It's a manufacturer's nightmare: somewhere in the supply chain somebody has added malware to the mobile phones. Units go out to the customer with undiscovered pre-installed malware. And an ambitious security provider uncovers it and issues a global press release exposing the infection.
In this case, it's Transsion and their Tecno W2 smartphones.
Security platform Secure-D, part of Upstream (who sells software to more than 60 mobile operators in over 45 countries) processed more than 1.7 billion mobile transactions in 2019, detecting and blocking over 98,000 malicious apps in 20 countries.
Starting late last year, Secure-D caught and blocked an unusually large number of transactions coming from Transsion Tecno W2 handsets mainly in Ethiopia, Cameroon, Egypt, Ghana, and South Africa-- with some fraudulent mobile transaction activity detected in another 14 countries. To date, a total of 19.2m suspicious transactions – which would have secretly signed users up to paid subscription services without their permission – have been recorded from over 200k Tecno devices.
Secure-D’s further investigation discovered components of the xHelper/Triada malware preinstalled on 53k Transsion’s Tecno W2 smartphones, a low-cost handset model typically bought by those on a lower income.
Triada is a well-known and extensively investigated malware that acts as a software backdoor and malware downloader. It installs a trojan known as “xHelper” onto compromised devices.
It uses top-level device privileges to execute arbitrary malicious code after receiving instructions from a remote command and control server. It then hides inside permanent system components, making it more resilient against attempts to remove it.
Geoffrey Cleaves, Head of Secure-D at Upstream, comments: “This particular threat takes advantage of those most vulnerable." Referring to the fact this hits Africa's entry-level mobile buyers. Tecno W2 sells for $30-$45.
In 2018 alone, Transsion sold 124 million mobile phones globally. According to IDC figures for 2018, Transsion then ranked 4th in global mobile phone brands and still holds the largest mobile phone market share in Africa.
Transsion, now a billion dollar company running three brands from its HQ in Shenzhen, has been focusing on global market expansion in recent years. Tecno, for example, is a sponsor since 2016 of the English Premier League champions, Manchester City.Their global sales network covers 70+ countries in emerging markets including Nigeria, Tanzania, Kenya, Ethiopia, Egypt, India, Pakistan, Indonesia, Vietnam and Bangladesh.
But instead of scoring a goal, this time it's a yellow card for the Chinese manufacturer.
