Motorola phones have started hijacking the Amazon app to insert affiliate codes
157 points
6 hours ago
| 25 comments
| 9to5google.com
| HN
codedokode
47 minutes ago
[-]
Think how bad the market got. Today we have preinstalled garbage apps like LinkedIn, garbage apps mandated to be preinstalled by the government, ads, cloud accounts, notifications spam, telemetry. This is not only Chinese smartphones, for example Samsung also plays this game. I assume there are Chinese backdoors, American backdoors and national government backdoors on almost every phone.

And there seems to be no way to buy a "free" smartphone without Google Services and telemetry below $250. Why 250? Because free OS have multiple bugs and issues and it is not rational to pay more than that.

I am considering two options, one, try to clean up and patch the firmware for a cheap smartphone (remove almost everything proprietary including Google Services, Unrusted Execution Environment, except for basic GUI and launcher), or two, port something like Lineage OS to my phone. Also I need to examine the network traffic and scan for potential weak points like SUID binaries. It is scary to think how much time I will have to waste for this.

Also, it is pretty stupid, in my opinion, to make an OS not based on Android, for example, use Qt for GUI, because there will be no apps for it.

reply
embedding-shape
4 minutes ago
[-]
Not sure what timescale you're referring to when you're talking about "how bad the market got" and "today", but back around 2012 I got my first and last Samsung smartphone, must have been a Galaxy 3 or something, that had all of those problematic things too.

It seems like this starting to happen as soon as apps were installable on phones, even iPhones came (and still comes) with a ton of apps you cannot remove regardless of how little you use them. Android, because of the whole OEM story, of course is much worse, but I don't feel like any of what you share is new, been going on for decades at this point.

reply
tomaytotomato
5 minutes ago
[-]
The paranoia is completely warranted, but there is a solution.

Just root your Android phone and put a custom ROM like LineageOS etc

If you want a stretch goal try and de-Google yourself, I have tried but failed twice now.

reply
kayson
4 hours ago
[-]
> In further digging, we noticed that the URL the phone opens up is “kira-abboud.com,” a website that references fashion influencer “@kirasfashionfinds.” Notably, this exact URL isn’t listed anywhere on Abboud’s social media, and the affiliate codes don’t match up either. The redirect coming from Motorola phones is using Amazona affiliate code “sramz-kff-008-20” which is completely different from any of the codes we saw from links shared by Abboud’s accounts and linked websites.

Something funny is up; this doesn't seem deliberate.

reply
londons_explore
3 hours ago
[-]
My guess is a rogue employee who hopes they can get away with this stuff for years till caught...

That employees cousin probably does social media for Abboud...

reply
GuestFAUniverse
1 hour ago
[-]
No matter how you turn it, that doesn't build trust in the Motorola brand, if a single employee can push that (hypothetical) code.
reply
0xEF
1 hour ago
[-]
I agree, but in fairness, I don't know of any brand, tech or otherwise, that can completely wall itself off against insider threats. No matter how vigilant you are, someone who knows exactly how you move will find a way around you.
reply
microtonal
1 hour ago
[-]
I can understand it's hard to defend against plausibly deniable errors that create backdoors, etc. But this would show a complete lack of code review, no?
reply
mschuster91
17 minutes ago
[-]
> But this would show a complete lack of code review, no?

You'd be surprised how many websites use Google Tag Manager to allow their marketing department to roll out trackers and other JS snippet directly into the site's root context.

GTM et al's sole reason of existence is to provide marketing people with a way to bypass corporate IT.

And I definitely would not rule out something like this being the cause in the end.

reply
apples_oranges
1 hour ago
[-]
right, they should start reviewing their PRs
reply
jollymonATX
2 hours ago
[-]
An affiliate can create multiple codes
reply
rainforest
2 hours ago
[-]
Note that the smart feed "feature" is Taboola-provided adware[0] so it's par for the course. It's beyond comprehension Lenovo would trash the brand by shipping it on flagships.

