Second Adups backdoor in Android devices

Many Android users may still have a backdoor on their device, according to new revelations made today by the Malwarebytes' mobile security research team.

The Adups backdoor incident from late 2016

Their discovery is related to the Adups case from last year. Back in mid-November 2016, US cyber-security firm Kryptowire revealed it discovered that firmware code created by a Chinese company called Adups was collecting vasts amount of user information and sending it to servers located in China.

According to Kryptowire, the backdoor code was collecting SMS messages, call history, address books, app lists, phone hardware identifiers, but it was also capable of installing new apps or updating existing ones.

The backdoor was hidden inside a built-in and unremovable app named com.adups.fota, the component responsible for the phone's firmware-over-the-air update (FOTA) system.

At the time, experts believed Adups shipped out the backdoored component to other phone vendors and the component eventually made its way inside over 700 million devices, most of which were low-budget Android phones, and in some cases, some Android Barnes & Noble NOOK tablets.

Following the revelations, many online stores reacted by refusing to sell phone models known to be vulnerable. With pressure from smartphone manufacturers and even the DHS, Adups eventually shipped out a version of the FOTA component without the backdoor and data collection code, even if in a presentation at the Black Hat 2017 security conference held in Las Vegas in August, Kryptowire researchers said that some devices were still sending data to the Adups servers.

Nonetheless, according to a recent investigation by Malwarebytes, "the new [com.adups.fota component] version was clean of wrongdoing."

New backdoor code found in another Adups component

But Malwarebytes says it found another Adups component doing bad things. Just like the previous Adups backdoor, this app is also unremovable, and users can't disable it either.

This second component is found on phones under two names, such as com.adups.fota.sysoper or com.fw.upgrade.sysoper, which appear in the phone's app list with the name UpgradeSys (FWUpgradeProvider.apk).

The good news is that this one does not collect user data, but instead only includes the ability "to install and/or update apps without a user’s knowledge or consent," according to Nathan Collier, Senior Malware Intelligence Analyst.

Some non-recommended ways to remove the app exist

The only way to remove the suspicious component is if users root their devices, something that many phone manufacturers recommend against, as it could open smartphones to even more dangerous threats.

There is also a Windows app named Debloater that is known to remove the UpgradeSys component, but it was not tested on all Android devices and may lead to unexpected behavior.

Malwarebytes says that at the time being, they have not seen any malicious activity being carried out through this app, but this doesn't guarantee that Adups or another threat actor may not use it in the future.

The most common explanation is that Adups forgot to remove the intrusive code from the UpgradeSys component after cleaning the FOTA component last year.

At the time of writing, it is unclear how many phones feature this second component, but Collier says that "there are reports of it being installed on phones bought from legitimate phone carriers in countries such as the UK."

"Hopefully, bringing public attention to this will once again alert Adups to clean things up. If not, we will remain vigilant of any malicious apps it may try to install," says Collier.