From The Depths Of Counterfeit Smartphones

Summary: Trail of Bits and DeviceAssure tore down a counterfeit iPhone 6 and Samsung S10 and found both misreported their Android versions, running KitKat 4.4.0 (last updated 2014) and Lollipop 5.1 (last updated 2015) respectively, with kernels exploitable by DirtyCow and Towelroot. Both devices carried malware and rootkits, including the Umeng analytics library, a SystemUI component on the S10 that can download and install .dex files, and a RAT disguised as a font service called LovelyFonts that gives remote shell access, file upload/download, and event logging.
What's compelling: The S10's LovelyFonts backdoor grants whoever planted it total compromise of the phone and all its data, and the counterfeit manufacturer can implant or modify the ROM before distribution in a way most users cannot detect or patch.

Read the original at Trail of Bits Blog ↗