Google has removed dozens of apps from its Google Play store after finding they contained hidden data-collecting software. The company that wrote the code, Measurement Systems S. de RL, is linked through corporate records and web registrations to a Virginia defense contractor that does cybersecurity, network defense and intelligence monitoring for U.S. national security agencies. The code ran on millions of Android devices and was found inside several Muslim prayer apps.
See also: Microsoft: New Windows 11 security feature requires “clean install”
Google recently removed more than a dozen apps from its Play Store after researchers discovered hidden data-collecting software hidden within them – among them Muslim prayer apps with 10 million downloads, a barcode scanner and a clock.
While conducting an investigation, researchers found a piece of code embedded in multiple apps that was used to extract personal identifiers and other data from devices. The code, a software development kit, or SDK, could “unequivocally be described as malware,” one researcher said.
For the most part, these apps appear to perform basic, repetitive functions — apps that a person might download and then promptly forget about. However, once implanted on a user's phone, the SDK-enabled programs collect important data points about the device and its users, such as phone numbers and email addresses, the researchers revealed.
See also: Zoom bug bounty: In 2021 the company gave $ 1.8 million to researchers
The Wall Street Journal first reported that the strange, invasive code was discovered by a pair of researchers, Serge Egelman and Joel Reardon, who both co-founded an organization called AppCensus, which audits mobile apps for user privacy and security. In a post about their findings, Reardon writes that AppCensus contacted Google about their findings in October 2021. However, the apps were removed from the Play store by March 25 after Google’s investigation, the Journal reports. Google issued a statement in response: “All apps on Google Play must comply with our policies, regardless of developer. When we find that an app violates these policies, we take appropriate action.”
According to their findings, the software's actual reach could be much greater as it can detect the existence of other devices operating on the same Wi-Fi network as one using an app that has the code, potentially providing a way to map social networks.
One of the apps was a QR and barcode scanner that, if downloaded, was instructed by the SDK to collect phone numbers, email addresses, GPS data, and router SSIDs. Also found within the apps were Muslim prayer apps, including Al Moazin and Qibla Compass—which were downloaded about 10 million times—that similarly steal phone numbers, router information, and IMEIs.
So who is behind all this? According to researchers, a company registered in Panama is called Measurement Systems. The researchers write in their report that Measurement Systems was actually registered by a company called Vostrom Holdings. Vostrom contracts with the federal government through a subsidiary called Packet Forensics, which appears to specialize in cyber espionage and network defense for federal agencies.
See also: US shuts down Cyclops Blink botnet
App developers who spoke to the newspaper alleged that Management Systems had paid them to embed its SDK into their apps, which allowed the company to “covertly collect data” from device users. Documents viewed by the Journal apparently revealed that the company primarily wanted data on users based in the “Middle East, Central and Eastern Europe, and Asia.”
Here you can find a full list of apps found to contain the SDK code.
Information source: gizmodo.com