[0] https://www.reddit.com/r/motorola/comments/1s61usi/edge_60_p...

reply
consp
2 hours ago
[-]
The point where they trashed the brand has long since passed, tried the phones when they bought the brand and it was OK for a while but went downhill quickly.
reply
GuestFAUniverse
1 hour ago
[-]
Until now I waited for their GrapheneOS-based phones. If there isn't a plausible follow up to this injection I don't think I will buy I device from them.
reply
microtonal
1 hour ago
[-]
Who outside Apple/Google/Fairphone isn't? Samsung has been shipping the Israeli (IronSource) AppCloud on A series for a while now and people in some regions even spotted it on S-series phones (it'll spy on your usage and install apps). Nothing, which uses clean Android as one of their selling points, started installing something similar (AppServices, presumably also from IronSource given the Aura branding) on various devices.

Between these companies pushing adware/spyware and Apple putting Apple Creator Studio ads in former iWork applications, ads for Apple Intelligence in the system settings, and pushing ads for their F1 movie in Apple Wallet, smartphones have reached the mass enshittification phase.

The only safe havens are Pixel with GrapheneOS and Fairphone with I don't know what exactly (Murena sorta has ads for their own stuff and has many other issues, I guess LineageOS then). Perhaps ironically, given the context, Motorola with GrapheneOS too :).

reply
xzxz
4 hours ago
[-]
I used to choose Motorola devices for a long time but since 2 years when I bought Edge 30 Fusion I started to notice they automatically (without my knowledge) add 3 stupid apps or games about two times a month :/ There is no way to stop it. My kids phones are stuffed with this sh*t.
reply
microtonal
4 hours ago
[-]
On some phones this is done by something like AppCloud, which you can usually uninstall from the user partition using ADB/Universal Android Debloater.
reply
kotaKat
1 hour ago
[-]
Motorola put the malware apps into the “nondisable” list. You can’t remove them even with ADB PM commands. I was fucking mad that my RAZR couldn't be fully debloated.

See also: various firmware builds for Moto phones like https://dumps.tadiphone.dev/dumps/motorola/aito/-/tree/user-...

reply
GuestFAUniverse
1 hour ago
[-]
Or: buy another brand and not jump hoops.
reply
microtonal
1 hour ago
[-]
Definitely, it's more that is worth trying for people who have a phone already. E.g. on Samsung, you can remove most of the bloatware.
reply
edarchis
2 hours ago
[-]
I got a prompt about trying new apps every week or something similar. The wording, the moment it prompted me were clearly designed for people to just say "ok" and then wonder how apps were installing regularly without any action. I got caught myself, disabled it but still got new app installs later. I killed the whole thing and have been free since. But definitely felt like a scam. And the apps suck.
reply
kotaKat
10 minutes ago
[-]
They even force you to select a bunch of apps during out-of-box setup on some Motorola phones and it mandates they automatically download post-setup. You can't say "no", you straight up have to let the phone queue up and let it pull all the APKs down for a bunch of shitty preloaded games and Netflix and crap, load them in, then get to waste fifteen minutes removing them again. :\
reply
xzxz
1 hour ago
[-]
This is exactly what I noticed and was disappointed about
reply
hypendev
1 hour ago
[-]
Motorola's history is so unfortunate.

They were a great brand, cool phones, one of early Android players.

After being bought out by Google, Motorola had some of the best devices out there with stock android, especially in the budget segment (and loved among android devs).They had one of the best smartwatches in the game at the time - Moto 360 (2014!!).

Then, after dropping the Nexus 6, Google stripped the patents and sold them to Lenovo. For a while it was ok, even dropping the relatively innovative Moto Z which had all the cool "modular" addons, played with it for a bit and seemed cool.

And then, things seemed to start taking a turn for the worse as Lenovo kept enshitiffying it more and more, using the brand name as a wedge in the market in which they are basically forgotten. They have the Razr brand which is cool, but the segment that was their best (budget phones) is now ruined with adware so they can extract every bit of value from it.

