistance Program’s cellphone service providers and asked for comment. They have not yet received a response.

Luke Conrad

Technology & Marketing Enthusiast

IoT Security: Protecting Your Connected Devices from Cyber Attacks

Miro Khach • 19th June 2024

Did you know we’re heading towards having more than 25 billion IoT devices by 2030? This jump means we have to really focus on keeping our smart devices safe. We’re looking at everything from threats to our connected home gadgets to needing strong encryption methods. Ensuring we have secure ways to talk to these devices...

Future Proofing Shipping Against the Next Crisis

Captain Steve Bomgardner • 18th June 2024

Irrespective of whether the next crisis for ship owners is war, weather or another global health event, one fact is ineluctable: recruiting onboard crew is becoming difficult. With limited shore time and contracts that become ever longer, morale is a big issue on board. The job can be both mundane and high risk. Every day...

London Tech Week 2024: A Launched Recap

Dianne Castillo • 17th June 2024

Dominating global tech investment, London Tech Week 2024 was buzzing with innovation. Our team joined the action, interviewing founders and soaking up the latest tech trends. Discover key takeaways and meet some of the exciting startups we met!

The Future of Smart Buildings: Trends in Occupancy Monitoring

Khai Zin Thein • 12th June 2024

Occupancy monitoring technology is revolutionising building management with advancements in AI and IoT. AI algorithms analyse data from IoT sensors, enabling automated adjustments in lighting, HVAC, and security systems based on occupancy levels. Modern systems leverage big data and AI to optimise space usage and resource management, reducing energy consumption and promoting sustainability. Enhanced encryption...

The need to weave agility throughout the business

John Craig Swartz SVP at POWWR • 11th June 2024

With geopolitical tensions, more extreme weather events and the legacy of a global pandemic, it is more difficult for energy suppliers to preserve their margins and remain competitive than ever before. To thrive in the current climate, it is imperative that a supplier makes marginal gains wherever they can. Profitability within the sector today hinges...

Artificial general intelligence is closer than expected

AI expert Stuart Fenton • 10th June 2024

Whilst most of the attention around artificial intelligence (AI) thus far has been on ChatGPT, it is just the tip of the iceberg. In many ways, ChatGPT shouldn’t be thought of as true AI as it is – at its heart – just generative, learned behaviour. The future of AI, in contrast, is a system...