Pinterest Stumbleupon Whatsapp
Ads by Google

The allure of a cheap smartphone can be hard to resist, especially as they’re now almost as capable as more expensive models. It’s for this reason why formerly-unknown Chinese manufacturers like Huawei and Xiaomi are rapidly overtaking Why Your Next Android Smartphone Should be Chinese Why Your Next Android Smartphone Should be Chinese For years, Chinese smartphones have gotten a bad reputation, but here's why you should really consider getting one now. Read More more established, premium manufacturers, like Samsung, Sony, and even Apple.

But, as in all things, you get what you pay for. A recently discovered vulnerability in many budget Chinese handsets, which could allow an attacker to gain root access, proves that modus. Here’s what you need to know.

Understanding The Attack

Many phones run SoCs (System on Chip Jargon Buster: The Guide to Understanding Mobile Processors Jargon Buster: The Guide to Understanding Mobile Processors In this guide, we'll cut through the jargon to explain what you need to know about smartphone processors. Read More ) built by Taiwanese-based MediaTek, who are one of the largest semiconductor manufacturers in the world. In 2013, they produced a phenomenal 220 million smartphone chips. One of their biggest sellers is the MT6582, which is used in a number of low-end smartphones, with many of them produced by Chinese manufacturers like Lenovo and Huawei.

The MT6582 came with a debug setting enabled, which according to wthe manufacturer, was used to test “telecommunications interoperability” in China.

While this was necessary for MediaTek to actually design the chip, and to ensure it works properly, leaving it on a consumer device represents an incredible security risk to consumers. Why? Because it allows an attacker, or a malicious piece of software, to gain root access to the phone.

Ads by Google

From this, they would be able to modify and delete important system files and settings, spy on the user, and install yet more malware without the user’s consent. If an attacker wanted, they could even brick the phone, rendering it permanently unusable.

According to The Register, this vulnerability can only be executed on phones running version 4.4 KitKat of the Android Operating system.

The discovery of this vulnerability follows a similar flaw found in the OS keychain of version 3.8 of the Linux Kernel, which was disclosed by researchers in January This Insane Flaw in Linux Gives Anyone Root Access To Your Box This Insane Flaw in Linux Gives Anyone Root Access To Your Box Read More . When exploited, this vulnerability would have allowed an attacker to gain root access of the machine.

This vulnerability affected virtually every distribution of Linux, as well as a plurality of Android phones. Thankfully, a fix was swiftly issued.

Put Down Your Pitchforks

Although phones from the likes of Lenovo and Huawei are especially affected, you shouldn’t blame them. Even though it might seem appealing, given some of these manufacturers have a history of security-related improprieties.

Lenovo is especially guilty of this. In 2014, they broke SSL for all of their users with SuperFish Lenovo Laptop Owners Beware: Your Device May Have Preinstalled Malware Lenovo Laptop Owners Beware: Your Device May Have Preinstalled Malware Chinese computer manufacturer Lenovo has admitted that laptops shipped to stores and consumers in late 2014 had malware preinstalled. Read More . Then they burdened their laptops with unremovable, BIOS-based malware. Then they installed a creepy, Big Brother-esque analytics program Now It's THREE Pre-Installed Malwares on Lenovo Laptops Now It's THREE Pre-Installed Malwares on Lenovo Laptops For the third time in a year, Lenovo have been caught shipping customers computers laden with privacy-unfriendly malware, showing that they haven't learned the lessons from the public outcry over Superfish. Read More on their high-end ThinkPad and ThinkCenter desktops.

But here, their hands are clean. For once. The blame lies squarely at the door of MediaTek, who shipped these chips to manufacturers with this setting enabled.

Am I Affected?

It’s worth pointing out that this vulnerability won’t have the same reach as the aforementioned Linux vulnerability. The vulnerability is only found on phones running on a chipset which didn’t ship on any phones released in 2015 and 2016.

It can also only be executed on phones running a very specific version of Android, which despite running on around one-third of Android phones, is by no means ubiquitous.

Despite that, it’s probably a good idea to check whether your phone is vulnerable. As it so happens, I own a budget Chinese phone – a Huawei Honor 3C, which was my main device until I jumped ship to Windows Phone in August.

HuaweiHonorC3

First things first, I looked up the device on GSMArena. This is essentially the Encyclopedia Britannica of phones. If a major manufacturer released it, this website will provide thorough statistics about it. Information about the chipset used can be found underneath Platform. Sure enough, my Huawei phone contains it.

MediaTekGSMArena

So, then I need to see whether I am running the affected version of Android. I opened Settings, and then tapped About Phone. This might be a bit different for your phone though. Manufacturers are known for customizing the settings menu.

Settings

Fortunately, my phone is running Android 4.2 Jellybean, which despite being long in the tooth, isn’t affected by this vulnerability.

