BLU is one of many low-end phone manufacturers, known for its dirt-cheap unlocked Android phones. But back in November, a security firm discovered spyware on some BLU phones sold in the United States, prompting Amazon to stop selling the affected devices until the issue was resolved.

But it looks like BLU is, once again, in trouble with Amazon. The retailer is ceasing sales of some BLU devices (there are still some available for purchase, at the time of writing) following an announcement from security firm Kryptowire at the recent Black Hat security conference. You might remember Kryptowire - it's the group that found spyware on BLU phones last year. The firm revealed that the original spyware, developed by Chinese company Adups Technology, is still present on BLU phones.

Ryan Johnson, a research engineer and co-founder of Kryptowire, said, "They replaced [the malware] with nicer versions. I have captured the network traffic of them using the command and control channel when they did it." Johnson purchased a Blu Grand M from Best Buy for $70, and found the device was still sending data to China. The information consisted of installed apps, the MAC address and IMEI, phone number, and cell phone tower ID. Kryptowire later provided the findings to Amazon.

Amazon said in a statement, "Because security and privacy of our customers is of the utmost importance, all BLU phone models have been made unavailable for purchase on Amazon.com until the issue is resolved." It looks like only direct sales from Amazon have stopped, as the site still shows listings sold by third parties.

BLU is denying any wrongdoing, saying that it stopped bundling Adups software in 2016, but some older devices still have it. The company stated, "The data that is currently being collected is standard for OTA functionality and basic informational reporting. This is in line with every other smartphone device manufacturer in the world. There is nothing out of the ordinary that is being collected, and certainly does not affect any user's privacy or security."

Source: CNET