Such a sad ending for a company that was so early in the space.

reply
ahartmetz
46 minutes ago
[-]
FWIW, the worst thing I can say about the Moto Edge 50 Neo (a midrange phone) from a year ago is that it had "sponsored" apps pre-installed. They could be uninstalled (not just deactivated) the usual way and never came back.
reply
xzxz
1 hour ago
[-]
I have exactly the same feelings.
reply
brnt
3 hours ago
[-]
You are in luck: LineageOS supports many Motorola devices, including the Edge 30.
reply
xzxz
1 hour ago
[-]
In the past I often tend to replace stock Android with LineageOS but in today's world with so many attack vectors like for example malware in supply chains etc. I choose to stay with stock OS. I also have my bank apps and lot of my clients data/credentials stored on my accounts.
reply
tredre3
4 hours ago
[-]
> There is no way to stop it.

There are ways. All the apps that install this crap can be disabled through Android's app manager, no fancy method required. (Of course updates can bring them back... But "luckily" Motorola isn't too keen on providing those for their products).

Some examples of the apps to look for:

- App Box

- Games

- MotoApps

- Moto App Manager

- Live lock screen

The active adware apps depends on your region and career. In some region Motorola doesn't push adware at all.

Personally by just disabling those (and similar sounding crap) I've never had adware sneakily installed.

For Moto G or lower tiers Edge I can begrudgingly accept that it's part of the deal... But I would be livid if they did this to my $1500 phone, which is why I refuse to risk getting a razr. Whether you want to fight your phone maker and keep using their product is up to you.

Let's hope that the grapheneos partnership plays off in our favor next year!

reply
xzxz
1 hour ago
[-]
I tried to disable some of them but then, (not even) after OS update (sometimes after reboot) I noticed that they are active again.
reply
SubiculumCode
3 hours ago
[-]
Strange, I've never gotten any moto apps on my cheap Moto G. I don't sign into any of their crap, but I don't recall doing anything else....
reply
markjchambers
3 hours ago
[-]
How old is your Moto G?

Anything in the last few years has the moto app manager that force loads LinkedIn etc.

Due to cheap and cheerful with long lasting battery - I still buy Moto G - but setup offline and disable all these apps using https://github.com/Universal-Debloater-Alliance/universal-an...

reply
KennyBlanken
4 hours ago
[-]
Luckily there is a mobile phone OS and hardware that isn't produced by the world's largest advertising company, and furthermore doesn't allow two different corporations to be involved in the core OS of the device.
reply
tredre3
4 hours ago
[-]
You're right but we can't easily get Huawei devices in North America.
reply
microtonal
1 hour ago
[-]
I hope you are not referring to the company that is pushing AI ads through their system settings, pushing Creator Studio subscription ads through the formerly non-shareware productivity tools, and pushing movie ads through their wallet?

Seriously, get a Pixel and install GrapheneOS, or maybe a Fairphone with LineageOS.

reply
yjftsjthsd-h
3 hours ago
[-]
Apple isn't the largest advertising company, but it's a pretty big one. The only other candidates I know of are aftermarket Linux distros, but they have their own problems.
reply
layer8
3 hours ago
[-]
Unfortunately, that company also polices what kinds of apps you’re allowed to install on your hardware.
reply
pjc50
2 hours ago
[-]
No, they only allow one corporation to be involved, which is not necessarily an improvement.
reply
dmos62
2 hours ago
[-]
I've a Xiaomi phone on which twice appeared obviously debug/hello-world notifications (something like "testtest111") from apps I've never seen or installed. Then another time all Xiaomi phones of close relatives started getting these cheap, spammy ads for Android games in the notifications, this time from some obscure system app: had to look up on reddit that there are settings that disable this specific behavior.

The degree to which I don't own my own device is insane.

reply
shantara
1 hour ago
[-]
I gifted my mom a Xiaomi phone a few years ago. Even after removing all the unnecessary apps and permissions, disabling all the privacy invasive settings and replacing the launcher with the stock Android, I was shocked when I checked the PiHole dashboard. The phone was constantly trying to communicate with dozens of different domains and endpoints, even when idle. None of these attempts had any sort of backoff, so they kept retrying every 30 seconds, draining the battery. Ultimately it generated several times more blocked requests than every other device on my network combined.

