16
Low-cost Android phones ship with residential proxy malware (www.bleepingcomputer.com)
submitted 1 month ago by [B] to c/pulse_of_truth@infosec.pub
comment fedilink hide all child comments
 

A malware campaign dubbed 'Midnight Mimosa' has been discovered on low-cost Android smartphones that ship with malicious software embedded in their firmware, allowing attackers to silently install apps, perform ad fraud, and turn devices into residential proxies. [...]

no comments (yet)

sorted by: hot top controversial new old
there doesn't seem to be anything here
32 comments in c/technology@lemmy.world view that post
[–] 50 points 1 month ago (4 children)

The researchers found preinstalled malware on devices with model names associated with legitimate manufacturers, including the Doogee S200 X and Cubot KINGKONG X, as well as phones impersonating Samsung and Apple products.

In case you were wondering which brands are mentioned here.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] 25 points 1 month ago (3 children)

    oh no i would have trusted the KINGKONG X

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
    • [–] 89 points 1 month ago (5 children)

    my bank...

    graphene os: eww no, sooo insecure, couldn't possibly trust that, fails checkbox compliance!

    rando crapware infested phone that hasn't seen a security update in 3 years: right this way sir...

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 10 points 1 month ago (2 children)

    I hear this complaint and perhaps I used the banking apps very minimally. I'm running GraoheneOS and just use the browser instead for my banking needs and I haven't had any issues.

    It was a slight setback but its not a huge deal for myself at least.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 7 points 1 month ago*

    I had this mindset until signing up with a bank that only uses its app for 2FA of any kind. No SMS option. No TOTP code option. So anytime you log in using a a mobile or desktop browser it would require opening the mobile app (running google play services OR having an iPhone).

    The only option I found to keep using this bank was to disable 2FA entirely.

    Which is dumb.

    But it was related to using a bank in a new country on GrapheneOS and Aurora Store version not fully working without Play Services and it turns out all banks suck here and not worth changing banks and there's not much money in this account anyway so just...sigh.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 5 points 1 month ago

    I actually don’t do any banking on my phone at all, as phones can easily be stolen and if that person saw you typing your passcode, then they can unlock it and get past any screen that asks for your fingerprint.

    Yes, I do use my fingerprint, but I can’t always use it (e.g. If I have rebooted or if my phone just won’t let me for some reason), so I don’t keep much on my phone and instead do things like banking on a desktop computer with disk-encryption.

    How long left until my bank requires me to use their app? I don’t know and I have no idea if it’ll work on custom ROMs.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 27 points 1 month ago (1 child)

    A little less than half of the apps you can download for an LG TV will also set up residential proxies.

    Gamers Nexus mentioned this article in a recent video:
    https://spur.us/blog/smart-tv-apps-residential-proxy-sdks

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 17 points 1 month ago

    silently install apps

    Sounds like Google.

    (/srs) Anyways, these "new"s are as old as "IoT" itself.

  • permalink
  • fedilink
  • source
    •
    [+] -18 points 1 month ago (17 children)

    So...kinda like what apple and google are doing too 😁

  • permalink
  • fedilink
  • source
  • hideshow 17 child comments
    •
  • [–] 45 points 1 month ago (1 child)

    Not to shill for Apple or Google, but it's definitely important to draw a distinction between first party telemetry and straight up distributing malware. If we can't we honest in our framing then there is really no reason to take what we have to say seriously.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 month ago

    While I wasn't 100% serious, I wasn't just joking either.

    Sure there is a difference. But not a big one. Do you know what each android process actually does? And both can install any shit they want at any time. You can't even uninstall their store or apps.

    To me personally, the difference is slim. And malware is malware, the difference often is just billions of dollars and doing it more or less on the open.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 22 points 1 month ago (3 children)

    No, because Apple and Google aren’t providing third parties access to the Internet through your devices.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 month ago

    for money they totally would do it. and since the whole thing is under their control they can design it in such way you wouldnt ever know. We are the product for them, not the phones.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 1 month ago

    Makes me feel so much safer with google or Apple 😁 They could though. All the tech for it is there and already installed. And you wouldn't even know if they did, because you don't own your own phone.

    Not that I wouldn't worry about an added layer of spy-shit though. The difference between that malware and the big malware it's installed on is just slim to me. I'm very security- and privacy-driven.

  • permalink
  • fedilink
  • source
  • parent
  • [+] -6 points 1 month ago (7 children)

    So… android IS google, and Apple is not doing anything remotely close to this.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 1 point 1 month ago (6 children)

    Android is google? You don't say? 😉

    And Apple is doing the same shit as google. At least they never tried to hide it

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 4 points 1 month ago (5 children)

    At the end of the day, each of us need to make a choice. Go with Apple and land in their walled garden and everything that comes with that. Choose Android with any OEM and bend over to Google AND the OEM. Get a pixel and bend over to Google (or nuke Pixel stock and install GOS, CalyxOS or whatever rocks your boat). Go the dumb phone way and only bend over to the carriers. Too many factors influence this, not just philosophy, taste or choice. Some people genuinely need a phone that will work with banks or cards, others can live without. Others, as is my case, can separate their life into 2 devices, I have a pixel 8 pro that I use exclusively for work on stock pixel, and a GOS pixel 10 Pro XL for my personal life.

