The data collection and transmission capability is spread across different applications and files. The user data was sent in JavaScript Object Notation (JSON) format to a number of servers, all with the hostname bigdata:, ,, and. The company immediately notified Google, BLU, AdUps, and Amazon-which is the exclusive retailer of the BLU R1 HD-of its findings. The transmissions were discovered by Kryptowire in lab testing. The firmware that shipped with the mobile devices and subsequent updates allowed for the remote installation of applications without the users' consent and, in some versions of the software, the transmission of fine-grained device location information.
#BLU R1 HD SOFTWARE UPDATE SCHEDULE ANDROID#
The firmware also collected and transmitted information about the use of applications installed on the monitored device, bypassed the Android permission model, executed remote commands with escalated (system) privileges, and was able to remotely reprogram the devices. The firmware could target specific users and text messages matching remotely defined keywords.
#BLU R1 HD SOFTWARE UPDATE SCHEDULE FULL#
These devices actively transmitted user and device information including the full-body of text messages, contact lists, call history with full telephone numbers, unique device identifiers including the International Mobile Subscriber Identity (IMSI) and the International Mobile Equipment Identity (IMEI). While Kryptowire reported that Adups' software was used on Huawei and ZTE handsets in China, a Huawei representative told Ars: The surveillance feature of the software was developed specifically for the Chinese market, the company says, and was unintentionally included in the software for BLU devices. AdUps claims its software runs updates for more than 700 million devices worldwide, including smartphones, tablets, and automobile entertainment systems. The company, Shanghai AdUps Technologies, had apparently designed the backdoor to help Chinese phone manufacturers and carriers track the behavior of their customers for advertising purposes. The data included phone number, location data, the content of text messages, calls made, and applications installed and used. The backdoor software, initially discovered on the BLU R1 HD, sent massive amounts of personal data about the phones and their users’ activities back to servers in China that are owned by a firmware update software provider. Security firm Kryptowire has uncovered a backdoor in the firmware installed on low-cost Android phones, including phones from BLU Products sold online through Amazon and Best Buy.
0 kommentar(er)
