Jiayu G4S TROJAN/MALWARE WARNING for custom and stock ROMs May/June - Android Q&A, Help & Troubleshooting

Hi all Jiayu users,
a recent stock ROM and many custom ROMs based on it, have been reported to have at least 2 trojans integrated.
Organizational:This has already been discussed in this general thread: http://forum.xda-developers.com/showthread.php?t=2746900&page=33
But there it goes out of sight very quickly so we should use this new thread to discuss security concerns with Jiayu ROMs in general.
I will update the thread title as soon as other models are reported to have it, too (that is likely).
I will also update the title if we find it is a false alarm (which I stopped to hope).
Any suggestions to improve this posting, or to move it to a better forum, are very appreciated.
It would be nice, if everyone could try not to clutter this thread with unnecessary things. For example, if you have suggestions what I should edit here, better contact me directly, instead of posting a reply that becomes obsolete quickly.​I've downloaded G4S-20140609-211642-SD.rar and G4SL-20140618-194209-SD.rar from needrom and verified the following facts myself. I did not test the stock ROMs, but in the general thread others reported that they have it, too. I don't know if they really came from an official source. April ROMs seem not to have it.
Many trustworthy virus/malware scanners detect trojans in system/app/ - see a list of reports in the virustotal links:
fonts 6.26
com.lovelyfonts
lovelyfonts_vanzo_noicon_6.26.apk
http://www.avgthreatlabs.com/android-app-reports/app/com.lovelyfonts/
https://www.virustotal.com/en/file/...e90eaa5e9e8a1dec4db0d4ece4a82be1185/analysis/
Unlock 2.144
com.yunlan.syslockmarket
SysMarket_92_NoIcon.apk
https://www.virustotal.com/en/file/...cd75a5543725b049c974735dcc66c526940/analysis/
Maybe one of them seems to download a third one and does it again if I delete it, which is clearly malicious behavior:
com.skymobi.pay.plugin 2.0.0.6
placed here: /storage/sdcard0/Android/data/com.skymobi.pay.app/plugins/com.skymobi.pay.opplugin_V2006.apk 174.95 KB
http://www.avgthreatlabs.com/android-app-reports/app/com.skymobi.pay.opplugin_v2006.apk/
https://www.virustotal.com/en/file/...19bf34f6884fa397f062e9b9e4ee4d9be0a/analysis/​I was able to delete both apps using Titanium Backup. Everything still works and the third app didn't come back anymore.
After deletion of the "fonts" app, without reboot, a chinese menu entry appears under settings/display. It translates to "font settings" and crashes when tapped. Maybe that's interesting.
Both apps caused wakelocks, consumed battery and sent data to the internet. They have lots of rights, and their names alone are suspicious.
Other Jiayu users with ROMs of May or June should check for these apps, too. Please report your results here. You can extract the ROM file on your PC and scan it with a virus scanner, or submit above apk files to virustotal or other online services.
Or, on your device, check for existence of the "fonts" and "Unlock" apps. You can do so under Settings/Apps, or in Titanium Backup, or Wakelockdetector and so on.
-Alex

---

Can you suggest tools to analyze what goes on on my device? Like a good task manager with lots of features showing useful info.
I would also like to see a list of open connections, and who caused them, is that possible?

---

I just downloaded and installer titanium to check for that apps, i dont seem to have any of those installed.
The rom i have its the official from jiayu.es, based on the 20140418-120537.
Anyways i wanted to check it manually, should I upload all my rom to virustotal?
Thanks

---

petete159 said:
I just downloaded and installer titanium to check for that apps, i dont seem to have any of those installed.
The rom i have its the official from jiayu.es, based on the 20140418-120537.
Anyways i wanted to check it manually, should I upload all my rom to virustotal?
Click to expand...
Click to collapse
This is an April ROM, and there are also other reports that they are not affected.
Since a few days, jiayu.es also has the June ROM for download.
No, you can't upload the whole ROM. You can unrar/unzip it on a PC and upload single apk files from /system/app/ - or directly upload from your phone (you can use ES file explorer to access that directory).

