Google pulls 500+ backdoored apps from Google Play
Security researchers have identified over 500 apps on Google Play containing an advertising software development kit (SDK) called Igexin, which allowed covert download of spying plugins.
The apps in question represent a wide selection of photo editors, Internet radio and travel apps, educational, health and fitness apps, weather apps, and so on, and were downloaded over 100 million times across the Android ecosystem.
Malicious third-party code
“Typically, mobile apps use advertising SDKs to make it easy for app developers to leverage advertising networks and deliver ads to customers. Like many ad networks, the Igexin service promotes its targeted advertising services that leverage data collected about people such as their interests, occupation, income, and location,” Lookout researchers noted.
It should be standard procedure for app developers to analyze any third-party code they embed in their apps in order to discover and disclose any data collection capabilities it has in the app’s privacy policy. Unfortunately, too many of them don’t bother or don’t know how to, and opt for trusting the developers of SDKs blindly.
The researchers pointed out that not all versions of the Igexin ad SDK deliver malicious functionality, but those that did implemented a plugin framework that allows the client to load arbitrary code, and requested instructions on what to download next.
Mostly, it was to exfiltrate call logs, which contain information such as time of call, calling number, and call state. But there were also instances where data about installed apps and GPS location was exfiltrated.
“Users and app developers have no control over what will be executed on a device after the remote API request is made. The only limitations on what could potentially be run are imposed by the Android permissions system,” the researchers pointed out.
A growing problem
“It is becoming increasingly common for innovative malware authors to attempt to evade detection by submitting innocuous apps to trusted app stores, then at a later time, downloading malicious code from a remote server. Igexin is somewhat unique because the app developers themselves are not creating the malicious functionality – nor are they in control or even aware of the malicious payload that may subsequently execute. Instead, the invasive activity initiates from an Igexin-controlled server.”
Lookout researchers did not name the apps that were found using the malicious SDK, but notified Google of the problem. The latter then proceeded to clean up house, either by removing the offending apps altogether, or by forcing app developers to upload an updated version with the invasive features (i.e. the Igexin SDK) removed.