Spyware in our phones?

Mats

There are indications of some Chinese phones sending user data from phones to servers in China.
Accoirding to Yahoo (http://finance.yahoo.com/news/kr ... ware-151000892.html) there's an app called com.adups.fota and/or com.adups.fota.sysoper
Of course I had to take a look in my Super, and wouldn't you know: There's an app in /system/app named AdupsFota.apk
As it's a system app, it can't be uninstalled (without rooting) - UMi - How do we proceed from here?
(More info here: http://www.theverge.com/2016/11/ ... china-text-messages)

Localhorst86

Since FOTA does not work for me anyways (because I am rooted and I use TWRP) I decided to simply disable the two adups packages using Titanium backup. I hope that's enough.

YaKillaCJ

Well their are key underline differences. Google, Facebook, ect are not key logging. Basically taking everything I type across the board. They ate also self contained and thus only can take what I use within there system. Thus sensitive info like what's in a bank app/website or text messages are not being logged. That's important. Good news is Umi seem to not be infected because they are using outdated versions of FOTA. Exception being the Umi Plus Nougat test build possibly vulnerable. I'm gonna take a look tho because I'm rooted to see if the servers are connecting.

Andrew87

I am very curious to know UMI's reponse on this issue.

davide2786

...........

Mats

Well, it could be a legitimate app to download FOTA updates, but then again - Who knows? Maybe someone with root could install https://play.google.com/store/ap ... spycell.connmonitor to see if the mentioned servers/IP is connected to?
I'm usually not all that anal with "personal integrity" as I rarely have anything to hide, but if lots of personal info is sent to China, I'd be a little irritated, to say the least.

Mats

If I list installed packages, I see:
package:/system/app/AdupsFotaReboot/AdupsFotaReboot.apk=com.adups.fota.sysoper
and
package:/system/app/AdupsFota/AdupsFota.apk=com.adups.fota

Exactly the package names mentioned in the Yahoo Finance article.

SilentMobius

\n\nJust a reminder that Adups OTA firmware is a perfectly legitimate product for managing OTA updates in China.

However it's also a backdoor for data harvesting.

All we can really do is pressure Umi to stop using the service because that kind of intrusion is not acceptable in the west.

in the meantime I'd recommend people issue:

> pm disable com.adups.fota
> pm disable com.adups.fota.sysoper

Via ADB to disable these.

SUPER-USER

Why do you think about a Chinese company spying on you?
What do you do about Facebook, Twitter, WhatsApp,...?
Whether UMI or Google evaluates and sells my data makes no big difference.

Mats

Yes it does, to me at least. I can choose to use or not use FB, Twitter, Google & cetera. Those players are very clear on that whatever I do when I use their apps is harvested, analysed and stored. The thing is this is something I can't remove, and there's no indication anywhere that my phone comes with this kind of "functionality" preinstalled. I don't care who or what can get my personal data - It's the fact that I'm (was) held unaware of the fact that bothers me.

mrrog

personally i'm not that bothered, don't keep any private information on my phone, but came across this today:-

http://android.wonderhowto.com/h ... ne-disable-0175034/

anybody know anything about it?