This was the first and only Xiaomi device I ever bought, no matter how attractive they might seem.

reply
xnickb
1 hour ago
[-]
And it's about to change soon. https://keepandroidopen.org/
reply
pjmlp
9 minutes ago
[-]
Yeah, I miss the days of multiple choices on mobile phone OSes.
reply
amelius
41 minutes ago
[-]
Since Uber, Airbnb and Tesla, now every company thinks they can do borderline illegal stuff to make an extra buck.

What is next? Our banks selling our payment histories to the highest bidder?

reply
Ekaros
35 minutes ago
[-]
Isn't credit ratings pretty much that? Buy the payment history on debt and then sell some derived value to anyone willing to pay?
reply
like_any_other
19 minutes ago
[-]
> What is next? Our banks selling our payment histories to the highest bidder?

They do it for your own good, so that you get "more opportunity for consumer experiences in stores and online."

https://en.wikipedia.org/wiki/Card_transaction_data

https://pirg.org/edfund/resources/how-mastercard-sells-data/

reply
realusername
6 minutes ago
[-]
Notice that this will pass Play Integrity while your clean rom won't.
reply
sandreas
3 hours ago
[-]
Hmm, this thread and the reports of shady practices make me wonder if this will affect the partnership with GrapheneOS[1]. It seems that such things shouldn't really happen on a device where security is a top priority, whether intentional or not.

1: https://news.ycombinator.com/item?id=47214645

reply
microtonal
1 hour ago
[-]
Why does it matter? The GrapheneOS team will make the OS images. So as long as the phone is unlockable, has up-to-date firmware bundles, etc. who cares?
reply
blitzo
4 hours ago
[-]
Isn't this cookie stuffing? Same modus operandi using by Geo-something widget back in 2000s with hidden ebay affiliate links that got caught by FBI. Someone should go in jail for this.
reply
fransje26
2 hours ago
[-]
This bodes well for the up-coming GrapheneOS cooperation..

Nothing screams "secure" better than app hijacking and url injections.

reply
andyjohnson0
3 hours ago
[-]
I have a Motorola G70, so this is concerning. But its hard to believe that this is a deliberate action by Motorola. To me it seems more likely that an update was compromised. Still bad though.
reply
davidelettieri
1 hour ago
[-]
With the digital wellbeing app feature it is possible to set a timer of 0 minutes on all auto-installed and auto-reenabling apps to effectively disabling it for good.

Edit: the timer stays even after updates so the app is not enabled again

reply
noduerme
3 hours ago
[-]
I like the Stylus G better than most phones I've owned, but Motorola really needs to end its partnership with the offensive "Glance" ad platform. There should not be a third party app like that which keeps re-enabling and reinstalling on every update. I don't understand what Motorola would get out of a partnership with a scammy third rate ad market that would be worth pissing off so many of their customers, but maybe they have some high level corruption in the company.
reply
heikkilevanto
3 hours ago
[-]
The comments here say that all Android phone manufacturers do stuff like this. I have never noticed that kind of things on my Fairphone. But then again, I don't have many apps and certainly not Amazon.
reply
microtonal
1 hour ago
[-]
Fairphone or Pixel with GrapheneOS are currently the best bets if you actually want to own your phone.
reply
p0w3n3d
3 hours ago
[-]
Is Motorola Chinese by any chance? I remember the Motorola company has been split to phones and the rest
reply
petu
3 hours ago
[-]
Owned by Lenovo, yes
reply
gsky
5 hours ago
[-]
Chinese brands always pull this stuff
reply
28304283409234
3 hours ago
[-]
Microsoft does similar and worse on Windows. This is capitalism being capitalism. Nothing chinese about it.
reply
userbinator
3 hours ago
[-]
Around 10-15 years ago you could get a completely stock Android from China with basically zero branding, fully unlocked and easily rootable, removable battery, expandable storage, dual DIMs, etc. at a great price. I have a few. Unfortunately many of those small honest OEMs appear to have disappeared, and the bigger ones left have turned scummy.
reply
greatgib
3 hours ago
[-]
Especially Xiaomi did a huge ugly U-turn like this. Use to be the best hardware for low price with the selling point of no-crap fully customable phones.

And then, once they become dominant enough starting to play it like the others but stuffing as many unremovable crap as possible.

reply
999900000999
4 hours ago
[-]
To think I was worried about buying a Xiaomi tablet while already using a Motorola.

