87
My Google-certified Android phone was infected with Triada malware by a security update. Google ignored me.
(ethannelson-moore.github.io)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 27 Oct 2026
87 points (93.9% liked)
Android
22265 readers
235 users here now
The new home of /r/Android on Lemmy and the Fediverse!
Android news, reviews, tips, and discussions about rooting, tutorials, and apps.
🔗Universal Link: !android@lemdro.id
💡Content Philosophy:
Content which benefits the community (news, rumours, and discussions) is generally allowed and is valued over content which benefits only the individual (technical questions, help buying/selling, rants, self-promotion, etc.) which will be removed if it's in violation of the rules.
Support, technical, or app related questions belong in: !askandroid@lemdro.id
For fresh communities, lemmy apps, and instance updates: !lemdroid@lemdro.id
📰Our communities below
Rules
-
Stay on topic: All posts should be related to the Android OS or ecosystem.
-
No support questions, recommendation requests, rants, or bug reports: Posts must benefit the community rather than the individual. Please post to !askandroid@lemdro.id.
-
Describe images/videos, no memes: Please include a text description when sharing images or videos. Post memes to !androidmemes@lemdro.id.
-
No self-promotion spam: Active community members can post their apps if they answer any questions in the comments. Please do not post links to your own website, YouTube, blog content, or communities.
-
No reposts or rehosted content: Share only the original source of an article, unless it's not available in English or requires logging in (like Twitter). Avoid reposting the same topic from other sources.
-
No editorializing titles: You can add the author or website's name if helpful, but keep article titles unchanged.
-
No piracy or unverified APKs: Do not share links or direct people to pirated content or unverified APKs, which may contain malicious code.
-
No unauthorized polls, bots, or giveaways: Do not create polls, use bots, or organize giveaways without first contacting mods for approval.
-
No offensive or low-effort content: Don't post offensive or unhelpful content. Keep it civil and friendly!
-
No affiliate links: Posting affiliate links is not allowed.
Quick Links
Our Communities
- !askandroid@lemdro.id
- !androidmemes@lemdro.id
- !techkit@lemdro.id
- !google@lemdro.id
- !nothing@lemdro.id
- !googlepixel@lemdro.id
- !xiaomi@lemdro.id
- !sony@lemdro.id
- !samsung@lemdro.id
- !galaxywatch@lemdro.id
- !oneplus@lemdro.id
- !motorola@lemdro.id
- !meta@lemdro.id
- !apple@lemdro.id
- !microsoft@lemdro.id
- !chatgpt@lemdro.id
- !bing@lemdro.id
- !reddit@lemdro.id
Lemmy App List
Chat and More
founded 3 years ago
MODERATORS
OP bought a cheap-shit no name phone and the cheap shit no name manufacturer pushed an update that had malware in it. At no point is Google responsible for any of that.
It certainly doesn't equate to Google themselves infecting the phone.
I'm all for calling Google what they are, and I personally have spent the last couple years degoogling as much as possible. But this is a clear cut case of "you get what you pay for."
Updates go through the phone manufacturer, if you can't trust the manufacturer you can't trust the update.
This was a supply chain attack and the poster knows that. It's not a software vulnerability.
The poster put a disclaimer right at the top stating that this is a supply-chain attack but points out that Google themselves put this phone on a list of "certified safe devices" and that Google had no response to his reporting the malware to them.
He also points out that this is one of the most commonly purchased devices from the Lifeline program meaning this issue can have a large impact on many vulnerable people.
At no point has a Google Play certification ever claimed that devices will be immune from supply chain attacks. The manufacturer is responsible for the breach and correcting the issue.
Also, OP is using a tool for software exploit reporting. Social media probably would have been a better outlet. Or even better their representatives since this phone is provided at tax payer expense.
This article is still a really long explanation about how they complained to the wrong people and were ignored.
Then what are they certifying and what makes this phone worthy of certification while some other no-name brand isn't?
Nobody is claiming that Google is responsible for removing the malware and patching the vulnerability but they are responsible for the certification list that they voluntarily compiled and released.
Think of it like the travel advisories put out by the US State Department. They're not responsible for ending cartel violence in Sinaloa Mexico but they are responsible for informing others of the potential dangers present in Sinaloa.
Social media requires that enough third-party individuals read and spread this information before it becomes visible enough to major companies like Google. Contacting them directly is a much faster and more direct approach, but using both approaches is probably best overall for something important. Social media virality just ensures that they can't ignore you when you contact them directly.
The certification means what they say it means. It's publicly available information.
And they say it means these devices are "safe" and "secure." I can see why you didn't want to define it yourself as it completely contradicts your argument.
Where does it say it protects against malicious manufacturer updates?
Until the manufacturer installed malware, after it shipped, it was safe and secure.
Where does it say that it doesn't? What benefit does the certification list offer if they're including devices that have malware installed by the manufacturer despite Google calling them "safe" and "secure?"
Explain the reasoning behind leaving these devices on the "safe" and "secure" list when informed that they aren't safe or secure with objective facts, since you seem to think they aren't responsible for certifying the devices on a certification list produced solely by them.
I've got nothing for you, all I've done is explain reality to you and have you respond with your made up ideas of what reality should be.
I'm sorry you and OP can't comprehend why reporting a supply chain attack that happened another company to Google's Android exploit portal ended in being ignored.
I'm sorry you can't comprehend why a promise that a phone ships free of malware and has protections from downloading malware in apps doesn't mean that Google will protect you from a manufacturer's update process they have no part in.
I'm sure Google might care that this manufacturer has been compromised, I'm sure the public may care, I'm sure that elected representatives might care that tax dollars are paying for phones from a manufacturer that is compromised. But none of those are the team responsible for patching Android software exploits.
All you've done is invent strawman arguments and hammer away at them while also moving goal posts, ignoring everything to the contrary.
Can you point out where I or any other person ever mentioned or even implied this? I actually addressed this directly several comments ago and you chose not to acknowledge it. Instead you wanted to argue against points that nobody was making while ignoring the ones they were. Talk about "making up your own reality"
So your claim is that Google is promising these devices ship free of malware, but what about devices built and shipped after this infected update came out? Google is promising those are free from malware too despite having the malware infested update included?
Google can't remove these devices from the certification list because Google isn't responsible for a list of "certified devices" compiled by Google? Are you finally willing to address this point or will your next reply deflect to something else like every other one before it?
Can you list a single benefit for Google to "certify safe and secure" a device that has malware pushed by the manufacturer directly? Does it really matter if the infection occurs prior to shipping rather than occurring the moment you take it out of the box and turn it on? That seems like a glaring loophole that benefits no one, so why are you so insistent that it must remain this way?
Your argument only makes sense if we were talking about malware coming from independent parties. Since this is coming directly from the phone manufacturer, there is zero reason for Google to continue to list them as certified. Until you can acknowledge this point, you're just arguing against yourself.
These types of arguments are so frustrating, it's like talking to a brick wall.
"Well, duh, it says it on the websites"
Then, when you make a stink about it, it's suddenly you who has a problem and doesn't understand the obvious thing they can't seem to point out themselves because it's apparently so obvious to everyone.
Where it says "safe", and where it says "secure". That's where.