40 cheap Android phones contain pre-installed banking malware, experts say a Shanghai software developer is the culprit

Leifeng.com news, are you still buying cheap Android smartphones for cheap? You should be more careful before buying. According to foreign media reports on March 3, US time, Dr.Web researchers found the terrible Triada banking malware in more than 40 cheap Android phones, and they were pre-installed.

Security researchers from antivirus company Dr.Web have isolated the Triada.231 banking malware from 42 cheap Android smartphones.

"In mid-2017, Dr.Web analysts discovered the new Triada.231 malware in the firmware of some cheap Android phones. Since then, the list of cheap Android phones infected with this malware has been growing," Dr-Web wrote in a blog post. "Now, more than 40 cheap Android phones have been infected. We have been monitoring the movement of this malware for a long time and now we can finally publish the final results of our investigation."

The Triada malware was first discovered by researchers at Kaspersky Lab in 2016. At the time, the researchers considered it to be the most advanced threat facing mobile devices.

Leifeng.com learned that when hackers designed Triada, they wanted to use it for financial fraud , the most typical of which was to use it for financial SMS transactions. The most interesting feature of this malware is that it uses a modular architecture, so in theory Triada can have a variety of destructive capabilities.

When inserting the code onto the device, the hackers used the Zygote process, which meant that the malware infiltrated every piece of software. There was only one way to eliminate the threat: wipe all the data on the smartphone and reinstall the entire operating system.

Researchers at Dr.Web pointed out that most of these Android smartphones pre-installed with malware are from small brands , with the hardest hit being brands that few people have ever heard of, such as Advan, Cherry Mobile, Doogee and Leagoo.

Dr.Web also revealed that the culprit of the malware infection was a software developer in Shanghai, which is a partner of Leagoo. "The Shanghai company provided Leagoo with an app that contained instructions to add third-party code to the system database before compilation. Unfortunately, the manufacturer did not refuse this controversial request. In the end, Triada.231 entered the smartphone openly," Dr.Web wrote in a blog post.

The infected app was also developed by a Chinese company, and security experts pointed out that the malware code is exactly the same as the software certificate that infected it in 2016.

"After analyzing this app, we found that it used the same certificate as the MulDrop.924 malware, and it is likely that the same people are behind it," Dr.Web wrote in a blog post.

The more than 40 infected Android phones mentioned in the article may be just a drop in the ocean, and the real blacklist of cheap phones may be larger than imagined.

Leifeng.com Via. Security Affairs