Backdoor security flaw found in ZTE Score M
A security flaw allowing third parties to control MetroPCS' ZTE Score M leaves users vulnerable.
A security hole was recently discovered in MetroPCS' ZTE Score M, allowing third parties the ability to control the device.
On May 10, a guest post on Pastebin included a hard-coded password for a root shell backdoor that would allow a hacker access to the Score M.
The post reads:
The ZTE Score M is an Android 2.3.4 (Gingerbread) phone available in the United States on MetroPCS, made by Chinese telecom ZTE Corporation.
There is a setuid-root application at /system/bin/sync_agent that serves no function besides providing a root shell backdoor on the device. Just give the magic, hard-coded password to get a root shell:
$ sync_agent ztex1609523
# id
uid=0(root) gid=0(root)
In the end, the anonymous poster concluded with the sentence, "Nice backdoor, ZTE."
In response, ZTE has confirmed the existence of the security hole and issued an official statement promising that it'll release a security patch before May 31, 2012:
...ZTE has identified a technical defect that exposes ZTE Score M units sold in the United States to potential third-party exploitation.
ZTE takes customer privacy very seriously and makes every effort to ensure personal data is safe from unauthorized access. ZTE is actively working on an update patch and expects to send the update over-the-air to affected users before May 31, 2012. ZTE is providing all relevant customer support possible in this isolated incident. We would encourage affected users to download and install the patch as soon as it is rolled out to the affected device.
ZTE also clarified that the security flaw, rumored to affect the ZTE Skate, does not exist in the Skate.
Though the Score M isn't the most popular handset on the market by far, the security setback doesn't bode well for ZTE.
The Chinese manufacturing company is the fourth largest cell phone vendor in the world, but its presence in this country is small.
Despite a consistent effort to crack the U.S. market, handset companies from China, like ZTE and Huawei, are often plagued by rumors and skepticism that connect them with the Chinese government.
