Hacker News Reader

Comment by paulmd | Hacker News Reader

Wonder if it's written itself into recovery. Or the SIM card/baseband - SIM card in particular usually includes functionality for triggering a sideload of apps (eg for carrier apps), sending notifications, etc into the main SOC so it fits. Maybe the second instance of SIM card malware ever.

https://www.youtube.com/watch?v=31D94QOo2gY

There are only so many places it can be hiding if it's surviving a factory reset.

--Guy who is undoubtedly vastly underestimating the problem given that it's resisted AV vendors for a while

View on HN

I'd wager that the firmware came pre-infected by the manufacturer (or an update to the firmware has the infection).

Based on the reddit thread at least one of the devices is from a no-name manufacturer.

https://www.reddit.com/r/antivirus/comments/bj6isa/xhelper_k...

a not insignificant portion of generic weird mediatek chipset android phones come rooted from the manufacturer, because the OS is built with a root/developer configuration. This also helps malware like this spread on the sub-$80 android phones sold to non technically sophisticated users in the developing world.

I remember reading something about mediatek based phones saving on the BOM by utilizing virtualization on a single SoC to run the baseband RTOS and the Smartphone OS.

That’s actually kind of brilliant.

Until you get bugs like "3D games lag when in fast moving car due to constant cell handovers" and "4G doesn't work at the same time as playing a 1080p60 video, so netflix/youtube are broken unless on wifi".

Sure but the phones $80. Getting to that price point requires some compromises. You’d think they’d also set the baseband VM at highest QOS.

I'm currently using a Xiaomi Redmi Go that was a bit less than that and I think it's remarkable how few compromises it has.

That’s a fair compromise to make a smart phone more affordable.

This happened to me with the Triada virus, on a Nomu S10 - it came with factory ota. That one patched the Zygote process and became invisible and unremovable without reflashing.

All they'd have to do in order to survive a factory reset is to write to the /system partition, which contains the main OS. A factory reset only wipes /data and a few caches.

Writing to /system requires it to be mounted read/write and permissions to do so, so they'd need a root exploit in order to pull it off, but there's quite a few to choose from especially as devices age and given that they're doing this outside Play Store where Google won't pick them up.

I'm just crossing my fingers advanced users don't lose the ability to side-load apps over bad publicity like this, maybe they should make it harder to enable though.

Is side loading the only way that code requiring root can easily get on a phone though? What about USB debugging?

True, just disabling it via PackageInstaller by default would do the trick, the root community could re-enable it easily and those who only needed to sideload the occasional app could do so via USB debugging.

It seems like every time I hope for a reasonable solution like this I get let down substantially though.

No. The play store does not check very well and is pretty easy to bypass. Up until recently you could just download .dex (android equivalent of .jar) files into your apps resources at run time then call the classloader. Then for their runtime scan you can either just wait to put the real code online or have a hardcoded switch to execute the main function based on like an NTP server saying it's past X day. I think that is why they removed calls to the classloader from android. There's a few other ways to do basically that that still work but I'm not sharing those for free.

IMO There is a slight flaw to how this question is worded. It's not that they block you from running code that you need to be root to run (you'll just get insufficient perms errors) it's just that you're not root. You could write the code to write to /system, and it will run it just will not work. Thus, you need to utilize some sort of local privilege escalation. That is it's own equally semi-sticky wicket.

Only semi-related, but I wonder if owning the SIM card could be used as some sort of rooting mechanism?

While there are theoretically many places it could hide in, the system partition or recovery seem the only realistic ones.

And recovery is already a stretch IMO.

AV vendors have multiple conflicts of interest and should not be trusted.

Can you elaborate?

Stories of bad viruses actually help them

This only really goes to the "don't entirely trust their statements regarding their product being the only effective barrier" part of the story. Reputable anti-virus companies do have a huge conflict of interest reporting on viruses they find and can tackle, but they also remain an important source of information about viruses. Disreputable anti-virus companies sell product which could be as simple as a "hollywood OS" green stripe animated GIF which says "virus cleaned" for all they really do: they probably install more malware rather than removing any.

Also, an anti virus company saying they can't understand how a virus remains infected after removal is interesting.

Yeah and fires "help" firefighters...

How uselessly cynical.

If you refer to the theory that AV actually wrote viruses (it's not clear), that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks.

I've followed the VX scene for years (it died long ago) and there has never been shortage of new malware.

Even if we wanted to give some credit to the theory, which type of virus would the AV companies develop? Something trivial, that requires a variation of a signature to detect? Or something extremely complex, that requires month of work, and that slows down the AV engine because it's algorithmically complex to detect?

None of this makes any sense. The truth is very simple - malware has always been an interesting subject, and writing viruses always had a subversive appeal to young rebels.

Ya totally nothing to do with APT's and plausible deniability.

Darn kids.

> If you refer to the theory that AV actually wrote viruses (it's not clear), that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks.

This analogy is not helping your case at all. It's not unheard of for police to plant evidence for such purposes. It's also been proven that law enforcement has been willfully using technology having high rates of false positives for things like drug testing to bring real charges against otherwise innocent people.

> that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks.

https://www.washingtonpost.com/nation/2019/07/11/florida-cop...

As a victim of such a falsified crime, testified by half a dozen police officers who couldn't get their stories straight but whom "somehow" were believed, you're only adding credence to the claim with that analogy.

Not really. I'm not doubting that you have been wronged by the judicial system, as I've seen this first hand with a close friend. However, a bold claim like this requires solid evidence that such practices are the norm.

It doesn't have to be the norm, it could be a rare thing done only during extremely slow periods to avoid right-sizing.

> that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks.

So very realistic then?

Or have you not encountered the numerous incidents where cops plant and manufacture evidence to frame people for various reasons such as increasing their numbers for a promotion or bad culture leading to quotas for arrests/tickets/etc.?

Now imagine a wholly for-profit police force.

Or even legal system. That would be unthinkable of ;)

> imagine a wholly for-profit police force.

https://www.newyorker.com/humor/daily-shouts/l-p-d-libertari...

> [...] that's as realistic as saying that police commits crimes so that they can get extra reward from the new tasks.

More like saying private 'protection companies' commit crimes so they can get you to pay for their 'protection'.

This is how mafia operates. They come to you and offer protection in exchange for a recurring "protection fee". If you refuse, they are the ones who commit crimes against you until you fork out a "protection fee".

Yes, AV is in a position where a) it needs regular full priv access to your files and unencrypted web traffic, b) is in a highly competitive, low-margin field where the players are literally attacking each other on your machine [1] to stay even, and c) have enormous motivation to seek other funding sources based on their desktop position [2-5].

I didn't say they created malware, no, but they certainly wave that flag when someone finds some. And it's certainly in their interest to pursue all of these alternatives, or even have a bad third party violate THEM to do so. The money is on the table. Do they take it? They'd be foolish not to.

1. http://www.techradar.com/us/news/software/security-software/...

2. https://news.ycombinator.com/item?id=13079569

3. https://www.wsj.com/articles/russian-hackers-scanned-network...

4. https://wiki.mozilla.org/CA:Symantec_Issues

5. https://www.howtogeek.com/199829/avast-antivirus-was-spying-...

etc...

Reply on news.ycombinator.com