Another Preinstalled Backdoor Found? Facts

Yes, another preinstalled backdoor has been found — this time, security researchers discovered a hidden, hardcoded account in certain low-cost Android tablets and TV boxes sold under multiple brand names. The account, which cannot be removed by the user, allows remote access to the device, raising serious privacy and security concerns.

Background: How Preinstalled Backdoors Happen

Preinstalled backdoors are not new. They typically appear when a manufacturer or firmware developer adds a hidden access method for debugging, remote support, or government compliance — but fails to remove it before shipping. In the latest case, the backdoor was found in the firmware of a Chinese ODM (original design manufacturer) that supplies many budget Android devices. The same firmware was rebranded by dozens of smaller companies, so the backdoor affected a wide range of products.

Unlike malware that infects a device after purchase, a preinstalled backdoor is present from the moment you turn the device on. It cannot be removed by a factory reset, because it lives in the system partition, which is read-only for normal users. This makes it far more dangerous than typical adware or tracking software.

How the Backdoor Works

The backdoor works by adding a hidden user account to the Android system. This account has root-level privileges, meaning it can read all files, install apps, and even record audio or video without the user’s knowledge. The account is not visible in the standard Settings app, so most users never know it exists.

In the recent discovery, the hidden account was accessed through a special service that listens on a network port. An attacker who knows the account credentials can connect to the device remotely, bypassing the lock screen and gaining full control. The credentials are hardcoded in the firmware, so they are the same across all devices running that firmware version.

Security researchers often find such backdoors by analyzing firmware images. They compare the list of system users against the standard Android user list and look for unexpected entries. In this case, they found an extra user with a predictable password, which confirmed the backdoor.

Which Devices Are Affected

The affected devices are primarily budget Android tablets, TV boxes, and some smartphones sold under various brands. Many of these are sold through online marketplaces at very low prices. The exact list of affected brands is not fully public, but researchers have identified several common models.

• Low-cost Android tablets (typically under $100)
• Android TV boxes and streaming dongles
• Some entry-level smartphones from lesser-known brands
• Devices that run heavily customized firmware by the ODM

If you own such a device, you can check for the backdoor by looking for a hidden user account in the system settings (if you have root access) or by scanning the firmware with a tool like firmware-analysis-toolkit. For most users, however, the safest approach is to assume the device is compromised and take protective measures.

How to Protect Yourself

If you suspect your device has a preinstalled backdoor, the most effective solution is to stop using it for sensitive activities. Do not enter passwords, banking information, or personal data on such a device. Here are practical steps:

1. Check for firmware updates: Some manufacturers may release an update that removes the backdoor. Go to Settings > About > System Update and check for updates.
2. Install a firewall app: A firewall can block the network port used by the backdoor, preventing remote access. Apps like AFWall+ (requires root) or NetGuard can help.
3. Disable unnecessary services: If you have root access, you can manually remove the hidden account or disable the service that listens on the network.
4. Use a different device for sensitive tasks: For banking, email, and other sensitive activities, use a device from a trusted manufacturer with a clean record.
5. Consider installing a custom ROM: If available for your device, a custom ROM like LineageOS can replace the entire system and remove the backdoor.

Common Misconceptions

One common misconception is that a factory reset removes a preinstalled backdoor. It does not, because the backdoor is in the system partition, which is not touched by a reset. Another misconception is that only cheap, unknown brands are affected. While that is often true, even some well-known brands have been caught shipping devices with hidden backdoors in the past.

Another myth is that a backdoor is the same as a virus. A virus is malicious software that spreads and causes harm, while a backdoor is a deliberate access point that may be used for good or bad. In some cases, backdoors are added for legitimate purposes, such as remote diagnostics, but they become a security risk when they are not removed or when they fall into the wrong hands.

Finally, some users believe that using a VPN protects them from a backdoor. A VPN encrypts your internet traffic, but it does not prevent an attacker from accessing the device itself. The backdoor works at the system level, so a VPN offers no protection.

Comparison with Other Backdoors

This is not the first preinstalled backdoor found in Android devices. In 2018, researchers found a backdoor in certain low-end phones that allowed remote code execution. In 2020, another backdoor was found in a popular TV box firmware that sent user data to a remote server. Each case shares similarities: a hidden account, hardcoded credentials, and a network service that listens for connections.

However, the latest backdoor is notable for its simplicity and scale. Because the ODM supplies firmware to many brands, the backdoor affects a huge number of devices. The credentials are also weak (often just a simple password), making it easy for anyone to exploit.

Cost and Risk of Ignoring the Issue

The financial cost of a backdoor is not just the price of the device. If an attacker gains access, they can steal personal information, use the device in a botnet, or even hold your data for ransom. The cost of identity theft or data loss can be far higher than the price of a new device.

Ignoring the issue also carries privacy risks. An attacker can turn on the microphone and camera, read your messages, and track your location. For these reasons, it is wise to treat any device with a known backdoor as untrusted.

Alternatives to Affected Devices

If you need a budget Android device, consider buying from brands that have a good security track record and release regular updates. Google’s own Pixel line is the most secure Android option, but it is not cheap. Other options include Samsung’s mid-range Galaxy A series, which receives monthly security patches. For TV boxes, consider devices that run Android TV (the official version) rather than the generic Android fork used by many cheap boxes.

Before buying any device, search for its model number followed by “backdoor” or “security issue” to see if any problems have been reported. Also, check if the manufacturer provides a way to unlock the bootloader and install a custom ROM, which gives you more control over the firmware.

Frequently Asked Questions

Can I remove the backdoor without rooting my device?
No, because the backdoor is in the system partition, which is read-only without root. You can block network access to the backdoor with a firewall app, but you cannot remove the account itself.

How do I know if my device has this backdoor?
If you have root access, you can check the /system/etc/passwd file for unexpected users. Alternatively, you can search online for your device model and “backdoor” or “CVE” to see if it is listed. Some security apps also scan for known backdoors.

Is it safe to use such a device for gaming or streaming?
It is safer than using it for banking or personal communication, but the backdoor still allows an attacker to access the device. If you do use it, avoid logging into any accounts and use a separate network if possible.

Will a VPN protect me from the backdoor?
No. A VPN encrypts your internet traffic, but the backdoor operates at the system level and can still be exploited. The attacker can access your device regardless of your VPN.

What should I do with an affected device?
The safest option is to stop using it and dispose of it properly. If you must use it, limit its use to non-sensitive tasks, keep it on a separate Wi-Fi network, and block its network access with a firewall.

Are there any legal actions against the manufacturers?
In some countries, regulatory bodies have investigated such cases, but legal outcomes are rare. Consumers can report issues to their local consumer protection agency, but the process is slow and often unsuccessful.

Related

• Hepa Purifier vs HVAC Filter: Cut Indoor Particle Pollution
• HDMI Display Stuck at Lower Resolution or Refresh Rate?
• Fix Valorant Tournament Stream Lag, Buffering & Frame Drops

in t | Finish time | min | 50 | 0
in d | Distance | km | 10 | 0
out pace | Average pace | min/km | t / d | 2
out speed | Average speed | km/h | d / (t / 60) | 2