    This technological life is a fucking mixed bag for sure.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 1 month ago (4 children)

    Totally.... I also "solved" it best i could. One dedicated totally anonymous phone for android-auto and one for banking-apps (they ALL need their fucking apps even though i use HBCI with most). Main phone is an aging pixel with graphene. The moment it dies (i'm waiting for many years now) i'm going some linux-phone, no matter how lacking it might be.

    Apple is a no-go. But yes, at least there's "only" one that i have to bend over for. But I was there when they tried so hard with "pay less, get more!" and now it's "get less, pay a lot more you dumb stupid consumer-trash-idiot". I would be ashamed of myself for using one.

    But yes. It sucks. And i was dumb enough to kinda believe google with "android will always remain free and open!". Yeah sure. Go fuck yourself.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 1 month ago (3 children)

    I was a full blown Google fanboy until around 2017. I had all their tech, no matter how new it was. Then I started looking, and my race to get out of there was fast and furious. That's when I landed on LineageOS first, then Calyx and have been on GrapheneOS since the pixel 6 came out. It was brutal, honestly. I swore by Google.

    Never been an Apple fan, I've always seen it as expensive shit that's only good to show off that 'I can spend more than you to do the exact same shit'.

    Then there's Windows. My last time on windows was also in 2017, and looking back, I do have to thank Google for opening my eyes to all the shit these companies were turning into.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 1 month ago (2 children)

    I'm "glad" to see that this shit also opens some eyes. Probably not enough to change anything, but it's something.

    Wouldn't call myself a fanboy but I really loved android when it came out. Mostly had custom Roms all the time, but it got harder and harder, and in the end I spent a day just to he able to install one. I was glad if there at least was a root. Needed for backup, I would never use a cloud. Especially not google.

    And I am still on the p6p. Got it when it came out. Hated google already but it were - ironically - the only brand left that was "open". It Broke 1 day before end of guarantee and got a brand new one. And this sucker refuses to die 😁 Graphene is nice and all, but I miss root. And because I basically don't use any "regular" app anymore, I will switch to a Linux then.

    Apple... It's tech-products for people that want tech but have not the slightest clue. Its like "my first Sony" 😁

    Oh Windows...I took too long to ditch it. As a hardcore gamer I never even thought about switching. I use mostly Linux for all my servers, but never used any GUI. But then I tried cachyos, super worried on a second nvme parallel to win. Nearly all games work, rarely any tweaking needed. And instead of having to write my own tool for months to move my windows where I want them and how, I use KDE win-rules. God I love KDE. Never ever booted win again. And I even made a VM out of it for "super emergencies"...never started it.

    Now I just need the "downgrade" from nvidia to and....

    Can't say though which company's shit made me snap and ditch all US-bigtech. Reddit helped a lot...

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 1 month ago (1 child)

    Yeah, this path we're on seems endless. I've always played on console more than PC, and have had every PlayStation generation and all Nintendo's up to the wii-u (my son does have a switch first gen and wanted the switch 2, I told him he could get one when he pays for it). With all the bullshit in the gaming world I'm looking to build a 'Steam Machine' of my own eventually to throw the PS5 out the window (or sell it 😏) because I've found that my way of thinking is entirely incompatible with every tech company out there except Valve (So far). I haven't touched the PS5 in about 4 months but my kids still play on it, I have been keeping to my steam deck mostly.

    What happens when I decide 'fuck Sony too'? Prices for parts to build my 'Bazzite console skyrocket and now I have to save more to be able to build something mildly functional.

    This whole tech environment has gotten so fucking tiring.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 1 month ago

    Amen to that. Last gpu i bought at 2.5k€ when i thought "it only rises more, buy now or never"...then it went down again. never recovered. Now the card is already outdated and i would have to shell out another 1,5k. or 1k for AMD (slower but linux-y). But then again I was lucky with RAM. Upgrade servers and gamingrig with 2x128gb+64gb. THEN it started to rise. Now i would have to pay for the ram what the server did cost in complete. ARE THEY FUCKING NUTS?!

    And I hear you. Never had a console (except the atari 2600), but seeing what Sony does pisses me off. This was one reason i boycotted steam when it started. For many years. Until i gave up, they won. And today? It's the least bad player in the market. As long as gaben don't die and they go public.

    It's really sad, gaming always was my passion. Tech in general. Now it mostly aggravates me. But hey, at least we have linux+FOSS left. But maybe the "AI"-bubble will burst and then shits hits the fan. Either temporarily to our benefit or...i don't wanna continue the thought.

  • permalink
  • fedilink
  • source
  • parent