{"id":183721,"date":"2026-10-09T22:53:43","date_gmt":"2026-10-09T20:53:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/vredonosnoe-po-v-proshivkah-kitajskih-android-smartfonov-na-chipah-mediatek"},"modified":"2026-10-09T22:53:49","modified_gmt":"2026-10-09T20:53:49","slug":"malware-in-the-firmware-of-chinese-android-smartphones-powered-by-mediatek-chips","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/malware-in-the-firmware-of-chinese-android-smartphones-powered-by-mediatek-chips","title":{"rendered":"Malware dans les firmwares des smartphones Android chinois utilisant des puces MediaTek","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

La soci\u00e9t\u00e9 Bitdefender a d\u00e9tect\u00e9 une activit\u00e9 d'int\u00e9gration de logiciels malveillants dans les firmwares de smartphones Android sur des plateformes MediaTek, fabriqu\u00e9s en Chine sous diff\u00e9rentes marques. L'activit\u00e9 malveillante se concentre sur l'insertion de publicit\u00e9s et le gonflement des clics publicitaires, ainsi que sur le maintien d'un botnet d'appareils, formant un r\u00e9seau distribu\u00e9 pour organiser des attaques DDoS et le proxy du trafic.<\/p>\n

Le logiciel malveillant pr\u00e9sent d\u00e8s le d\u00e9part cible principalement les appareils \u00e9conomiques, tels que le Doogee S200 X et le Cubot KINGKONG X, mais on le retrouve \u00e9galement dans de fausses copies de Samsung Galaxy (S25 Ultra, S24 Ultra et Note 18 Ultra) et dans des appareils imitant l'iPhone. Des dispositifs probl\u00e9matiques ont \u00e9t\u00e9 d\u00e9tect\u00e9s dans plus de 150 pays, mais le plus grand nombre a \u00e9t\u00e9 observ\u00e9 au Mexique, en France, en Italie, aux \u00c9tats-Unis, en Allemagne, au Br\u00e9sil et en Espagne. <\/p>\n

Les composants malveillants sont livr\u00e9s sous forme d'applications syst\u00e8me, telles que com.android.system.lite, com.android.sys.gmsprot, com.android.sys.bcprot et com.android.sys.prot, sign\u00e9es par une signature num\u00e9rique de la plateforme et ex\u00e9cut\u00e9es avec les droits android.uid.system, permettant l'installation d'applications et la gestion des autorisations. Le code int\u00e9gr\u00e9 dans le firmware charge des applications suppl\u00e9mentaires, dans lesquelles l'activit\u00e9 malveillante est directement impl\u00e9ment\u00e9e, et d\u00e9l\u00e8gue des autorisations suppl\u00e9mentaires, telles que l'acc\u00e8s aux notifications et aux SMS. 32 applications suppl\u00e9mentaires de ce type ont \u00e9t\u00e9 identifi\u00e9es, combinant des fonctionnalit\u00e9s malveillantes avec un \u00e9diteur audio, un widget m\u00e9t\u00e9o, un gestionnaire de fichiers, un bloqueur d'applications et un OCR. <\/p>\n

La principale fonctionnalit\u00e9 malveillante est int\u00e9gr\u00e9e dans la biblioth\u00e8que libeasy.so, fournissant des fonctions pour t\u00e9l\u00e9charger des modules malveillants suppl\u00e9mentaires \u00e0 partir de serveurs externes. Le service pour interagir avec les contr\u00f4leurs serveurs tr\u00e8s charg\u00e9s<\/a> est camoufl\u00e9 sous une API de v\u00e9rification des pr\u00e9visions m\u00e9t\u00e9orologiques. \u00c9tant donn\u00e9 que les composants malveillants font partie de la partition syst\u00e8me, leur suppression n\u00e9cessite un reflash de l'appareil ou la d\u00e9sactivation des composants via l'outil ADB.
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 Android-\u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u043e\u0432 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 MediaTek, \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0432 \u041a\u0438\u0442\u0430\u0435 \u043f\u043e\u0434 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u0431\u0440\u0435\u043d\u0434\u0430\u043c\u0438. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u0430 \u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b \u0438 \u043d\u0430\u043a\u0440\u0443\u0442\u043a\u0435 \u043a\u043b\u0438\u043a\u043e\u0432 \u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u0443, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 \u0438\u0437 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 DDoS-\u0430\u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0435 \u0438\u0437 \u043a\u043e\u0440\u043e\u0431\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043e \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183721","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Logiciels malveillants dans les firmwares de smartphones Android chinois sur des puces MediaTek | ProHoster","description":"La soci\u00e9t\u00e9 Bitdefender a d\u00e9tect\u00e9 une activit\u00e9 d'int\u00e9gration de logiciels malveillants dans les firmwares de smartphones Android sur des plateformes MediaTek, fabriqu\u00e9s en Chine sous diff\u00e9rentes marques.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/malware-in-the-firmware-of-chinese-android-smartphones-powered-by-mediatek-chips","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 Android-\u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u043e\u0432 \u043d\u0430 \u0447\u0438\u043f\u0430\u0445 MediaTek | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 Android-\u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u043e\u0432 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 MediaTek, \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0432 \u041a\u0438\u0442\u0430\u0435 \u043f\u043e\u0434 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u0431\u0440\u0435\u043d\u0434\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/malware-in-the-firmware-of-chinese-android-smartphones-powered-by-mediatek-chips","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-09T20:53:43+00:00","article:modified_time":"2026-10-09T20:53:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/183721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=183721"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/183721\/revisions"}],"predecessor-version":[{"id":183722,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/183721\/revisions\/183722"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=183721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=183721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=183721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}