‘Undeletable’ Malware Shows Up in Yet Another Android Device

[silversurfer]

Security researchers have identified yet another Android-based mobile device available through the government-funded Lifeline Assistance Program pre-loaded with malware, a discovery adding evidence to the disturbing trend of smartphones infected with undeletable malicious code upon purchase.
 
Hard on the heels of research exposing the prevalence of pre-installed adware on Android devices, researchers at Malwarebytes Labs found an American Network Solutions (ANS) UL40 device running Android OS 7.1.1, preloaded with compromised Settings and Wireless Update apps.
 
According to a report by senior malware intelligence analyst Nathan Collier, each of the malware variants has “their own unique infection characteristics,” he said.
 
The phone is distributed by the Lifeline program via Assurance Wireless by Virgin Mobile. It’s not clear whether the device is still available, but researchers found its user manual available on the Assurance Wireless website, Collier said. At the time of this writing, however, that website was not available.
 
The Lifeline Assistance Program provides people with lower incomes in the United States access to mobile phone services and devices. Curiously, the malware that researchers found on the UL40 device is the same as the malicious apps that Malwarebytes researchers discovered on the Unimax Communications U683CL Android device in January. That device also is distributed via the program, and the issue was later resolved, researchers said.
 
The UL40 device analyzed by Malwarebytes came with a preinstalled trojan file: Android/Trojan.Downloader.Wotby.SEK. It’s installed in the device’s Settings app, which as its name suggests, is required to control all of the device’s settings. It is thus undeletable, as to remove it would render the device useless, Collier said.

Read more: https://threatpost.com/undeletable-malwa...ce/157289/