Gonna flash a rom on the Xiaomi anyway, but all oems are doing this type of stuff.

reply
petu
3 hours ago
[-]
Note that Xiaomi today is very hostile to bootloader unlocking -- to get unlock code you need to win in daily first come, first served "lottery" (they limit total number of unlocked devices per day). After a second or two passes you're already too late for the day.
reply
999900000999
1 hour ago
[-]
Thank you for letting me know, the plan right now is to try for about a week or 2 and then give up and return the tablet if I can't.

Which is a damn shame because not too many options exist with a headphone jack and a Snapdragon processor. I'm in an environment where Bluetooth is unreliable for a good chunk of my day.

The only other tablet that fits my needs is a gosh darn Surface which is like 1000$.

reply
consp
2 hours ago
[-]
No wonder there are numerous dubious sites doing it for you ... this breeds abuse.
reply
KennyBlanken
4 hours ago
[-]
All Android OEMs are "doing this type of stuff."
reply
risfriend
4 hours ago
[-]
This is really unethical, replacing original app shortcuts breaks trust.
reply
coretx
4 hours ago
[-]
That begs the question! Did they use a Sony rootkit ? XD
reply
metalman
1 hour ago
[-]
It is laborious to go through all the apps on a phone and dissable the default unessesary "open web link" feature on ALL the apps, but apparently it has some effect in reducing the "draft" from all the back doors
reply
dotcoma
5 hours ago
[-]
How low can you go?
reply
gib444
5 hours ago
[-]
I was possibly thinking of getting a Motorola with G.ràphenéOS when released.

Yeah, not now.

reply
Uzazo
5 hours ago
[-]
The described behavior would not happen when you use a custom OS.

I understand not wanting to give Motorola any money because of this, though.

reply
Cider9986
5 hours ago
[-]
True. Google does much worse things overall, but they aren't as surface-level scammy as this.
reply
gib444
4 hours ago
[-]
The tail never wags the dog.

Initially the project won't change, but it likely will over time.

reply
microtonal
4 hours ago
[-]
But AFAIK it doesn't work like that. Motorola makes a phone that has an unlockable bootloader, provides firmware bundles, etc., but the OS images will be made by the GrapheneOS team and they would never do anything like that.

(I think the misunderstanding is that Motorola would make the GrapheneOS builds.)

reply
gib444
2 hours ago
[-]
I'm misunderstanding nothing

You're probably just not willing to believe that a 'partnership' with a massive company will change things, like I do. I am disagreeing, not misunderstanding. There's a difference

reply
microtonal
1 hour ago
[-]
Have you ever observed the GrapheneOS team? I have rarely seen any team more principled than them, outside maybe RMS.

Time will tell, but my bet is on the GrapheneOS team doing the right thing, they have always done so in the past.

reply
dingensundso
4 hours ago
[-]
Calling this "hijacking the Amazon app" is hyperbolic in my opinion. They replaced the shortcut in the app drawer. To me this looks like normal scummy OEM behaviour, like pre-installing spyware, "anti-" malware, adware etc. which sadly pretty much every mobile/computer manufacturer does.

Replacing the OS is one of the first things I do with every laptop, PC and mobile device to get rid of (most) crap that was installed without my consent.

reply
userbinator
3 hours ago
[-]
and mobile device

Very little ability to do that with most devices these days, unfortunately.

reply
sourcegrift
5 hours ago
[-]
If an anti-worker company is getting fleeced, nothing wrong with that.

I hope motorola collaborates with Pine and brings linux to phones. In the age of LLM apps are obviously not a problem. (Hopefully windows Phone 7, not 8 also comes back)

reply
WolfeReader
4 hours ago
[-]
I agree with your overall opinion, but not sure why you had to bring LLMs into a topic that has nothing to do with them.
reply
SubiculumCode
3 hours ago
[-]
I would agree, but I just looked on my phone and there was a Moto AI services app I don't remember being there before
reply
ta8903
1 hour ago
[-]
I think they mean you don't need to worry about a tiny app ecosystem these days because LLMs make it easy to create your own.
reply