SMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets

## Overview

The presentation explores mobile botnets fueled by compromised firmware supply chains and how cybercriminals monetize them through SMS Phone Verified Accounts (PVA) and proxy services. The research, conducted by threat researchers including Zhengyu Dong, Theodore Ryan, and Vladimir Kropotov, focuses on how threat actors deliberately embed malicious loaders into mobile devices during the manufacturing and distribution lifecycle.

A central actor highlighted is the "Lemon Group," a group of Chinese-speaking individuals responsible for operating mobile botnets built from compromised supply chains.

---

## Supply Chain Architecture and Attack Vectors

The mobile supply chain involves multiple stages where tampering can occur: - **OEM vs. ODM Roles:** Original Equipment Manufacturers (OEMs, such as LG and Samsung) have factories that produce phones. Original Design Manufacturers (ODMs) also operate factories and typically manufacture devices in bulk. - **Image Hand-off and Third-Party Modification:** An OEM or ODM embeds the basic Android OS into a system image and transfers it to third-party vendors to add software features. Once modifications are complete, the image is returned to the OEM for final retail preparation. - **Budget and Quality Assurance Pressures:** Manufacturers of low-cost mobile devices frequently mass-produce hardware and negotiate with third-party vendors for low pricing. Budget, resource, and time constraints can lead to overlooked quality assurance (QA), providing an opening for malicious loaders to be introduced. - **Persistence via Firmware:** Firmware represents the lowest software tier with direct hardware interaction. Because malware is embedded in the firmware, it activates immediately upon first boot. While antivirus tools can repeatedly detect the threats, standard disinfection is insufficient; the device must be reflashed with clean firmware to remove the infection.

---

## Prevalent Malware Families and Historic Incidents

The speakers highlighted historic milestones and notable malware families associated with mobile supply chain attacks:

- **Triada and Guerrilla:** These represent two of the most prevalent malware families in mobile supply chain attacks. Google researchers (notably a researcher named Lucas) previously reported on Triada's involvement in mobile supply chains and assisted OEMs in disinfecting affected devices. - **Rise of ROM Customization:** Growth in the open-source Android market drove significant demand for ROM flashing and customization services in China, creating further opportunities for unauthorized modifications. - **The "Silent Plug-in" Incident (2011–2013):** - Developed between 2011 and 2012 as reflashing became less lucrative, this trojan was designed to illegally collect private data and send personal information to command servers starting in mid-2012. - The operation compromised data across devices, stealing approximately 20 million contacts. - The scheme involved collusion among three separate companies (one promoting an app store, another handling development, and a third providing ROM packages to promote software for fees) along with 10 individuals. - In 2013, domestic law enforcement intervened and arrested the perpetrators; one actor received a 3.5-year prison sentence and a fine of 700 to 800 US dollars. - Analysis indicated the compromised samples were neither Triada nor Guerrilla, but rather tampered FOTA (Firmware Over-The-Air) update mechanisms.

---

## Monetization and Threat Implications

- **PVA Abuse:** Platforms and service providers rely on Phone Verified Accounts (PVA) as a security mechanism to prevent fake accounts, bot registrations, spam, fake news, and online harms. Compromised mobile devices enable threat actors to intercept verification SMS messages and sell SMS PVA bypass services. - **Secondary Monetization:** Beyond SMS PVA interception, botnet operators monetize these infected devices through proxy services, app promotion schemes, and the exfiltration and sale of private user data.