If You Are Affected

While I was rather lucky, it’s safe to assume millions of phones will be affected by this. If you are, you’d be wise to purchase a new phone.

The Motorola Moto G The Moto G Is Officially Here For Only $179 Unlocked The Moto G Is Officially Here For Only $179 Unlocked Motorola has just announced the rumored Moto G, a cheaper cousin to the Moto X that will cost $179 for the 8GB model and $199 for the 16GB model. Read More is a great budget phone, produced by a manufacturer you can trust. You can get one on Amazon for just $110. As an added bonus, Motorola are rather speedy when it comes to issuing software updates, which Huawei is definitely not.

Motorola Moto G (2nd generation) Unlocked Cellphone, 8GB, Black Motorola Moto G (2nd generation) Unlocked Cellphone, 8GB, Black Front ported stereo speakers Buy Now At Amazon $299.99

If you can’t afford to upgrade, you’d be wise to make some simple security precautions. First, try to avoid downloading software from disreputable sources. Avoid downloading pirated apps Cracked Android Apps and Games: Read This Before Downloading Cracked Android Apps and Games: Read This Before Downloading The statistics don't lie: Most Android malware comes from outside Google Play. Downloading cracked apps -- or any type of app -- from a shady website or untrustworthy third-party app store is the way most... Read More and warez like the plague. Stick to the Google Play store.

It’s likely that many of the affected users will be based in China, where the Google Play store isn’t available. Chinese consumers have to make do with other alternative app stores Google Play Alternatives For Downloading Android Apps Without Fuss Google Play Alternatives For Downloading Android Apps Without Fuss Many people think that the Google Play Store is the only option Android users have for downloading apps, but there are actually quite a few quality alternatives out there. Read More , many of which aren’t as vigilant at filtering malware out as Google is. Those consumers would be advised to be extra careful.

In Short: Be Afraid, But Don’t

This vulnerability is scary. It’s scary because it’s borne from how a particular piece of hardware is configured. It’s scary because there are no steps a consumer can take in order to stay secure.

But it’s worth emphasizing that the majority of consumers won’t be affected. It only affects a limited number of devices, which were released by a handful of manufacturers around 2013 and 2014. Most people should be fine.

Were you impacted? If so, will you get a new phone? Or are you not all that concerned? Let me know in the comments below.

  1. Pat
    July 29, 2016 at 9:16 pm

    Hi I have Cubot X6 which is running 4.2.2 KitKat and the chipset is MT6592. I think my phone is affected. Keeps coming up with random ads and apps trying to install every few minutes while im on Facebook etc. It's really a pain in the butt! I bought it Christmas before last. It was fine until a couple of months ago. It's a good phone apart from that and the fact that the microphone is too quiet when calling someone. Should I bin it?

    • Matthew Hughes
      July 31, 2016 at 5:23 pm

      Try flashing it with a third-party ROM running a later version of Android!

  2. Lard Taco
    February 8, 2016 at 11:00 pm

    @jcase: Keep those froggies under control damn you! And come back to us, please. ;)

  3. Philip Bates
    February 7, 2016 at 9:33 pm

    A great article is being needlessly picked apart. I literally went on the article, scrolled through, chedk out the "Am I Affected?" section, went 'oh thank God, my phone's okay', and that was that. The title's a title. Otherwise, you're left with "Your Phone Might Be Affected By This Security Issue," which is more "alarmist".

  4. Dwayne
    February 7, 2016 at 2:38 pm

    You said that only a very specific version of Android is vulnerable, you never stated which version that is

  5. Lobster70
    February 6, 2016 at 5:56 pm

    Wait, Motorola is Lenovo. That should be mentioned here at least, especially with the embedded recommendation (ad) for Moto G! And, are any Motorola/Lenovo phones affected?

  6. Kelsey Tidwell
    February 5, 2016 at 4:13 am

    Dang, Matthew...it's a good article. Ignore every single nitpicker! You gave full instructions on how to tell if a phone is affected or not. I checked, and my ZTE is running Qualcomm...which I'm happy to say I own stock in hee hee. Thank you for alerting us to a POTENTIAL danger, for SOME phones...as your article states very clearly.

    Carry on.

    • Matthew Hughes
      February 5, 2016 at 12:46 pm

      Thanks Kelsey. I appreciate that.

  7. Eddie G.
    February 5, 2016 at 2:23 am

    I don't think my phone is all that important.....I already have a complete backup of every contact and email address in various places, so if anyone ever wanted to hijack it?..or brick it?...they're more than welcome to....I am able to replace my phone at any time....due to me being in the IT field....I guess this article is more for those people who are not able to do that?

    • Matthew Hughes
      February 5, 2016 at 12:48 pm

      Sure. It's basically a warning for anyone who has bought a budget phone in the past few years.

      Take my advice, or leave it. It's entirely up to the reader.

