Google confirms that advanced backdoor malware came preinstalled on Android devices

Dan Goodin for Ars Technica:

Criminals in 2017 managed to get an advanced backdoor [Triada] preinstalled on Android devices before they left the factories of manufacturers, Google researchers confirmed on Thursday.
Once installed, Triada’s chief purpose was to install apps that could be used to send spam and display ads. It employed an impressive kit of tools, including rooting exploits that bypassed security protections built into Android and the means to modify the Android OS’ all-powerful Zygote process. That meant the malware could directly tamper with every installed app. Triada also connected to no fewer than 17 command and control servers.
In July 2017, security firm Dr. Web reported that its researchers had found Triada built into the firmware of several Android devices, including the Leagoo M5 Plus, Leagoo M8, Nomu S10, and Nomu S20. The attackers used the backdoor to surreptitiously download and install modules. Because the backdoor was embedded into one of the OS libraries and located in the system section, it couldn’t be deleted using standard methods, the report said.
On Thursday, Google confirmed the Dr. Web report, although it stopped short of naming the manufacturers.

MacDailyNews Take: Google’s toxic hellstew continues to boil unabated.
People who value security and privacy use real iPhones and iPads.
[Thanks to MacDailyNews Reader “Chris” for the heads up.]