For about US$50, you can get a smartphone with a high-definition display, fast data service and, according to security contractors, a secret feature: A backdoor that sends all your text messages to China every 72 hours.
Security contractors recently discovered preinstalled software in some Android phones that monitors where users go, whom they talk to and what they write in text messages.
US authorities said it is not clear whether this represents secretive data mining for advertising purposes or a Chinese government effort to collect intelligence.
International customers and users of disposable or prepaid mobile phones are the people most affected by the software.
However, the scope is unclear. The Chinese company that wrote the software, Shanghai Adups Technology Co, said its code runs on more than 700 million phones, cars and other smart devices.
One US phone manufacturer, BLU Products, said that 120,000 of its phones had been affected and that it had updated the software to eliminate the feature.
Kryptowire, the security firm that discovered the vulnerability, said the Adups software transmitted the full contents of text messages, contact lists, call logs, location information and other data to a Chinese server.
The code comes preinstalled on phones and the surveillance is not disclosed to users, said Tom Karygiannis, a vice president of Kryptowire, which is based in Fairfax, Virginia.
“Even if you wanted to, you wouldn’t have known about it,” he said.
Security experts frequently discover vulnerabilities in consumer electronics, but this case is exceptional.
It is not a bug. Rather, Adups intentionally designed the software to help a Chinese phone manufacturer monitor user behavior, according to a document that Adups provided to explain the problem to BLU executives.
That version of the software was not intended for US phones, the company said.
“This is a private company that made a mistake,” said Lily Lim, a lawyer in Palo Alto, California, who represents Adups.
The episode shows how companies throughout the technology supply chain can compromise privacy, with or without the knowledge of manufacturers or customers. It also offers a look at one way that companies — and by extension governments — can monitor cellphone behavior.
For many years, the Chinese government has used a variety of methods to filter and track Internet use and monitor online conversations. It requires technology companies that operate in China to follow strict rules.
Adups is not affiliated with the Chinese government, Lim said.
At the heart of the issue is a special type of software, known as firmware, that tells phones how to operate. Adups provides the code that lets companies remotely update their firmware, an important function that is largely unseen by users.
Normally, when a phone manufacturer updates its firmware, it tells customers what it is doing and whether it will use any personal information. Even if that is disclosed in long legal disclosures that customers routinely ignore, it is at least disclosed.
That did not happen with the Adups software, Kryptowire said.
According to its Web site, Adups provides software to two of the largest cellphone manufacturers in the world, ZTE and Huawei. Both are based in China.
Samuel Ohev-Zion, who is chief executive of Florida-based BLU Products, said: “It was obviously something that we were not aware of. We moved very quickly to correct it.”
Adups had assured him that all of the information taken from BLU customers had been destroyed, he said.
Because Adups has not published a list of affected phones, it is not clear how users can determine whether their phones are vulnerable.
“People who have some technical skills could, but the average consumer? No,” Karygiannis said.
Kryptowire discovered the problem through a combination of happenstance and curiosity.
A researcher bought an inexpensive phone for a trip overseas.
While setting up the phone, he noticed unusual network activity, Karygiannis said.
Over the next week, analysts noticed that the phone was transmitting text messages to a server in Shanghai that was registered to Adups, according to a Kryptowire report.
Kryptowire took its findings to the US government. It plans to make its report public as early as Tuesday next week.
Marsha Catron, a spokeswoman for the US Department of Homeland Security, said the agency “was recently made aware of the concerns discovered by Kryptowire.”
Catron said that the Department of Homeland Security “is working with our public and private sector partners to identify appropriate mitigation strategies.”
‘IN A DIFFERENT PLACE’: The envoy first visited Shanghai, where he attended a Chinese basketball playoff match, and is to meet top officials in Beijing tomorrow US Secretary of State Antony Blinken yesterday arrived in China on his second visit in a year as the US ramps up pressure on its rival over its support for Russia while also seeking to manage tensions with Beijing. The US diplomat tomorrow is to meet China’s top brass in Beijing, where he is also expected to plead for restraint as Taiwan inaugurates president-elect William Lai (賴清德), and to raise US concerns on Chinese trade practices. However, Blinken is also seeking to stabilize ties, with tensions between the world’s two largest economies easing since his previous visit in June last year. At the
Nearly half of China’s major cities are suffering “moderate to severe” levels of subsidence, putting millions of people at risk of flooding, especially as sea levels rise, according to a study of nationwide satellite data released yesterday. The authors of the paper, published by the journal Science, found that 45 percent of China’s urban land was sinking faster than 3mm per year, with 16 percent at more than 10mm per year, driven not only by declining water tables, but also the sheer weight of the built environment. With China’s urban population already in excess of 900 million people, “even a small portion
UNSETTLING IMAGES: The scene took place in front of TV crews covering the Trump trial, with a CNN anchor calling it an ‘emotional and unbelievably disturbing moment’ A man who doused himself in an accelerant and set himself on fire outside the courthouse where former US president Donald Trump is on trial has died, police said yesterday. The New York City Police Department (NYPD) said the man was declared dead by staff at an area hospital. The man was in Collect Pond Park at about 1:30pm on Friday when he took out pamphlets espousing conspiracy theories, tossed them around, then doused himself in an accelerant and set himself on fire, officials and witnesses said. A large number of police officers were nearby when it happened. Some officers and bystanders rushed
Beijing is continuing to commit genocide and crimes against humanity against Uyghurs and other Muslim minorities in its western Xinjiang province, U.S. Secretary of State Antony Blinken said in a report published on Monday, ahead of his planned visit to China this week. The State Department’s annual human rights report, which documents abuses recorded all over the world during the previous calendar year, repeated language from previous years on the treatment of Muslims in Xinjiang, but the publication raises the issue ahead of delicate talks, including on the war in Ukraine and global trade, between the top U.S. diplomat and Chinese