  8. Daniel
    February 4, 2016 at 1:54 am

    Didn't Lenovo (a Chinese company) buy Motorola? If so, doesn't that mean you are raising alarm on Chinese phones, while at the same time recommending that people go out and buy a budget Chinese phone?

    • Matthew Hughes
      February 5, 2016 at 12:48 pm

      I didn't say ALL Chinese phones were affected.

      • Daniel
        February 6, 2016 at 1:05 am

        If not all Chinese phones are affected, then your title and the contents of the article are potentially a little too alarmist.
        iPhones (and probably some Samsung phones) are made in China too, and from the way the first paragraph reads, it's not clear to me if you knew that --as you seem to draw a distinction between "premium" manufacturers and Chinese manufacturers. From the Motorola section, I couldn't tell if you knew that it's now owned by Lenovo.
        In the event you didn't know the manufacturer of every phone you mentioned in this article, it's probably best to not just assume.
        In any event, "Chinese" seems to be too much of an over-generalization. If it's a couple of Chinese vendors, just name those companies (e.g. Huawei etc), or better yet a list of models affected. I assume that information is probably out there somewhere. The link to GSMArena is helpful though, and it turns out my Chinese phone (OnePlus One) was apparently not affected.

  9. Bartb
    February 3, 2016 at 7:03 pm

    In China they call that a feature

    • Matthew Hughes
      February 3, 2016 at 7:17 pm

      Heh, clever. :D

  10. Yodi
    February 3, 2016 at 6:49 pm

    @Matthew Hughes it's turning out to be one of those days, isn't it? :)

    • Matthew Hughes
      February 3, 2016 at 7:17 pm

      Don't you know it.

  11. Read and Share
    February 3, 2016 at 5:44 pm

    My comment got removed because I happen to agree with Alex? I will repeat again that the vibe I got -- esp. reading the title -- is the author resorting to a cheap shot at 'Chinese phones' just to get our attention. Not good.

    But reading on, one realizes it's one chip (Taiwanese) and one OS version (Kitkat). Well, the author at least had the decency of stating so... but only after the ridiculous title. Still not good.

    • Read and Share
      February 3, 2016 at 5:45 pm

      Oops, now my earlier comment shows up!?! Scratch the above then.

    • Matthew Hughes
      February 3, 2016 at 5:45 pm

      Your comment wasn't deleted. If you read below, you'll see that I responded to it.

      Again, not to labor the point, but THE MAJORITY OF THE MANUFACTURERS AFFECTED ARE CHINESE.

  12. Read and Share
    February 3, 2016 at 5:35 pm

    Agree with Alex -- that's the vibe I got. Is Matthew anti-Chinese? No, I don't believe so, not from reading his other articles. But he obviously couldn't resist resorting to a cheap shot at China to get our attention. Not good.

    • Matthew Hughes
      February 3, 2016 at 5:37 pm

      Right, we'll pretend that the majority of handsets aren't from Chinese manufacturers then.

      • Read and Share
        February 3, 2016 at 5:46 pm

        The majority of handsets do indeed come from China. But are all of them affected? Your title seems to imply. That's the cheap shot about it.

        • Matthew Hughes
          February 3, 2016 at 5:48 pm

          Right, because the word "might" means "definitely absolutely all of them".

        • Read and Share
          February 3, 2016 at 5:57 pm

          Dude, you really don't get it, huh? Try this on for size. Say some critical bug affects certain models of Apple, Motorola, etc. phones. This title below would be just as idiotic as yours:

          Your American Smartphone Might Have a Serious Security Problem

          Methinks you would specify brands.

        • Matthew Hughes
          February 3, 2016 at 6:00 pm

          Did you read the article? I did specify brands. Namely Huawei and Lenovo.

          I should point out we're not the only site to point out that the issue affects Chinese-made handsets. The Register did too.

          http://www.theregister.co.uk/2016/02/02/chip_chomped_as_devs_debug_backdoor_found_in_android_phones/

          But whatever. That's just, like, your opinion man.

        • Read and Share
          February 3, 2016 at 6:04 pm

          Did you read my comments? The title was a cheap shot to get our attention. But I also mentioned that you did eventually narrow down to the brands themselves. Still a cheap shot is a cheap shot. Don't do it again.

        • Christian Cawley
          February 5, 2016 at 3:52 pm

          As editor of the post, I'll be having sharp words with Matt for having the audacity to use a headline to get anyone's attention.

  13. Alex
    February 3, 2016 at 4:06 pm

    Well , I think this article is over reacted, these just MTK security issues, not Chinese . This topic is really aggressive . But go ahead if you like .

    • Matthew Hughes
      February 3, 2016 at 4:31 pm

      Lol dude, did you read the bit where I said the vast majority of Android phones won't be affected?

Leave a Reply

Your email address will not be published. Required fields are marked *