Tecno Dismisses Malware Allegations, Saying It’s Old News

The Chinese-owned African mobile phone giant Tecno is rebutting new accusations that its W2 phones came pre-installed with malware. In a statement sent to the Nigerian tech news website Silicon Nigeria on Tuesday, Tecno claimed that the Triada malware was first discovered in April 2018 and since then the company distributed a patch that customers could use to remove the program.

The company added that if customers ran any system updates on their phones since 2018, then that would have eliminated the problem. For those who haven’t yet done so the company advised: “For current W2 users facing Triada issue presently, we advise that they download the [over the air] fix on their phone for installation, or contact TECNO’s after-sales service support for assistance.”

Interestingly, the statement made no mention of the xHelper malware program that Secure-D also discovered on Tecno’s W2 phones.

Secure-D, the security division of the mobile technology company Upstream Systems that identified the malware on 53,000 Tecno devices in a new report, also acknowledged that Triada/xHelper apps had been around for more than a year. “Starting in March 2019, Secure-D caught and blocked an unusually large number of transactions coming from Transsion Tecno W2 handsets mainly in Ethiopia, Cameroon,  Egypt, Ghana, and South Africa, with some fraudulent mobile transaction activity detected in another 14 countries,” the company said in a blog post published this week.

Tecno blamed an undisclosed “vendor in the supply chain process” for the problem, according to this week’s Buzzfeed News report that broke the story.

Key Highlights From Secure-D’s Report on Pre-Installed Malware on W2 Tecno Phones

• HOW THE MALWARE WAS DETECTED: “Secure-D acquired a selection of Tecno W2 mobile phones, both used from real users and newly purchased, to analyze the nature of the software that caused the fraudulent subscription requests. The analysis was carried out using a combination of device models and firmware versions. Phones were used for different purposes and connected to different types of networks. “The investigation confirmed that Tecno W2 devices came with Triada-related malware pre-installed. Triada is a well-known and extensively investigated malware that acts as a software backdoor and malware downloader.”

• HOW THE MALWARE FUNCTIONED: “As soon as the device was placed in Secure-D’s protected ‘sandbox’ testing environment and connected to the internet, Triada malware would then download a second malware called xHelper. We identified new system libraries that the malware patched in order to compromise other essential applications. These changes made the malware resilient across reboots, attempts at removal, and factory resets.”

SUGGESTED READING:

• Upstream Systems: Well-Known Malware Committing Click Ad Fraud on Low-End Devices in Emerging Markets Uncovered by Secure-D
• BBC News: Chinese phones with built-in malware sold in Africa
• Silicon Nigeria: TECNO Debunks Fake Report On Mobile Security Flaw

• Get a daily email packed with the latest China-Africa news and analysis.
• Read exclusive insights on the key trends shaping China-Africa relations.
• Connect with leading professionals on the China- Africa Experts Network.

You've reached your free monthly article limit.

Subscribe today for unlimited access.

-17% Savings

The post Tecno Dismisses Malware Allegations, Saying It’s Old News appeared first on The China Africa Project.

source https://chinaafricaproject.com/2020/08/26/tecno-dismisses-malware-allegations-saying-its-old-news/?utm_source=rss&utm_medium=rss&utm_campaign=tecno-dismisses-malware-allegations-saying-its-old-news