Update, 8/1/17, 2:20pm PT: After this story was published, Blu responded to our request for comment with the following: "Since Nov 2016 when the initial privacy concern was reported by Kryptowire, which BLU quickly remedied, Amazon has been aware of the Adups and other applications on our BLU devices which were deemed at the time by BLU, Amazon, and Kryptowire to pose no further security or privacy risk. Now almost a year later, the devices are still behaving in the same exact way, with standard and basic data collection that pose no security or privacy risk. There has been absolutely no new behavior or change in any of our devices to trigger any concern. We expect Amazon to understand this, and quickly reinstate our devices for sale.”
Original article: 8/1/17, 11:15am PT:
Smartphones are expensive. Here in the U.S., shoppers are left with three options: pay hundreds of dollars out of pocket, enter a contract with a wireless network provider, or find something that can get the job done without breaking the bank. People who choose the last option might be unwittingly giving away their personal information, however, according to the Kryptowire security company.
And it seems Amazon won't put up with that. The online retailer has pulled devices made by Blu, a Florida-based company, from its virtual shelves. "We recently learned of a potential security issue on select BLU phones, some of which are sold on Amazon.com," a company spokesperson told Tom's Hardware. "Because security and privacy of our customers is of the utmost importance, all BLU phone models have been made unavailable for purchase on Amazon.com until the issue is resolved. For more information, customers should contact BLU Products customer service at 1-877-602-8762 or firstname.lastname@example.org."
Here's the issue. Kryptowire revealed in November 2016 that it discovered mobile firmware that "actively transmitted user and device information including the full-body of text messages, contact lists, call history with full telephone numbers, unique device identifiers including the International Mobile Subscriber Identity (IMSI) and the International Mobile Equipment Identity (IMEI)" in several Android smartphone models.
That was just the tip of the iceberg. Kryptowire explained:
The firmware could target specific users and text messages matching remotely defined keywords. The firmware also collected and transmitted information about the use of applications installed on the monitored device, bypassed the Android permission model, executed remote commands with escalated (system) privileges, and was able to remotely reprogram the devices. The firmware that shipped with the mobile devices and subsequent updates allowed for the remote installation of applications without the users' consent and, in some versions of the software, the transmission of fine-grained device location information.
At last week's Black Hat conference, Kryptowire revealed that the firmware was still present on some devices. This time, however, it collected data in a much less obvious way. This implies that the company behind this firmware, Adups, knowingly collected personal information without permission and attempted to hide this data collection from the manufacturers who use its firmware. Blu still uses the firmware in some phones--hence the removal from Amazon.
According to Blu, though, its customers have nothing to be worried about. The company published a statement to say that "there is absolutely no spyware or malware or secret software" on its phones and that "these are inaccurate and false reports." It also pointed out that it hired Kryptowire after the November 2016 report to keep an eye on the Adups' firmware's activities.
Blu put itself in some interesting company with that last bit. The U.S. has repeatedly questioned the security of Huawei devices specifically because they send information back to China, with the fear being that the Chinese government could access that information whenever it wished. Saying it's acceptable to store information in China-located servers because Chinese phone makers do the same thing is a stretch at best.
"Kryptowire presented the technical details and forensic evidence of our findings at Black Hat, one of the largest security conferences in the world, in front of an audience of the world's foremost security experts. We stand behind those findings."
We've reached out to Blu, Best Buy, and Newegg to learn more about the situation and to see if the retailers plan to follow Amazon's lead. We'll update this post if we receive a response.
Stay on the Cutting Edge
Join the experts who read Tom's Hardware for the inside track on enthusiast PC tech news — and have for over 25 years. We'll send breaking news and in-depth reviews of CPUs, GPUs, AI, maker hardware and more straight to your inbox.
Nathaniel Mott is a freelance news and features writer for Tom's Hardware US, covering breaking news, security, and the silliest aspects of the tech industry.
I was tempted to get a BLU XL2 but I suspected that inexpensive phones with interesting specs would come at a hidden price. Maybe later when 3rd-party firmware becomes available.Reply
I just got a BLU XL2 a few months ago. Fantastic phone for a dirt cheap price. The privacy thing sucks, but I don't really care if China can see what I'm texting to my friends, none of it is really private anyways.Reply
I find it laughable that Amazon claims to be concerned with the "security and privacy" of it's customers considering the Echo has the ability to record and transmit everything that's said within range of it's microphone back to Amazon...which is an invasion of privacy itself. I guess Amazon wants to be the only company invading the privacy of their "customers"....Reply
Every company(not just Amazon) 'wants to be the only company invading the privacy of their "customers"....'.Reply
The reply from Blu that the current version has "data collection that pose no security or privacy risk" is laughable.Reply
I think it's more correct to state that the risks involved are not significantly greater than if you use any of the more mainstream smartphones that have Apple or Google track your every move.
My best guess would be that the gathering of data is less sensitive with Blu, but the risk of mis-use might be a bit higher.