Blu Phones Not On Amazon: Marketplace Removes Phones Over Privacy Concerns

Amazon has suspended the sale of Android handsets sold by smartphone manufacturer Blu after it was discovered the devices can collect user data without permission, CNET reported.

The decision, which Amazon described as being the result of a “potential security issue,” came after researchers at security firm Kryptowire demonstrated how software built into the Blu handsets could gather data and send it to servers based in China without alerting the user of the behavior.

Read: Android Malware: Apps In Google Play Store Discovered Stealing Texts

The discovery of Blu’s spying tactics were revealed by Krypotwire in Las Vegas at the Black Hat security conference last week. During the presentation, Kryptowire showed software from Shanghai Adups Technology installed on Blu devices communicating with a command and control server.

The connection maintained by the software could allow Adups to perform a number of tasks on an individual’s device, including installing applications, snapping screenshots, recording on-screen activity, make calls, send text, recording call logs and even wiping the device. The software, which could also allow surveillance of activity like browsing history and GPS location.

None of those actions would require permission from the user to be performed by Adups, and call can be done remotely without the phone’s owner being made aware of the activity. It is essentially a form of malware preinstalled on the device.

Despite the research from Kryptowire and the decision by Amazon to pull the phones, Blu has defended the inclusion of the software on its devices and denied any wrongdoing. The company told CNET it “has several policies in place which take customer privacy and security seriously,” and is in the process of getting its phones reinstated on Amazon.

Read: Android Malware: CopyCat Attack Infects 14 Million, Roots 8 Million Devices

This is not the first time Blu has come under fire for lacing its devices with software that could be used to spy on a user. Kryptowire first brought the practice to light back in November 2016 when it discovered some of the most popular models of Blu devices were using the Adups software.

At the time, Blu claimed it was unaware of the practice and said Adups offered the functionality against the wishes of the phone manufacturer. “We have an email history with Adups saying we did not want that functionality on our devices, and they violated our request,” Blu CEO Samuel Ohev-Zio said at the time of the discovery.

Eight months later, it appears Blu has does little to fix the initial problem, though being dropped from Amazon may be enough to change the company’s behavior. The Blu R1 HD, which sold for $60, was previously the top selling smartphone on Amazon.

Blu was also a participant in the Amazon Prime Exclusive Phones program, which offered discounts to users who were willing to tolerate advertisements being displayed on their lockscreen. Blu is no longer listed on the program’s page.

"Because security and privacy of our customers is of the utmost importance, all BLU phone models have been made unavailable for purchase on Amazon.com until the issue is resolved," Amazon said in a statement. It has directed customers to contact Blu’s customer support with any questions.