Gionee's mobile phone implanted in "Trojan Horse" made an illegal profit of more than 27 million yuan. Do you have it in your phone?

Editor Lu Wei

According to a recent judgment, Shenzhen Zhipu Technology Co., Ltd. (hereinafter referred to as "Zhipu Technology") implanted Trojans in Gionee's mobile phones, and carried out "pull-live" business for more than 2.884 billion times, with a profit of more than 27 million yuan.

The so-called "pull" is actually a widely criticized "brush data". Zhifu Technology involved in this case is a subsidiary of mobile phone company Gionee Group. This bad practice of collusion between well-known mobile phone manufacturers has aroused fierce criticism and accusation from the public.

In addition to the Jinli Trojan horse incident, cases of illegal implantation of trojans by mobile phones have emerged one after another. From "live" Trojans to trojans that steal personal privacy registration applications, mobile phone security issues are worrying.

Xue Jun, a professor and doctoral supervisor at Peking University Law School, told Caijing that the frequent implantation of Trojans in mobile phones is mainly due to the proliferation of "gray and black products" on the Internet, which makes criminals gain gray and black income by implanting Trojans. "Registering some accounts by stealing other people's mobile phone numbers, and then getting corresponding rewards, this is a typical form of network gray and black production."

165438+1October 30th, China Judgment Document Network released the first-instance criminal judgments of Shenzhen Zhipu Technology Co., Ltd., Xu Li, Zhu Ying and others on the crime of illegally obtaining data from computer information systems and illegally controlling computer information systems.

According to the judgment, Zhipu Technology, a subsidiary of Gionee Group, implanted "Lahuo" Trojan in the APP, and brought Trojan into the user's Gionee mobile phone through software update. From February, 20 18 to February, 20 19, the company used Trojan horse help platform or APP to "pull goods" for more than 2.884 billion times, involving more than 26.5 million mobile phones of Gionee brand, with a profit of more than 27 million yuan.

"Pull live" means that some platforms or apps are highly active without the user's knowledge and seek benefits from them. This behavior will directly lead to problems such as accelerated power and traffic consumption and memory occupation of users' mobile phones, which will further affect the user experience.

2065438+In July and August of 2008, Zhu, the legal representative of Beijing Baice Technology Co., Ltd. (hereinafter referred to as "Beijing Baice"), conspired with Xu Li, the general manager of Zhipu Technology, to implant the "story lock screen" APP with "pull" function into Jinli mobile phone, and then bring it into the user's Jinli mobile phone through the "story lock screen" software update. 20 18, 12, 1, both parties formally signed the "pull-live" agreement.

According to public information, Beijing Baice was established on 20 15, and its business scope includes technology promotion services, basic software services, application software services and Internet information services. Zhou mentioned in the judgment is the actual controller and legal representative of the company, Zhu, who holds 64.52% of the shares.

"Story Lock Screen" APP is a mobile phone application software, developed by Gionee Group and built into Gionee mobile phone. Users cannot uninstall it in the normal way. The judgment shows that the mobile phone installed with SDK automatically updates the version without the user's knowledge, and pulls the designated APP after receiving the pull command, thus achieving the effect of advertising and earning the pull fee.

20 18 12 due to the inefficiency of the existing "pull-live" mode, Zhipu Technology and Beijing Baice conspired again to implant the updated plug-in "Dark Horse Platform" into the "Story Lock Screen" and other apps, and install the updated "pull-live" Trojan horse through the "Dark Horse Platform" without the user's knowledge, thus improving the "pull-live"

Xue Jun told Caijing that one of the important reasons why Gionee Group implanted Trojans in its mobile phones was the convenience of operation. The company implanted a Trojan horse before selling mobile phones, and "implanted software in the process of selling hardware". This kind of behavior is hidden and not easy to be found. If a Trojan horse is implanted in other manufacturers' mobile phones, it is difficult to invade their systems or induce users to install some software and then bring the Trojan horse.

20 19 12, Xu Li and other four members of Zhipu Technology who participated in the case were arrested by Yiwu Public Security Bureau. On June/KOOC-0/65438+/KOOC-0/October/KOOC-0/KOOC-0/day, 2020, the first-instance judgment was completed in Yiwu People's Court.

The four defendants were sentenced to fixed-term imprisonment ranging from three years to three years and six months for the crime of illegally controlling computer information systems, and all voluntarily pleaded guilty. Among them, Xu Li, as the person in charge of the company, has the longest sentence of three years and six months. The persons involved in Beijing Baice were dealt with separately.

Zhipu Technology was established in June 20 14, and Gionee Group holds 85% of the shares. Liu Lirong, chairman of Gionee Group, is also the chairman of Zhipu Technology. Xu Li was the general manager of Zhipu Technology, holding 1 1% equity, and he was still the vice president of Gionee Group in 20 18 years.

Caijing noted that the time when Gionee Group began to implant Trojans in its own mobile phones was when the company encountered operational difficulties.

At the end of 20 17, Liu Lirong, the chairman of Gionee Group, was exposed to gambling debts, and it was later proved that he really owed more than one billion yuan. It was also at this time that the problem of Gionee's capital fracture was exposed. Gionee mobile phone suppliers, including Oufei Technology, began to cut off Gionee's supply or apply for asset preservation.

2065438+2008+65438+June 2008 10, Dongguan No.1 People's Court froze Liu Lirong's 4 1.4% equity for two years. Subsequently, Liu Lirong confirmed in an interview that Gionee had a capital chain crisis.

20 18 1 1 month, after several months of door-to-door debt collection, nearly 20 suppliers of Gionee Group submitted bankruptcy reorganization applications to Shenzhen Intermediate People's Court. On 20 18 12, Shenzhen Intermediate People's Court accepted the creditor's application for bankruptcy liquidation of Gionee Group, and Gionee Group officially entered the bankruptcy liquidation procedure. A few months ago, Xu Li and others began to carry out the "pull-live" business by implanting Trojans.

In addition to the "Trojan Horse Gate" incident of Gionee's mobile phone, two months ago, the Yuecheng District People's Court of Shaoxing City, Zhejiang Province pronounced a similar case.

According to relevant judicial materials, Sun Mou, deputy general manager of Shanghai Road Macro Data Technology Co., Ltd. and Su Mou, the legal representative of Beijing Yiliang Technology Co., Ltd., implanted an SDK with a Trojan horse program on the user's mobile phone, which enabled the mobile phone to open the designated APP advertisement from the background in the locked screen state. Subsequently, the two people implanted Trojans into more than 5.59 million mobile phones, making a profit of more than 330,000 yuan.

In addition to using Trojans to "pull live", there are also criminals who use mobile Trojans to steal personal information.

In the special action of "Net Net 20 19" in Guangdong on 20 19, Jiangmen police cracked a case of illegally obtaining computer information system data, which was the first case in China to crack down on illegal online production of pre-installed mobile phones to obtain verification codes to register online accounts. According to public reports, a technology company in Shenzhen cooperated with a number of mobile phone manufacturers with miscellaneous brands to implant Trojan hacking programs into mobile phones that have not yet left the factory, and more than 300,000 mobile phones across the country were controlled.

After the user buys a mobile phone and inserts a calling card, the mobile phone number is controlled by a hacker program. The above-mentioned technology companies set up several platforms to receive mobile phone verification codes, and combined with pre-implanted Trojan horse programs, provided the received mobile phone numbers and SMS verification codes to downstream gangs for registering various online accounts. However, after the verification code returns, it will be deleted or blocked in the background immediately, and users can't find the Trojan horse.

There are many similar cases, and the old man-machine is the hardest hit. 2065438+August 2009, Zhejiang police cracked a case of implanting Trojan horse into an elderly machine. A technology company in Shenzhen cooperated with many established motherboard manufacturers to implant Trojan horse programs into motherboards. When the calling card is inserted, the Trojan horse program can obtain information such as the mobile phone number and automatically intercept the verification code and transmit it to the background database. This case involves more than 3.3 million old machines.

Zhu Wei, deputy director of the Communication Law Research Center of China University of Political Science and Law, pointed out that the so-called Trojan is actually a "small plug-in". When users browse some websites or download some apps, Trojans may be unconsciously brought into their mobile phones, and most of them are for profit.

Zhu Wei told Caijing that there are many ways to profit from Trojans, and the "false registration" mentioned above is a very common one. Criminals use mobile phone numbers to register accounts, and then act as the "water army" of some platforms to help them make data fraud.

According to the Special Report on Android Malware in 20 19 released by 360 Security Brain, in 20 19, 360 Security Brain intercepted about 1809000 new malicious programs on the mobile terminal, and intercepted about 5000 new malicious programs on the mobile terminal every day. The new malicious programs are mainly tariff consumption, accounting for 46.8%; Followed by privacy theft, accounting for 4 1.9%.

In Zhu Wei's view, the Gionee Trojan horse incident actually "sounded the alarm for people". At present, the mobile phone is not only a communication tool, but also a network platform. The existing technical means have been able to identify whether there is a Trojan horse in the third-party app. Therefore, it is more and more difficult to bring Trojans into mobile phones by using APP, which is likely to lead to APP failing to pass the trial. However, if the mobile phone manufacturer leaves a "backdoor program" in the APP that comes with the mobile phone, it will be difficult to identify it.

Xue Jun also expressed a similar view. He believes that the Ministry of Industry and Information Technology and other relevant departments should clarify the regulations on mobile phone access in the future, such as not leaving a "backdoor program"; The state should also strengthen law enforcement, punish Li Jing and other manufacturers who implant Trojans in their mobile phones, and cancel their network access qualifications.

In addition, Xue Jun reminded consumers that when buying mobile phones, they should choose reliable brands and not buy high-risk knockoffs. If you suspect that your mobile phone has been implanted with a Trojan horse, you should conduct professional testing in time.