---

This warning is now in multiple forums, but no one seems to really care.
Where should I post to get attention?
Some say, I should just delete the suspicious apps and everything is ok. I did that, but I'm not feeling safe, of course. How can we find out more?

---

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I found this out also.
I've checked the app and it has suspiciously many rights...

---

mainstreamer said:
I found this out also.
I've checked the app and it has suspiciously many rights...
Click to expand...
Click to collapse
Thanks a lot, can you tell what ROM version you use and where you got it from. And if not G4S, what model?
What about the other 2 apps?

---

Stock Rom from jiayu.es (the latest). I have the g4s.

---

mainstreamer said:
Stock Rom from jiayu.es (the latest). I have the g4s.
Click to expand...
Click to collapse
for the records, that is:
(4.2.2)Rom Oficial Jiayu China 20140609-211642
http://www.jiayu.es/software.php?soft&jiayu=G4S

---

Alex1a said:
for the records, that is:
(4.2.2)Rom Oficial Jiayu China 20140609-211642
http://www.jiayu.es/software.php?soft&jiayu=G4S
Click to expand...
Click to collapse
Indeed. Somehow it's already included in the official rom.
Maybe it's time to contact jiayu directly?

---

mainstreamer said:
Indeed. Somehow it's already included in the official rom. Maybe it's time to contact jiayu directly?
Click to expand...
Click to collapse
I contacted jiayu.de at 30.6., they think it's harmless, but are looking at it - no further info until now.
I then contacted jiayu.es yesterday, but got no answer at all until now.
The latest official software posted on http://www.ejiayu.com/en/News.html is from April. How do we know, that 0609 and so on is really officially from them? Is there another official source?

---

I sent a detailed email to ejiayu.com and will post any comments here.

---

Answer from Jiayu Official Store España:
"Hello. We do not know anything about this issue because it is working right at this moment. Please contact to Jiayu China or ejiayu to talk about this issue with them."
EDIT: I then asked for help contacting Jiayu China and got this reply after some days:
"Hi. This rom is made bu Jiayu China not by us. We do not know anything from that,. Try to keep in contact with them because we can do nothinfg to fix it."

---

Hmm ok thanks.
Strange that nobody knows what might be going on. Is the latest rom maybe bogus?
Anyone got a good rom alternative for my jiayu g4s?

---

Here are the details:
http://securelist.com/blog/virus-watch/59356/caution-malware-pre-installed/
Zopo also does this: recent official KitKat has the fonts troyan, and it is embedded into Settings!
This is clearly intentionally done.
We, simple people, think we pay less for decent phones, and in fact, phone sellers and manufacturers sell out secrets to 3rd party without asking us.

---

Latest info: there's a new official kitkat ROM for this phone, and it has exactly the same 2 trojans
I really wonder why this security thread is that short. Is it the wrong place here, or doesn't anyone care? I don't feel secure after deleting those apps and don't want to use such ROM. So I restored the april stock ROM...
From official sources nothing new about this issue.

---

answer from german flagship store
Alex1a said:
From official sources nothing new about this issue.
Click to expand...
Click to collapse
I received an answer from the German branch (flagship store in germany: url jiayu dot de).
The applications are designed for remote maintenance.
I hope they are right.

---

cepria said:
I received an answer from the German branch (flagship store in germany: url jiayu dot de).
The applications are designed for remote maintenance.
I hope they are right.
Click to expand...
Click to collapse
Never ever, german store is more or less just a reseller with the same poor customer service than a chinese one, why should they confirm that the company who they earn the money with is distributing malware, this would kill their Business immediately

---

any news on this issue?
I'm planning to buy this phone, but only if the malware is 100% removable.
Can someone confirm that simply removing the APKs does the trick?
Are they located in /system/apps/?

---

Confirmed, or just flash a different rom, can suggest borx rom gold v3