The selection of low-cost Android phones on Amazon just got a little smaller.
Amazon has suspended Miami-based budget smartphone maker Blu—a former partner in Amazon's Prime Exclusive Phones program—over spyware concerns.
"We recently learned of a potential security issue on select Blu phones, some of which are sold on Amazon.com," Amazon told PCMag today. "Because security and privacy of our customers is of the utmost importance, all Blu phone models have been made unavailable for purchase on Amazon.com until the issue is resolved."
This happened last year, too. In December, Amazon pulled Blu's entry-level device from shelves after researchers from security firm Kryptowire discovered a firmware-updating app, Adups, was sending users' texts to a server in China. Blu later pushed an update to prevent the Adups software from sending details home, signed a contract with Kryptowire to have the security firm monitor their phones for the next year to make sure none of their vendors pull a fast one again, and swapped out Adups's update utility for Google's.
But at Black Hat last week, Kryptowire revealed that several Blu phones, including the best-selling Blu Advance 5.0, still contain spying software created by Shanghai Adups Technology.
Blu denies its phones contain spyware, malware, or any secret software. "Blu has several policies in place which takes customer privacy and security very seriously, and confirms that there has been no breach or issue of any kind with any of its devices," the company wrote.
Blu said it "quickly remedied" the problem last year when Kryptowire first brought up the issue. Since then, Amazon has known about Adups and other apps on its devices, and agreed they "pose no further security or privacy risk," Blu said.
"Almost a year later, the devices are still behaving in the same exact way, with standard and basic data collection that pose no security or privacy risk," Blu said. "There has been absolutely no new behavior or change in any of our devices to trigger any concern. We expect Amazon to understand this, and quickly reinstate our devices for sale."
But Kryptowire says Adups' software is still quietly sending information from Blu phones to a server in Shanghai without informing people. "They replaced them with nicer versions," Kryptowire co-founder and Research Engineer Ryan Johnson told CNET. "I have captured the network traffic of them using the command and control channel when they did it."
"Kryptowire presented the technical details and forensic evidence of our findings at Black Hat, one of the largest security conferences in the world, in front of an audience of the world's foremost security experts. We stand behind those findings," said Tom Karygiannis, VP of Product at Kryptowire.
Blu, meanwhile, says not all its phones have been pulled from Amazon. "There are several Blu devices still available for purchase on Amazon. We cannot comment as to their selection process, you would need to speak with them."
Ajay Kumar contributed to this report.