Mobile security firm Lookout has revealed that a number of models of Gionee and Karbonn Mobiles have shipped from China with a malware pre-installed on them. The malware has been identified as DeathRing and is believed to have origins from China, MediaNama reports. Also Read - Joker malware back on Google Play store, delete these apps from your phone immediately
The Trojan masks as a ringtone maker app and downloads infectious contents from its parent servers. Lookout further notes that DeathRing may have been using SMS for phishing user’s personal information, and phone’s browser to further download more APKs (installation files for Android), that may be infected as well. The company also notes that one can’t uninstall these apps as they’re built-in and reside in phone’s system directory. Also Read - Downloaded WhatsApp Pink virus by mistake? Here's what you can do to fix your phone
So far, we’ve learned two ways this malware executes. According to Lookout, if the handset has been turned off and on five times, the malware starts executing. A similar clock is set based on the number of times one locks and unlocks the screen. Also Read - Mobile cyberattacks on Indian firms up by 854% in 2021: Report
The handsets that are shipping with the DeathRing malware, according to Lookout are as follows:
Gionee Gpad G1,
KarbonnTA-FONE A34 and A37,
Hi-Tech Amaze Tab
Counterfeit Smsung Galaxy S4 and Note II,
Various TECNO handsets,
Unspecified i9502 + Samsung clone),
It is yet to be known since how long the said handsets have been infected with this trojan. This is certainly not the first time we’ve learned that a phone is shipping with malware inside it.
Earlier this year, the security firm had reported that Karbonn Smart A26, and Xolo A5005 among others were shipping with another malware named MouaBad. In a statement to India Today, Gionee said that it isn’t selling any of the said handsets in India anymore.
While Lookout believes that these malwares were attached to the phone whilst production, it hasn’t been able to locate the exact department at the supply chain where it happens. But given the malware’s Chinese origin, and the fact that Gionee, Karbonn, and Xolo are manufactured in China and then rebranded and sold in India, it all comes down to piecing together the puzzle.