Windows 10: Backdoor/rootkit found preinstalled on 3 million Android phones

Brink · Nov 20, 2016

Firmware that actively tries to hide itself allows attackers to install apps as root.

Almost three million Android phones, many of them used by people in the US, are vulnerable to code-execution attacks that remotely seize full control of the devices, researchers said Thursday.

Until recently, the flaw could have been exploited by anyone who took the time to obtain two Internet domains that remained unregistered despite being hardwired into the firmware that introduced the vulnerability. After discovering the vulnerability, researchers from security ratings firm BitSight Technologies registered the addresses and control them to this day. Even now, the failure of the buggy firmware to encrypt communications sent to a server located in China makes code-execution attacks possible when phones don't use virtual private networking software when connecting to public hotspots and other unsecured networks.

Since BitSight and its subsidiary company Anubis Networks took possession of the two preconfigured domains, more than 2.8 million devices have attempted to connect in search of software that can be executed with unfettered "root" privileges, the researchers said. Had malicious parties obtained the addresses before BitSight did, the actors could have installed keyloggers, bugging software, and other malware that completely bypassed security protections built into the Android operating system. The almost three million devices remain vulnerable to so-called man-in-the-middle attacks because the firmware—which was developed by a Chinese company called Ragentek Group—doesn't encrypt the communications sent and received to phones and doesn't rely on code-signing to authenticate legitimate apps. Based on the IP addresses of the connecting devices, vulnerable phones hail from locations all over the world, with the US being the No. 1 affected country.

"The thing that scares us is a lot of these users will be unaware of the vulnerability, and they will never get an update," BitSight CTO Stephen Boyer told Ars. "This is full system compromise. This is at the root level. [Attackers with a MitM position] can do anything."
Click to expand...

Read more: Powerful backdoor/rootkit found preinstalled on 3 million Android phones | Ars Technica

:)

verdy.p · Nov 20, 2016

Weird update "Microsoft - WPD - 2/22/2016 12:00:00 AM - 5.2.5326.4762"

I suspect that this update is a new version of a prior update made in 2016, but modified this year, possibly related to backdoors discovered and used by malwares (but initially developed by CIA intruders working inside Microsoft)

See the recent Wikileaks revelations about "CIA Vault-7". Not all is published, but lots of documents are still coming.

It looks there's really a lot of backdoors in Windows, including in code developed for previous security updates, that need to be fixed again (these concern not just Windows 10, but at least everything since Windows 8, and some security updates for Windows
7 that are still published for some organizations worldwide, notably in banks and governments, though their extended support program).

The WPD drivers updates could be related to backdoors found in drivers communicating with smartphones connected to PC's via the USB interface. It could be activated by the "MPD" filesystem supported by Android and iOS (and a backdoor in the MPD protocol
support or even in the "Battery charge only" working mode of smartphones when we don't allow the MPD connection (the backdoor would still be able to inspect smartphone data through Windows).

Probably we should no longer connect Android and iOS smartphones to a PC USB port with a USB data cable, but only with a 2-wires cable without data support, but most probably by a separate battery charger plugged on an AC outlet or external large capacity
battery.

Wifi drivers also seem very suspect if we use the smartphone at home. Apparently the CIA developed backdoors focusing specific identifiable customers, and WiFi hotspots are precise enough to perform targetted attacks, now also used by malwares and fraudulent
organizations located anywhere.

We're all spied, but not only by authors of these costly-developed backdoors that have gone out of control.

Microsoft/Apple/Google/Cisco/Intel/IBM/AMD/HP/Oracle... should no longer tolerate any backdoor and should fire all spiers working in its own dev labs and start legal actions against governments controlling them. It should also offer indemnify victims of
these uncontroled backdoors now exploited by criminals, and send the bill of these indemnities to the US government: it will cost the US gov more than the initial huge cost paid to develop the backdoor programs and deply them wordwide.

They must also give serious warranties to other governements and cooperate with them to resolve all damages caused including by unknown criminals that have found and used these backdoors for their profit.

vesperillo · Nov 20, 2016

Carrier IQ on Nokia phones?

Hello

Does anybody know if Carrier IQ has been installed by default on Nokia N8?

Read more :

Phone 'Rootkit' Maker Carrier IQ May Have Violated Wiretap Law In Millions Of Cases

Windows 10: Backdoor/rootkit found preinstalled on 3 million Android phones

Backdoor/rootkit found preinstalled on 3 million Android phones

Backdoor/rootkit found preinstalled on 3 million Android phones

Backdoor/rootkit found preinstalled on 3 million Android phones - Similar Threads - Backdoor rootkit found

backdoor virus

backdoors

New Moriya rootkit stealthily backdoors Windows systems

Unremovable malware found preinstalled

android phone

android phone

android phone

Microsoft’s Your Phone app has more than 5 million download on Android

MBAM 3 "Scan for Rootkits" Off or On?