5,815,022 Members 39,471 Now Online
XDA Developers Android and Mobile Development Forum

Pre-installed Uupay.A/Uupay.D spyware on some Chinese phones

Tip us?
 
SUMM0NER
Old
(Last edited by SUMM0NER; 14th June 2014 at 11:03 AM.)
#1  
SUMM0NER's Avatar
Member - OP
Thanks Meter 4
Posts: 38
Join Date: Jun 2007
Location: London
Exclamation Pre-installed Uupay.A/Uupay.D spyware on some Chinese phones

Heise (German publisher of various computer related magazines) has just put up an article about the Chinese Star N9500 Android smartphone coming pre-loaded with a trojan called Uupay.D, that will try to harvest your personal information on the phone and may even try to send costly SMS to premium numbers.

link to the article translated into English

link to article in German

I just checked my shiny new iNew/Alps i7000 with ESET Mobile Security and sure enough, it has the Uupay.A trojan apparently macerating as Google Play service.
Regards

SUMMONER

- Sony Xperia Mini Pro (Mango/SK17i), running Kit Kat (PAC-man ROM 4.4 Alpha 1)
- iNew I7000 MTK6589 Quad Core phone with stock Android 4.2

Mobile Internet via Three UK and email/contacts/calendar via Google Apps.
The Following 3 Users Say Thank You to SUMM0NER For This Useful Post: [ Click to Expand ]
 
ganeshkrishnan
Old
#2  
Junior Member
Thanks Meter 1
Posts: 3
Join Date: Apr 2014
Default Root your device

Root your device and from /system/app remove the extra play apks. The offending apk is not part of system image but of the custom ROM that is on these phones.

Run the the ESET anti-virus to check for the trojan
The Following User Says Thank You to ganeshkrishnan For This Useful Post: [ Click to Expand ]
 
N2k1
Old
#3  
Member
Thanks Meter 13
Posts: 41
Join Date: Feb 2008
Quote:
Originally Posted by SUMM0NER View Post
Heise (German publisher of various computer related magazines) has just put up an article about the Chinese Star N9500 Android smartphone coming pre-loaded with a trojan called Uupay.D, that will try to harvest your personal information on the phone and may even try to send costly SMS to premium numbers.

I just checked my shiny new iNew/Alps i7000 with ESET Mobile Security and sure enough, it has the Uupay.A trojan apparently macerating as Google Play service.
This program ist known here since 2013/08.
Kaspersky lab wrote in march about this problem - but it was not interesting enought.
Now, the german crew from GData saw this app (it is only a PUP - not a trojan or virus) and they make money with there own anti virus app.

Go to settings --> Apps --> scroll to all apps --> deactivate (or remmove all apps if your phone is rooted.)
You are able to scann all apps on your phone if you pull all apps to your PC (adb pull /system/app and if you run KitKat adb pull /system/priv-app)

Remember: In the eyes of anti virus crews are all rooting apps also malicous apps!
The Following User Says Thank You to N2k1 For This Useful Post: [ Click to Expand ]
 
zxzyzd
Old
(Last edited by zxzyzd; 17th June 2014 at 03:29 PM.)
#4  
zxzyzd's Avatar
Senior Member
Thanks Meter 248
Posts: 480
Join Date: Feb 2011
Also see http://forum.xda-developers.com/show....php?t=2395007
Smartphone History:
LG GW620 / Desire / Desire S / Lumia 800 / Galaxy S2 / Xperia P / Xperia S / One S / Nexus 4 / Xiaomi Mi2s
The Following User Says Thank You to zxzyzd For This Useful Post: [ Click to Expand ]
 
SUMM0NER
Old
(Last edited by SUMM0NER; 17th June 2014 at 10:09 AM.)
#5  
SUMM0NER's Avatar
Member - OP
Thanks Meter 4
Posts: 38
Join Date: Jun 2007
Location: London
Thanks everyone!

Rooted my phone with this and then removed the fake Google Play app with Root App Delete.
Regards

SUMMONER

- Sony Xperia Mini Pro (Mango/SK17i), running Kit Kat (PAC-man ROM 4.4 Alpha 1)
- iNew I7000 MTK6589 Quad Core phone with stock Android 4.2

Mobile Internet via Three UK and email/contacts/calendar via Google Apps.
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes