Pre-installed malware on Android POS terminals: how we found a factory backdoor from network traffic

POS terminals process financial transactions between credit cards and bank accounts, requiring strong security and segregation. So when FLOLIVE^® security monitoring flagged a fleet of Android POS terminals for talking to a known command-and-control (C&C) server, we had to investigate further.

The terminals are part of a Flolive customer’s fleet. We sampled one week in October, 271 SIMs, all in the same POS model, raised 1,508 alerts. Every one of them pointed to the same malicious server.

The traffic came from an app the manufacturer installed at the factory, and that app belongs to a malware family with public CVEs for remote command execution. These terminals were installed with remote control vulnerabilities through their supply chain. They shipped that way.

The findings below come from what the network can see.

Key findings

• 271 Android POS terminals on one customer sub-account raised 1,508 command-and-control (C&C) alerts in one week, all pointing to the same server.
• The traffic came from com.ekesoo.mtfont, a factory-installed “cloud font” app that matches LovelyFonts, a known family of pre-installed malware.
• Related apps in this family are covered by CVE-2019-15344, CVE-2019-15388 and CVE-2019-15389 (CVSS 8.1), which allow remote command execution over plain HTTP.
• During the week of analysis we didn’t find an attack in progress. 1,497 of the 1,508 connections went unanswered and no code reached the devices.

First look: was it an attack or factory software?

The shape of the alerts told us a lot before we looked at a single packet. All 271 SIMs were in the same POS model. They all called the same server on the same port, on every network the terminals used.

Malware that spreads does not look like that. It reaches different models at different times and shows up unevenly. What we were looking at behaved like something every terminal had carried from day one.

What was the malware doing on the POS terminals?

We pulled packet captures to see what a flagged connection actually contained.

Mostly, nothing. A terminal sent four TCP connection requests (SYN) over seven seconds, got no answer and gave up. That is 240 bytes and no content. In one five-minute capture, 52 terminals made 674 attempts. The server accepted five.

Those five were the interesting ones. When the server did pick up, the app made three calls:

• Update check: it asked for an update. None came back.
• Status and user calls: the server acknowledged both and sent nothing back.
• Check-in interval: a gap_time=18000000 parameter, in milliseconds, points to a five-hour cycle. Most alerts clustered in one morning hour, which matches the app schedule rather than when the terminals were in use.
• Data leaving the device: an encrypted 689-byte record went out on every /user call. 

So the terminals were checking in on a timer, reporting something encrypted, and asking whether there was anything new to run. The next question was which app was doing it.

What is LovelyFonts? Following the URLs to a known malware family

The requests named their sender: com.ekesoo.mtfont, a “cloud font” app built into the terminals’ firmware. A font app has no reason to check in every five hours, upload encrypted records or ask a remote server for updates.

We searched for the request paths. All three appear word for word in published research on pre-installed malware, a family known as LovelyFonts.

The research on this family is not reassuring. Apps from the same vendor are documented to:

• Run as the Android system user, start at boot, and download and execute code and plugins.
• Accept commands from anyone who can tamper with their plain-HTTP replies. CVE-2019-15344, CVE-2019-15388 and CVE-2019-15389 (CVSS 8.1) describe how that reply can make the device record the screen, read notifications and SMS, install a keylogging keyboard, or factory-reset itself.
• Turn up on cheap devices. Trail of Bits reported the family as a remote-access tool on counterfeit MediaTek phones in 2019.

The good news: nobody was using it

We found no sign of an attack in progress.

• No spread. One server, one port, one model. Nothing moved between devices.
• No tasking. Of 1,508 connections, 1,497 went unanswered and the rest got empty replies. No code or data reached the terminals.
• No break-in. Traffic looked the same before, during and after the alerts. Nothing changed on the devices when the alerts started.

The bad news: anyone could

The terminals were not under attack, but they were exposed.

• Backdoor-capable software is on every affected terminal, from a family with system-level access.
• Remote takeover is one reply away. Whoever controls the server, the hostnames or the network path can answer the app over plain HTTP with commands.
• Something leaves the device on every check-in, and it is encrypted.

On a POS terminal, the documented capabilities of this family (recording the screen, installing a keyboard, reading notifications) are not abstract. We have no evidence any of them were used here. We also do not know why the server stays quiet. It could start answering at any time.

How to contain pre-installed malware on an IoT fleet

Re-flashing a fleet of POS terminals takes weeks. Blocking a hostname at the core takes minutes. Because Flolive runs the core network, we could cut the backdoor off from its server on the sub-account APNs while the devices were fixed. That closes the remote-command path and stops the encrypted upload.

Our recommendations to the customer:

1. Block the hosts on the sub-account APNs now: *.yiqiziku.com, *.ekesoo.com, yiqicloudfont.com, loveota.net and loveota.com.
2. Inspect one terminal with adb shell pm list packages -f and look for com.ekesoo.* and com.lovelyfont.*.
3. Remediate the fleet with clean vendor firmware, remove the packages where possible, or replace the units.
4. Check the terminals that never called the server. They may already run a clean firmware build.
5. Keep monitoring. Escalate at once if any server reply carries content, which would mean code is arriving.

Conclusion: check what ships inside the device

If you deploy cellular devices at scale, a few things from this case apply well beyond POS terminals.

• The supply chain is part of the attack surface. These terminals left the factory with backdoor-capable software. Vetting the device vendor and the purchase channel matters as much as vetting the SIM.
• A threat-intel hit is a starting point, not a verdict. Checking the alerts against the traffic history told us this was neither a false positive nor a live attack. Without that history, the team would have had to guess.
• The network sees what the device does not report. Software with system-level access can make a device look clean from the inside. Its traffic still shows where it connects, how often and how much it sends.
• Plain HTTP from a privileged app is the real risk. A quiet server does not make the device safe. Anyone who can answer that request can control the device.
• A network-level block buys time. It contains the exposure while the slower work of fixing the devices happens.

Frequently asked questions

What is pre-installed malware? Pre-installed malware is software with malicious or backdoor capabilities that is built into a device’s firmware before it is sold. Because it runs as a system app, users usually cannot remove it, and security tools on the device may treat it as trusted.

How can you detect compromised IoT devices without installing an agent? Watch what the devices do on the network. Matching destinations against threat-intelligence lists, checking how often devices call home, and comparing behaviour across one device model can show a backdoor that the device itself does not report. In this case, SIM signalling and two packet captures were enough.

Is malware on a POS terminal dangerous if its C&C server is silent? Yes. In the LovelyFonts family, the app requests instructions over plain HTTP, so whoever controls the server, the hostnames or the network path can reply with commands. A quiet server today does not mean a safe device tomorrow.

Can a cellular connectivity provider block malware traffic? A provider that runs its own core network can block known malicious hostnames on a customer’s APNs. That cuts the device off from its C&C server and stops data uploads while the devices are fixed. Flolive can apply this kind of block for its customers.

How do you check an Android POS terminal for LovelyFonts? Connect to one unit and run adb shell pm list packages -f. Look for packages starting with com.ekesoo. or com.lovelyfont..

How do you reduce the risk of pre-installed malware in an IoT rollout? Ask the device vendor where the firmware comes from and how it is updated, inspect a sample unit before a large rollout, and monitor device traffic once the fleet is live.

Indicators and references

Package: com.ekesoo.mtfont; related: com.ekesoo., com.lovelyfont.

Hostnames: bbzt.yiqiziku.com, pushstablev9.yiqiziku.com, *.ekesoo.com, yiqicloudfont.com, loveota.net, loveota.com

URL paths: /cloudfontapp/upgrademsg, /cloudfontapp/status, /cloudfontapp/user?crypt_type=2

Public references:

• NVD: CVE-2019-15344, CVE-2019-15388, CVE-2019-15389 (Kryptowire, 2019)
• Trail of Bits: From the depths of counterfeit smartphones (2019)
• GitHub: jptrsn/mt6753-k53v1-malware, network_infrastructure.md