Ars Technica reports hackers were able to preinstall an advanced backdoor on Android devices before they left the factories in 2017. Google confirmed the Triada backdoor was installed on several Android models and initially had trouble detecting it as it was “inconspicuously included in the system image as third-party code for additional features requested by the [original equipment manufacturers].” Triada was able to access the Google Play app and download and install apps of its choice. The backdoor bypassed built-in security protection and could potentially modify the Android OS’ Zygote process. Google has worked with manufacturers to remove the firmware.
Full Story