GAMERXVILLE
Android Users Beware: 100 Million Users Must Delete This Dangerous ‘Spyware’ App Now
Zak Doffman
Zak DoffmanContributor
Cybersecurity
I write about security and surveillance.
Android Portable Device Application
NURPHOTO VIA GETTY IMAGES
The scourge of Android permission abuse has reared its ugly head again in the latest disclosure from the research team at VPNpro. The new report focuses on a specific Chinese “spyware” app with more than 100 million installs. Worse, the developer behind the app has other dangerous titles with at least 50 million installs. According to VPNpro, those apps request “dangerous” permissions, and at least one of them is also hiding a malicious remote access trojans.
Beyond the reported technical abuses, the report also highlights the issue of obfuscation—we have seen networks of related developers hiding their links before, and here we have allegations that the Chinese developer masked its origins behind local subsidiaries in presenting apps on Play Store.
There have been multiple reports now into both of these issues. To its credit, Google has pulled networks of apps that abuse permissions or spew adware once installed. The permissions issue, though, is more complex. Google has taken steps to encourage developers to keep in line but that is not enforced. It should be mandatory. There is no excuse for permission abuse that puts hundreds of millions of users at risk for the sake of ruthless monetisation, especially as it also opens the door to much more malicious threats.
Today In: Cybersecurity
Under-Resourced Data Protection Authorities Fail To Enforce GDPR
Burn-In: The Book For Our Times
China Just Crossed A Dangerous Line For Huawei: New ‘Retaliatory Responses’ Threatened
The developer in question this time is Hangzhou-based QuVideo Inc, its most popular app being VivaVideo. VPNpro describes this as “one of the biggest free video editing apps for Android, with at least 100 million installs on Play store.” We shouldn’t be too shocked at the claims the app is up to no good—it was one of 40 Chinese apps listed by the Indian government in 2017 as “either spyware or ‘malicious-ware’.” Military personnel were instructed to delete it immediately.
According to VPNpro, QuVideo has three apps on Play Store, although it appears to be networked to others as well. It also has apps on the iOS App Store, but the permission situation with iOS is different and not open to the same abuse.
QuVideo on Google Play Store
QuVideo on Google Play Store GOOGLE PLAY STORE
There are some permissions VivaVideo needs to function properly—those arguably include the ability to read/write to external drives, albeit once that permission is granted it’s not limited. Why the app would need to know a user’s “specific GPS location,” though is less clearcut. Until, that is, you realise that this permission allows apps “to send your location data up to 14,000 times per day, even when you’re not using their apps.” We saw the scale of this recently, when the U.S. turned to this type of marketing data for coronavirus phone tracking.
This isn’t an isolated example, of course, VivaVideo’s stablemate VidStatus (50 million installs) “asks for a whopping 9 dangerous permissions, including GPS, the ability to read phone state, read contacts, and even go through a user’s call log.” The app was flagged by Microsoft as malware, hiding the AndroRat trojan.
“When we checked VidStatus on VirusTotal, it came back positive,” VPNpro warns. “These kinds of trojans can steal people’s bank, cryptocurrency or PayPal funds.” Putting the alleged malware to one side, the permission abuse is enough to warrant immediate deletion and avoidance of these apps.
VIRUS REPORT
VIRUSTOTAL
QuVideo doesn’t make its ownership of ViStatus obvious, but those links can be found. “On the English language version of its website (vivavideo.tv),” VPNpero says, “QuVideo simply lists its company name as ‘VivaVideo’. However, on the Chinese language versions of its site (for both quvideo.com and xiaoying.tv), it goes by Hangzhou Zhuying Technology Co., Ltd.”
Mapping out this small network of apps, VPNpro reports that there are six from the same developer that should be treated with caution. “These apps have more than 157 million installs combined. But the number is likely much bigger—while VivaVideo’s Google Play page shows it has 100 million+ installs, its ’About Us’ page shows that it already has 380 million users worldwide.”
