Malware Found Pre-Installed on Xiaomi, Huawei, Lenovo Phones [pdf]

Lenovo..

When I worked for a company that distributed malware (mostly desktop, but trying to break into mobile), we had relationships with a few people who would buy up android devices in bulk and then charge money to companies like ours to have our apps pre-installed. You could pay extra to have the app baked into a custom rom to make it non-removable.

The business model from our end is we'd find app developers who are willing to pay X amount per install (a conversion was usually tracked by the first time an end user opens the app), and then we pay Y amount per install to a shady phone re-seller to bake that app into the rom of their latest batch of phones. As long as X is sufficiently higher than Y to account for whatever our conversion rate is, we make our money back plus profits as the app developer pays us for conversions.

The shady re-sellers would take their phones with new roms and either sell direct to consumer or, in the case of the bigger guys, move those phones on to a big-box retailer.

Well, this is a whitepaper from a company that wants to sell you mobile AV software... so IMO some independent verification (or better proof than what's in this PDF) would be good. Not that I doubt this goes on.

A random comment is not an "independent verification"

While SuperFish was a security risk it wasn't a "malware", there is a difference between various really stupid and blatant backdoors and other security risks and actual malware.

Lenovo didn't use it to steal user's data they could care less about it, but some one could abuse it to compromise users both through compromising SuperFish it self and by exploiting the fact that SuperFish will issue certificates to SSL websites even if the original certificate isn't really valid which will allow attackers to MITM SSL connections.

Sony also had distributed software that could be classified as backdoors or rootkits in it's CD's as DRM, many other companies also had similar incidents.

While it's a stupid practice and quite unfair to your customers you can't really call it malicious since they didn't really used it for that just never thought it quite true or didn't care enough in the first place.

The packages in this case seem to be actual malware and not some adware/unwanted software installed by the vendors which while might be a security risk wasn't intended to actually compromise the user.