US-Funded Android Phone Comes With Free Malware You Can't Remove

The US government has painted the image of a Chinese government that will use every trick in the book to spy both on its own citizens as well as other countries. The latter can come in the form of smartphones with spyware, which is one of the accusations it hurled at Huawei. It is almost ironic, then, that smartphones that the US government itself has funded to sell at an affordable price do exactly that and, unfortunately, there is no way to get rid of these malware.

The phone in question is a relatively unknown UMX U686CL and is offered by Virgin Mobile (yes, that same Virgin Mobile that Sprint is shutting down) as part of its Assurance Wireless plan, funded by the US government's Lifeline Assurance program. The $53 is as basic as basic can be but apparently has at least two unwanted gifts inside.

The first poses as a Wireless Updater and at least does exactly that. It is the only way to update the phone's firmware but is also able to install apps without having to ask the user's permission. Any such covert capability is almost begging to be hijacked to install more destructive malware.

The second malware functions as the phone's Settings app and its purpose is to install another HiddenAds malware on the phone. Unlike the Wireless Updater which can be forcibly removed at the expense of not getting updates, removing this second app will render the phone practically useless.

Both malware come from China as does the UMX phone itself. It's probable that neither Virgin Mobile nor the US government was aware of these facts, which is still ironic given the paranoia around Chinese-made phones. As Malwarebytes reports, UMX isn't alone in pre-installing unremovable malware on phones and things could actually be getting worse as time goes by.