{"id":183721,"date":"2026-10-09T22:53:43","date_gmt":"2026-10-09T20:53:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/vredonosnoe-po-v-proshivkah-kitajskih-android-smartfonov-na-chipah-mediatek"},"modified":"2026-10-09T22:53:49","modified_gmt":"2026-10-09T20:53:49","slug":"malware-in-the-firmware-of-chinese-android-smartphones-powered-by-mediatek-chips","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/malware-in-the-firmware-of-chinese-android-smartphones-powered-by-mediatek-chips","title":{"rendered":"Malware nei firmware degli smartphone Android cinesi basati su chip MediaTek","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

L'azienda Bitdefender ha rilevato attivit\u00e0 di integrazione di malware nei firmware degli smartphone Android basati su piattaforme MediaTek, prodotti in Cina sotto vari marchi. L'attivit\u00e0 dannosa \u00e8 concentrata sulla sostituzione della pubblicit\u00e0 e sul click fraud, oltre a mantenere un botnet di dispositivi che formano una rete distribuita per organizzare attacchi DDoS e il proxying del traffico.<\/p>\n

Il malware preinstallato \u00e8 principalmente distribuito attraverso dispositivi economici, come il Doogee S200 X e il Cubot KINGKONG X, ma si trova anche in copie contraffatte del Samsung Galaxy (S25 Ultra, S24 Ultra e Note 18 Ultra) e in dispositivi ispirati all'iPhone. I dispositivi problematici sono stati registrati in oltre 150 paesi, con il numero pi\u00f9 elevato riscontrato in Messico, Francia, Italia, Stati Uniti, Germania, Brasile e Spagna. <\/p>\n

I componenti dannosi vengono forniti sotto forma di applicazioni di sistema, come com.android.system.lite, com.android.sys.gmsprot, com.android.sys.bcprot e com.android.sys.prot, firmati con una firma digitale della piattaforma ed eseguiti con i diritti android.uid.system, che consentono l'installazione di applicazioni e la gestione delle autorizzazioni. Il codice integrato nel firmware scarica ulteriori applicazioni, in cui viene implementata direttamente l'attivit\u00e0 dannosa, e delega ulteriori autorizzazioni, come l'accesso alle notifiche e agli SMS. Sono stati registrati 32 di queste applicazioni installabili, che combinano funzioni dannose con un editor audio, un widget meteo, un gestore di file, un blocco delle applicazioni e OCR. <\/p>\n

La principale funzionalit\u00e0 dannosa \u00e8 integrata nella libreria libeasy.so, che fornisce funzioni per scaricare ulteriori moduli dannosi da server esterni. Il servizio per interagire con i controllori server<\/a> \u00e8 camuffato da API per la verifica delle previsioni del tempo. Poich\u00e9 i componenti dannosi fanno parte della sezione di sistema, per la loro rimozione \u00e8 necessaria una reflash del dispositivo o la disattivazione dei componenti tramite l'utility ADB.
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 Android-\u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u043e\u0432 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 MediaTek, \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0432 \u041a\u0438\u0442\u0430\u0435 \u043f\u043e\u0434 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u0431\u0440\u0435\u043d\u0434\u0430\u043c\u0438. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0441\u043e\u0441\u0440\u0435\u0434\u043e\u0442\u043e\u0447\u0435\u043d\u0430 \u043d\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b \u0438 \u043d\u0430\u043a\u0440\u0443\u0442\u043a\u0435 \u043a\u043b\u0438\u043a\u043e\u0432 \u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u0443, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 \u0438\u0437 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u0443\u044e \u0441\u0435\u0442\u044c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 DDoS-\u0430\u0442\u0430\u043a \u0438 \u043f\u0440\u043e\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430. \u041f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0435 \u0438\u0437 \u043a\u043e\u0440\u043e\u0431\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043e \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183721","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Malware nei firmware degli smartphone Android cinesi con chip MediaTek | ProHoster","description":"L'azienda Bitdefender ha rilevato attivit\u00e0 di integrazione di malware nei firmware degli smartphone Android basati su piattaforme MediaTek, prodotti in Cina sotto vari marchi.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/malware-in-the-firmware-of-chinese-android-smartphones-powered-by-mediatek-chips","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 Android-\u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u043e\u0432 \u043d\u0430 \u0447\u0438\u043f\u0430\u0445 MediaTek | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Bitdefender \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 Android-\u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u043e\u0432 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 MediaTek, \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u043c\u044b\u0445 \u0432 \u041a\u0438\u0442\u0430\u0435 \u043f\u043e\u0434 \u0440\u0430\u0437\u043d\u044b\u043c\u0438 \u0431\u0440\u0435\u043d\u0434\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/malware-in-the-firmware-of-chinese-android-smartphones-powered-by-mediatek-chips","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-09T20:53:43+00:00","article:modified_time":"2026-10-09T20:53:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/183721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=183721"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/183721\/revisions"}],"predecessor-version":[{"id":183722,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/183721\/revisions\/183722"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=183721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=183721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=183721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}