Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

7/9/2018
12:54 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

New Android Smartphones in Developing Markets Sold With Pre-installed Malware

Upstream discovers infected devices for sale across 8 developing markets

LONDON, July 6th, 2018 – Upstream has today revealed that new inexpensive smartphone devices being sold to consumers in developing markets, many of whom are coming online for the first time, contain pre-installed malware, which collects their personal information, depletes their mobile data allowance and triggers fraudulent subscription charges to their pre-paid credit, without their knowledge or consent.

Guy Krief, CEO of Upstream, explains the findings: “Our Secure-D platform has uncovered that a number of cheap smartphones for sale in developing markets, such as Brazil, Egypt, Myanmar and South Africa, are sold with a digital ad fraud malware pre-installed, before the user has even turned the phone on for the first time. It communicates with, and sends unauthorized personal user data to a server in Asia, depletes their data allowance and signs them up to premium subscription services without their consent.”

Smartphone penetration in developing markets is growing rapidly, forecast to reach 62 percent by 2020, and, as a result, broadband connections are also increasing, expected to rise to 88 percent in Brazil by 2020, according to the GSMA Mobile Economy 2017 report. That said, the cost of data in emerging markets remains expensive, relative to local income levels, compared to what holds in developed markets (indicatively, in Brazil, 1GB of data would take the average person 6 hours of work to pay for). Moreover, in emerging markets, where 80 percent of people are unbanked, and most are pre-paid mobile subscribers, carrier billing — a payment method allowing users to purchase digital services by charging payments to their air time balance — is often the only way they can pay for digital services. The combination of these conditions creates an explosive context for the effects pre-installed smartphone malware has on consumers in emerging markets.

Krief added: “This malware is targeting consumers who are often getting online for the first time via their mobile device and have no other way to access the internet. In emerging markets, where online clicks can trigger a purchase and charges to airtime credit, such online advertising fraud directly impacts the end consumer. These users are immediately falling victim to fraudulent activity, which is using their mobile data allowance and taking money from their air time credit. In one month, we observed over 1.3 million fraudulent attempts to purchase a single digital premium service in Brazil alone, the first of the markets where we identified this issue in. A similar pattern was identified by our Secure-D platform in other emerging markets, like Myanmar, Egypt and South Africa.”

Upstream’s carrier-grade platform Secure-D combines machine learning algorithms with payment processing workflows to protect mobile operators and their subscribers against online transaction fraud and data depletion. The Secure-D platform, deployed in 12 markets with 18 mobile operators, processes over 3.3 million transaction requests per day.

Krief commented: “Digital ad fraud is a global phenomenon, responsible for a loss of more than 30 percent of global digital investment. It is mostly about fake impressions and clicks, generated by machines. If left unchecked, digital ad fraud has the potential to hold back the mobile internet revolution in developing markets by eroding customer trust in the entire digital ecosystem. From a business perspective, and morally, protecting the next three billion consumers who are coming online for the first time needs to be a top priority for organizations working in high-growth markets.”

For more information, please visit www.upstreamsystems.com

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .