Slashdot Mirror

← Back to Stories (view on slashdot.org)

Stealthy Google Play Apps Recorded Calls and Stole Emails (arstechnica.com)

Posted by EditorDavid on from the don't-be-an-evil-app dept.

An anonymous reader quotes Ars Technica: Google has expelled 20 Android apps from its Play marketplace after finding they contained code for monitoring and extracting users' e-mail, text messages, locations, voice calls, and other sensitive data. The apps, which made their way onto about 100 phones, exploited known vulnerabilities to root devices running older versions of Android.... As a result, the apps were capable of surreptitiously accessing sensitive data stored, sent, or received by at least a dozen other apps, including Gmail, Hangouts, LinkedIn, and Messenger. The now-ejected apps also collected messages sent and received by Whatsapp, Telegram, and Viber, which all encrypt data in an attempt to make it harder for attackers to intercept messages while in transit... To conceal their surveillance capabilities, the apps posed as utilities for cleaning unwanted files or backing up data.
Google reports that the malicious apps also had these functions:
  • Call recording
  • VOIP recording
  • Recording from the device microphone
  • Location monitoring
  • Taking screenshots
  • Taking photos with the device camera(s)
  • Fetching device information and files
  • Fetching user information (contacts, call logs, SMS, application-specific data)

12 hours later an antivirus provider reported two more Google Play apps could surreptitiously steal text messages by downloading a malicious plugin -- and that the apps had already been downloaded at least 100,000 times.


2 of 55 comments (clear)

  1. Google Needs to ix this by Zombie+Ryushu · · Score: 4, Insightful

    Two things wwould fix this:

    1. Instead of being "Google Play" or "Everything else" the user should be able to say: I trust Google Play, F-Droid, and APK Pure only.

    2. All the handset makers need to provide support for Vanilla Stock Android VIA Lineage OS or Similar. Cough up Driver APKs, and stop allowing handset makers to bake Malicious software like ADUPS in the System area.

  2. Sorry to trouble you, but, um ... by cascadingstylesheet · · Score: 5, Insightful

    Sorry to trouble you, but, um ... what are the apps? What are they named?