Researchers discovered a rash of Android apps with tens of millions of downloads implanted with a defense contractor's data-stealing code. Google banned them.
over a dozen apps from its Play Store—among them Muslim prayer apps with 10 million-plus downloads, a barcode scanner, and a clock—after researchers discovered secret data-harvesting code hidden within them. Creepier still, the clandestine code was engineered by a company linked to a Virginia defense contractor, which paid developers to incorporate its code into their apps to pilfer users’ data.
For the most part, the apps in question appear to have served basic, repetitive functions—the sort that a person might download and then promptly forget about. However, once implanted onto the user’s phone, the SDK-laced programs harvested important data points about the device and its users like phone numbers and email addresses, researchers revealed.
s, Serge Egelman, and Joel Reardon, both of whom co-founded an organization called AppCensus, which audits mobile apps for user privacy and security. Inon their findings, Reardon writes that AppCensus initially reached out to Google about their findings in October of 2021. However, the apps ultimately weren’t expunged from the Play store until March 25 after Google had investigated, the Journal reports.
One of the apps was a QR and barcode scanner that, if downloaded, was instructed by the SDK to collect a user’s phone number, email address, IMEI information, GPS data, and router SSID. Another was a suite of Muslim prayer apps including Al Moazin and Qibla Compass—downloaded approximately 10 million times—that similarly pilfered phone numbers, router information, and IMEI. A weather and clock widget with over one million downloads sucked up a similar amount of data at the code’s command.