Hacker News Reader

Why do they gloss right over how this was distributed? Barring details of any other kind of exploit we would have to assume the vendor's update server was compromised? If so why don't they just say so.

View on HN

Cheap Android phones and tables often have built-in advertisement from manufacturer. One example of such software, it creates a window with Google Ads on top of browser window. The window is shown only when the browser is active to make it look like the ads is a part of the site. The ads appears only couple weeks after activation so that the user thinks it is a result of installation of some app and Youtube reviewers do not notice existence of malware. The adware consults a remote config which defines in what countries it should work. Another adware component automatically downloads and re-installs it if it is deleted.

I found all these details through examining the official firmware image and reverse engineering.

I don't remember if I reported Google Ads id to Google. It is interesting that Google doesn't notice and care about such use of their products.

> we would have to assume the vendor's update server was compromised

You say "compromised". I say "monetised".

:sigh:

Reply on news.ycombinator.com