Proprietary ·
Coolpad ROMs carried CoolReaper backdoor
Palo Alto Networks found CoolReaper in many Coolpad Android ROMs, giving the vendor silent app installation, data upload, SMS, and OTA-abuse capabilities.
CoolReaper was not a vague privacy concern. Unit 42 found it in stock ROMs for many Coolpad Android phones, signed with Coolpad certificates and paired with Android OS changes that hid the backdoor from users and security tools.
The backdoor could download, install, and activate Android apps without user consent. It could clear user data, uninstall or disable apps, send or insert SMS and MMS messages, dial numbers, show fake OTA updates, and upload device location, app usage, call, and SMS history.
The implementation also changed the user-visible trust model. Because CoolReaper was signed with vendor certificates and supported by ROM-level changes, the affected phones treated the backdoor as part of the platform rather than as a removable third-party app.
Palo Alto Networks concluded that Coolpad created and installed the backdoor. That makes this a vendor-deliberate inclusion record rather than a third-party compromise, but it still fits the archive's hardware/software trust boundary: the device arrived with hidden code in the vendor ROM.
Appendix · Affected releases
- Unit 42 reporting identified 24 Coolpad phone models and more than 10 million affected users in China.
- Affected models: Coolpad Quattro 4G (5860E), Coolpad Flo, Coolpad Quattro II. These name hardware or product variants, not releases.
References
- CoolReaper Revealed: A Backdoor in Coolpad Android Devicesunit42.paloaltonetworks.com
- Backdoor Found in Android Phones Manufactured by Coolpadsecurityweek.com
- Coolpad phones CoolReaper backdoor uncoveredtheguardian.com
- Coolpad Android Devices Shipped With Backdoordarkreading.com
Source record: proprietary/coolpad/meta.yaml