Android mobile devices from top vendors in China have pre-installed malware

Researchers reported that the top-of-the-line Android mobile devices sold in China are shipped with malware.

China is currently the country with the largest number of Android mobile devices, but a recent study conducted by researchers from the University of Edinburgh and the Trinity College of Dublin revealed that top-of-the-line Android devices sold in the country are shipped with spyware.

The boffins used static and dynamic code analysis techniques to study the data transmitted by the preinstalled system apps on Android smartphones from three of the most popular vendors in China, Xiaomi, OnePlus, and Oppo Realme. The experts discovered several system, vendor and third-party apps with dangerous privileges.

The apps were designed to exfiltrate user and device information in a stealthy way, including system info, geolocation, user profile, social relationships, and call history.

The smartphones analyzed by the r researchers were observed sending data to the device vendor and the Chinese mobile network operators (e.g., China Mobile and China Unicom), even though they do not provide any service to the device (i.e. the SIM card is not present in the phone or if the SIM card used was provided by a different operator in China or in the UK).

This malicious software puts users’ privacy at risk, it could be used to spy on users and unmasking of their identities.

The experts pointed out that also users that leave the country are exposed to surveillance, through the pre-installed software.

The researchers also compared the preinstalled system apps on the Chinese (CN) and Global (e.g., EU) Android OS distributions from the same OS developers. They discovered that the number of preinstalled third-party apps on CN OS distributions is 3 to 4 times larger than for the corresponding Global OS distribution and that these are given 8 to 10 times as many permissions as third-party apps in Global distributions.

“Overall, our findings paint a troubling picture of the state of user data privacy in the world’s largest Android market, and highlight the urgent need for tighter privacy controls to increase the ordinary people’s trust in technology companies, many of which are partially state-owned.” reads the paper published by the experts.

could easily lead to the persistent tracking of users and the easy unmasking of their identities.

The experts measured the network traffic generated by the devices when in-use by a privacy-aware consumer, who opts out of analytics and personalization, does not use any other optional third-party services or any cloud storage, and has not set up an account on any platform of the OS distribution developer.

The researchers discovered major differences in terms of how privacy provisions are enforced in different regions.

In China, phone numbers are registered under a citizen ID, which means that was possible to link the device to the real identity of the owners.

Chinese manufacturers have yet to comment on the research.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Android mobile devices)