Google’s Play Store is often laced with malware-laced apps and it takes a lot of work to fish them out. According to recent reports, a Chinese company, Shenzhen HAWK, is “secretly behind 24 popular apps seeking dangerous permissions.” As of now, these apps are no longer on the Google Play Store but before their expulsion, they already had 382 million. “We take reports of security and privacy violations seriously,” Google said to Forbes reporter, Zak Doffman. “If we find behaviour that violates our policies, we take action.” And that’s certainly what has happened here. Before we proceed with the report, the 24 apps are listed in the image below
One of the apps, Hi Security, request for “too much” and strange permission within its VPN apps. After a series of investigations, this app was found to have links with Shenzhen HAWK.
Shenzhen HAWK is a subsidiary of TCL Corporation, a huge and partially state-owned Chinese electronics corporation. This is not the first report of TCL’s involvement with malicious apps. Last year, reports of its malicious Weather Forecast app hit the web. In 2017, the Indian government spotted Virus Cleaner (another of the Hi Security apps) to be hiding “spyware or other malware.”
Gizchina News of the week
As of the time of yesterday, two apps (Super Battery and Dig It) were still available for download. However, Google has not confirmed that all 24 apps no longer exist on Google Play Store. Nevertheless, if you have installed any of these apps, it is in your interest to uninstall them immediately.
Android User Warning – What Do These Apps Need?
While six of the 24 apps need access to the user’s camera, two want to penetrate the phone. This means that they can make phone calls or send messages. From the list, 15 apps need GPS access (users location) and can read data on external storage. In addition, 14 of these apps can return details of a user’s phone and network. In fact, one of these can record audio on its server or on the device while another has access to your contact.
With all these permissions, these apps collectively have access to your entire device. They can also communicate with an external server controlled by their developers. Ever wonder why you get certain advert messages of things you shop for frequently? Once the app has location and user details, it can know your preferences and sell this information to advertisers who will then be able to personalize unwanted ads for you. This is probably the lowest risk associated with these apps.
More importantly, once your device is compromised, other things can follow. They can install other apps on your device which collect your personal information and private stuff.
Please give due care and attention to the apps from unknown developers that you allow onto your devices. These risks are real. The permissions being requested are real, as are the past issues with malware and data theft. As VPNpro warns, “apps that seem innocent may actually be reading and changing your files, selling your data, or much worse—remember, you are the last line of defense against malicious software.”
