What is "com.adups.patch"

SUPER-USER

Today i found the App "com.adups.patch" (Patch Tools 1.0.1) on my Phone.
Does anyone know what this App is?

dionisisg

dude!! this is a spyware app, where did you locate this app? i want to check on my super.

Mats

benchebacsi has explained that the version of ADUPS used is an old version, not containing the vulnerability/spyware. The Nougat beta (when/if it arrives) will have the affected version of ADUPS, while final Nougat ROM will have a later version, not affected.
ADUPS is the app responsible for OTA updates. You can disable it, but then you'll not get any OTA updates.

Mats

Read here: http://community.umidigi.com/for ... &fromuid=250090

dionisisg

Thanks for clearing this up, so we do not have to worry about it?

Localhorst86

Not at this point, no. We will have to worry about it again when the final nougat ROM is released to check if the final version really ships without a vlunerable version. In the meantime, I have still disabled both com.adups processed on my phone, just for good measure.

mrrog

Localhorst86 replied at 2016-12-7 18:36
Not at this point, no. We will have to worry about it again when the final nougat ROM is released to ...

Has anybody read the original security report/scare on this, importantly we need to know if earlier and later versions were cleared by the researchers, my assumption would be they only examined one version, so others, while not being criticised for their behaviour, are still highly suspect?

Mats

Well,

Any UMi models are currently not in the list of the affected devices and not mentioned in researches.

and

Once a UMi model will be reported as a vulnerable/infected device, we will take action to release an update as soon as possible.

makes me sleep well at night. I've read some of the research, and nowhere is UMi mentioned among potentially/confirmed affected devices.

mrrog

Mats replied at 2016-12-7 19:42
Well,
and

Mats, not sure what your saying here, my simple point is that if the research was limited to one version of the addups software, which UMI does not use, then it's no surprise to me that UMI is not being highlighted and Bence can wash his hands. But that is not the same thing as saying other versions, which UMI does use, are not similarly affected without us knowing, I.e. that if the vulnerability exists in one version it stands a distinct chance of existing in others, especially earlier ones. Unless the researchers have specifically addressed this I think it's remains a reasonable suspicion?

mrrog

mrrog replied at 2016-12-7 20:18
Mats, not sure what your saying here, my simple point is that if the research was limited to one v ...

And, to further point this up, am I wrong in thinking I have read this week that one of the manufacturers identified as affected has decided to replace the addups software with another, not merely change the version specifically identified?