According to a report published two days ago, owners of some models of the popular Infinix phones in Nigeria and around the world are vulnerable to attacks by malicious bugs. These attacks are capable of taking over and controlling the whole device.
The security researchers, from Bitsight company, showed how the bug which affects mostly low-end phones produced in China.
Surprisingly (at least to me) most of the phones are based in the United States of America. The total number of phones affected worldwide so far is about 3 million devices with the US accounting for over 2 million.
The code execution attacks, also referred to as man-in-the-middle attacks, are very hard to detect because the bugs would have full root privileges once inside the phone.
Some time ago, the researchers discovered the possibility of embedding these bugs in the affected phones through two Internet domains that were not registered.
The Internet domains, meanwhile, were already part of the firmware of the phones. In other words, the manufacturers of the softwares used in the phones included these two domains inside the software.
So if hackers had registered and acquired the domains, they would have been able to send malicious bugs to all these phones.
What happens in essence is this: since the domain names are already in the devices’ firmwares, connection to the domains would be automatic once there is internet access. It would then be easy to send viruses or bugs to take over the phones without the owner being aware of it.
And once inside, only a clean Install of the phone’s ROM would have eliminated the bugs. But a new ROM would still have the internet domains just waiting to be exploited again to take control of the phone remotely.
Fortunately, the security firm acquired these domains to stop hackers from doing so just in time. And up to this moment, they are still in charge of the two domains.
But that has not stopped these phones from trying to connect to these websites. It was from these attempts to connect to the websites that the researchers were able to estimate the number of phones affected worldwide.
The biggest culprit are BLU phones, which accounted for about 26 percent of the phones affected. Infinix phones accounted for about 8 percent of these number. While other phones combined accounted for almost half of the total number of phones.
The complete list of the phone Models:
- BLU Studio G
- BLU Studio G Plus
- BLU Studio 6.0 HD
- BLU Studio X
- BLU Studio X Plus
- BLU Studio C HD
- Infinix Hot X507
- Infinix Hot 2 X510
- Infinix Zero X506
- Infinix Zero 2 X509
- DOOGEE Voyager 2 DG310
- LEAGOO Lead 5
- LEAGOO Lead 6
- LEAGOO Lead 3i
- LEAGOO Lead 2S
- LEAGOO Alfa 6
- IKU Colorful K45i
- Beeline Pro 2
- XOLO Cube 5.0
It is very likely that most phone models that sourced their firmware from RagenTek Group of China might be affected.
To know if your Chinese made phone is not affected, an internet research about your phone’s firmware would suffice. If the firmware was made by RagenTek Group, then you are very likely affected.
The firmware made by RagenTek containing these domains had two major flaws:
- Communications sent from and to the phones are no secured so could easily be hacked and
- When installing apps on phones with this firmware, there is no provision for code-signing to validate the authenticity of the apps.
So far, according to the security researchers, only BLU have acknowledged the problem and have released security updates to patch the bugs.
The efficacy of the security updates are yet to be tested by the researchers. And it is unclear if the security patches would be done over the air (OTA) or users have to download and install them manually.
It is situation like this that clearly separates responsible OEMs from those who don’t care about users of their devices. BLU have done the responsible thing by acknowledging and responding to the threat.
Others like Infinix are yet to make a statement about the problem. It seems manufacturers like them stop engaging with users once they have collected money from sale of phones.
This is irresponsible behaviour no matter how they may want to spin it.
image credit: arstecnica.com; blog.anubisnetwork.com; infinitymobilty.com