Kryptowire, a security research firm, says millions of phones made by Chinese companies, including Blu, include a secret backdoor that send owner text messages to a server in China.
The backdoor also records location data, reports the contents of messages, and identifies the recipients of those messages. The software in question is made by a Chinese corporation called Shanghai Adups Technology Company and is installed on some 700 million phones, connected devices, and cars from Huawei, ZTE, Blu, and others.
Adups says its software is meant to help improve customer service by identifying junk messages and phone calls. Adups installed the software at the request of one of its Chinese phone-maker clients, but the company would not disclose which one.
Blu Products executive Samuel Ohev-Zion says the software was found on about 120,000 of its devices in the U.S., but was removed. “It was obviously something that we were not aware of. We moved very quickly to correct it,” said Ohev-Zion in a statement provided to the New York Times.
“Today there is no Blu device that is collecting that information.”
Ohev-Zion did not say how recently Blu discovered the software, nor when it was removed. Kryptowire says Adups’ software was hidden deep within the firmware of Android phones, invisible to end users. Adups insists it is the phone-maker’s responsibility to disclose such software and data collection to end users. Kryptowire has brought the matter to the U.S. Department of Homeland Security.
The research company did not say if Huawei or ZTE handsets are affected.
