Dangerous Banking Malware Discovered Lurking on Brand-new Android Phones

Minimalist · Mar 2, 2018

The unwanted, pre-installed software (or bloatware) that comes on most smartphones these days is bothersome enough. But it could be worse. Your new phone could have been infected with malware before you even turned it on for the first time.

Security researchers at Dr.Web have discovered dozens of low-cost Android phones that were shipping with an extremely dangerous Trojan called Triada. It's not a new strain of malware. Cybercriminals began distributing it back in 2016. When it was first discovered, researchers said Triada was "as complex as Windows malware" and "the most advanced mobile threat seen to date."

It was originally spread through a malicious advertising network. About a year later the Triada Trojan was found baked in to phones prior to shipping. That was last July, though its spread was fairly limited. Dr.Web's post at the time only mentioned 4 smartphones that were infected.

This time the situation is much more serious. So far, Dr.Web says they've identified 42 different models.
Click to expand...

https://www.forbes.com/sites/leemat...iscovered-lurking-on-brand-new-android-phones

Minimalist · Mar 2, 2018

Here is a list of devices:

https://wccftech.com/42-android-banking-trojan/

guest · Jun 6, 2019

Google confirms that advanced backdoor came preinstalled on Android devices
After Google successfully beat back Triada in 2017, its developers found a new way in
June 6, 2019
https://arstechnica.com/information...ack-that-sneaked-backdoor-on-android-devices/

Criminals in 2017 managed to get an advanced backdoor preinstalled on Android devices before they left the factories of manufacturers, Google researchers confirmed on Thursday.
Triada first came to light in 2016 in articles published by Kaspersky here and here, the first of which said the malware was "one of the most advanced mobile Trojans" the security firm's analysts had ever encountered.

On Thursday, Google confirmed the Dr. Web report, although it stopped short of naming the manufacturers. Thursday's report also said the supply chain attack was pulled off by one or more partners the manufacturers used in preparing the final firmware image used in the affected devices. Lukasz Siewierski, a member of Google's Android Security & Privacy Team, wrote:

Triada infects device system images through a third party during the production process. Sometimes OEMs want to include features that aren't part of the Android Open Source Project, such as face unlock.
[...] Based on analysis, we believe that a vendor using the name Yehuo or Blazefire infected the returned system image with Triada.
Click to expand...

Google Security Blog: PHA Family Highlights: Triada

guest · Jun 7, 2019

Another example where security paranoia is useless, you can't secure what is beyond your reach.

guest · Jul 25, 2019

Android Malware 'Triada' Most Active on Telco Networks
Google in May disclosed that several Android devices had been shipped pre-installed with the RAT
July 25, 2019
https://www.darkreading.com/mobile/...-most-active-on-telco-networks/d/d-id/1335337

New research into the impact of Triada, a sophisticated remote access Trojan that was recently found pre-installed on numerous Android devices, has shown that more than 15% of telecom companies globally have infected devices running on their network.
Security ratings firm BitSight, which has been tracking the malware since May, recently gathered telemetry from command-and-control domains that Triada-infected devices have been communicating with.

BitSight also looked for telemetry related to PrizeRAT - a remote access Trojan that like Triada was found pre-installed on some low-cost Android devices last year - and for data pertaining to Ztorg, a lightweight Trojan that in the past has been associated with Triada.
The reason for the relatively heavy presence of infected systems on telecom and education sector networks is likely because many of the devices belong to consumers and students.

"The telecommunications and education industry sectors often do not enforce security controls on devices communicating through their networks since they primarily offer transit services to their customers, or students in the case of the latter," says Dan Dahlberg, a security researcher at BitSight.
According to BitSight, most organizations that have been impacted by Triada so far have a security rating of 400 or lower, meaning their security practices lag well behind industry standards
Click to expand...

BitSight: Third-Party Insight into Triada & Related Families

guest · Aug 25, 2020

Chinese-Made Smartphones Are Secretly Stealing Money From People Around The World
Preinstalled malware on low-cost Chinese phones has stolen data and money
August 24, 2020
https://www.buzzfeednews.com/article/craigsilverman/cheap-chinese-smartphones-malware

When Mxolosi saw a Tecno W2 smartphone in a store in Johannesburg, South Africa, he was attracted to its looks and functionality. But what really drew him in was the price, roughly $30 — far less than comparable models from Samsung, Nokia, or Huawei, Africa’s other top brands.

“They’re very attractive and appealing to your eyes,” Mxolosi, who asked for his last name not to be used to protect his personal safety, told BuzzFeed News. “Honestly, I was a Samsung fan but I said, ‘Let me try this new product.’”
But its success can come at a price. Mxolosi, an unemployed 41-year-old, became frustrated with his Tecno W2. Pop-up ads interrupted his calls and chats. He’d wake up to find his prepaid data mysteriously used up and messages about paid subscriptions to apps he’d never asked for.
Click to expand...

He thought it might be his fault, but according to an investigation by Secure-D, a mobile security service, and BuzzFeed News, software embedded in his phone right out of the box was draining his data while trying to steal his money.
A Transsion spokesperson told BuzzFeed News that some of the company's Tecno W2 phones contained the hidden Triada and xHelper programs, blaming an unidentified “vendor in the supply chain process.”
Click to expand...

Secure-D: Triada

Launching the Investigation
Starting in March 2019, Secure-D caught and blocked an unusually large number of transactions coming from Transsion Tecno W2 handsets mainly in Egypt, Ethiopia, South Africa, Cameroon, Ghana with some fraudulent mobile transaction activity detected in another 14 countries.

To date, a total of 19.2m suspicious transactions – which would have secretly signed users up to subscription services without their permission – have been recorded from over 200k unique devices.
Click to expand...

Log in or Sign up

Dangerous Banking Malware Discovered Lurking on Brand-new Android Phones

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Dangerous Banking Malware Discovered Lurking on Brand-new Android Phones

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches