Beware this low-priced Android smartphone: It comes bundled with spyware

Beware this low-priced smartphone from China – it may come bundled with spyware, a German security firm claimed this week.

Germany-based G Data said the "N9500" made by Chinese maker Star is the first phone to have the spyware installed as part of the firmware.

"The malware is disguised as the Google Play Store and is part of the pre-installed Android apps. The spyware runs in the background and cannot be detected by users," it said in a blog post.

It added the smartphone sends personal data to a server in China and can secretly install additional applications that can "retrieve personal data, intercept calls and online banking data, read emails and text messages or control the camera and microphone remotely."

Despite this, it said the phone is still being sold by large online retailers for 130 to 165 euros, mainly across Europe.

The company's initial findings showed the malware also blocks the installation of security updates.

Online criminals

G DATA product manager for mobile solutions Christian Geschkat said the options of the spyware "are nearly unlimited."

"Online criminals have full access to the smartphone," Geschkat said.

‘Subsidy’

Buyers not aware of the low-priced phone's spying capabilities would be enticed to buy it, as it sports a quad-core processor, a second battery, car charging adapter and second cover.

"Comparable devices from well-known brands cost almost three times that much," G DATA said.

However, G DATA added it is possible the low price is a "subsidy" due to the selling of data records stolen from the smartphone owner.

"In general, particularly cheap offers online that seem tempting should make buyers suspicious. There’s no such thing as a free lunch," said Geschkat.

Serious risk

G DATA said the smartphone poses a "serious risk to users" by allowing criminals to secretly install apps.

Such apps can lead to abuse ranging from interception and recording to purchases and banking fraud.

On the other hand, the company said it is impossible to trace where the data is sent.

"The intercepted data is sent to an anonymous server in China... It is not possible to find out who ends up receiving and using the data," said Geschkat. — Joel Locsin /LBG, GMA News