ZTE Plant Cell Phones with Backdoors in the US

ZTE, a leading global provider of telecommunications equipment and network solutions, was caught distributes a cell phone model which contains a backdoor with hardwired root password in the US through MetroPCS.

As reported at many Android community hubs, such as Land of Android, or simply Google ZTE backdoor

The ZTE Score M is an Android 2.3.4 (Gingerbread) phone available in the United States on MetroPCS, made by Chinese telecom ZTE Corporation.

There is a setuid-root application at /system/bin/sync_agent that serves no function besides providing a root shell backdoor on the device.  Just give the magic, hard-coded password to get a root shell:

$ sync_agent ztex1609523
# id
uid=0(root) gid=0(root)

Nice backdoor, ZTE.

Another model 'Skate' sold in UK was also found the same issue.

ZTE and Huawei are the top two communication equipment manufactures in China. Due to its rich features and low cost, ZTE cell phones are very popular among Android community. This revelation is a major blow to consumer confidence in Made-In-China electronic products.

While Chinese telecommunication manufactures are barred in other countries, so far they have not received much scrutiny in the US market. India government blocked ZTE and Huawei from sub-contracting a $426 million deal in India's infrastructure constructions, following similar steps made by government of Australia, due to security concerns.