VivaVideo
VivaVideo PRO Video Editor HD
SlidePlus - Photo Slideshow Maker
Tempo - Music Video Editor with Effects
VivaCut - Pro Video Editor APP
VidStatus - Status Videos & Status Downloader
Unless and until Google makes permission adherence mandatory, putting an end to user data factories, or unless and until hundreds of millions of users vote with their feet (or fingers) and stop installing such apps, these dangers will persist.
As ever, decide if you need the plethora of apps casually installed on your phone. Be especially cautions of apps from China, which is where most of these networks of apps appear to originate. And pay attention to the permissions you grant these apps. If the list of requests seems out of step with the purpose of the app, you would be well advised to avoid installing it on your phone.
Both QuVideo and Google were approached for comment before publishing.
Follow me on Twitter or LinkedIn.
Zak Doffman
Zak Doffman
Zak Doffman
Zak DoffmanContributor
Cybersecurity
I write about security and surveillance.
Android Portable Device Application
NURPHOTO VIA GETTY IMAGES
The scourge of Android permission abuse has reared its ugly head again in the latest disclosure from the research team at VPNpro. The new report focuses on a specific Chinese “spyware” app with more than 100 million installs. Worse, the developer behind the app has other dangerous titles with at least 50 million installs. According to VPNpro, those apps request “dangerous” permissions, and at least one of them is also hiding a malicious remote access trojans.
Beyond the reported technical abuses, the report also highlights the issue of obfuscation—we have seen networks of related developers hiding their links before, and here we have allegations that the Chinese developer masked its origins behind local subsidiaries in presenting apps on Play Store.
There have been multiple reports now into both of these issues. To its credit, Google has pulled networks of apps that abuse permissions or spew adware once installed. The permissions issue, though, is more complex. Google has taken steps to encourage developers to keep in line but that is not enforced. It should be mandatory. There is no excuse for permission abuse that puts hundreds of millions of users at risk for the sake of ruthless monetisation, especially as it also opens the door to much more malicious threats.
Today In: Cybersecurity
Under-Resourced Data Protection Authorities Fail To Enforce GDPR
Burn-In: The Book For Our Times
China Just Crossed A Dangerous Line For Huawei: New ‘Retaliatory Responses’ Threatened
The developer in question this time is Hangzhou-based QuVideo Inc, its most popular app being VivaVideo. VPNpro describes this as “one of the biggest free video editing apps for Android, with at least 100 million installs on Play store.” We shouldn’t be too shocked at the claims the app is up to no good—it was one of 40 Chinese apps listed by the Indian government in 2017 as “either spyware or ‘malicious-ware’.” Military personnel were instructed to delete it immediately.
According to VPNpro, QuVideo has three apps on Play Store, although it appears to be networked to others as well. It also has apps on the iOS App Store, but the permission situation with iOS is different and not open to the same abuse.
QuVideo on Google Play Store
QuVideo on Google Play Store GOOGLE PLAY STORE
There are some permissions VivaVideo needs to function properly—those arguably include the ability to read/write to external drives, albeit once that permission is granted it’s not limited. Why the app would need to know a user’s “specific GPS location,” though is less clearcut. Until, that is, you realise that this permission allows apps “to send your location data up to 14,000 times per day, even when you’re not using their apps.” We saw the scale of this recently, when the U.S. turned to this type of marketing data for coronavirus phone tracking.
This isn’t an isolated example, of course, VivaVideo’s stablemate VidStatus (50 million installs) “asks for a whopping 9 dangerous permissions, including GPS, the ability to read phone state, read contacts, and even go through a user’s call log.” The app was flagged by Microsoft as malware, hiding the AndroRat trojan.
“When we checked VidStatus on VirusTotal, it came back positive,” VPNpro warns. “These kinds of trojans can steal people’s bank, cryptocurrency or PayPal funds.” Putting the alleged malware to one side, the permission abuse is enough to warrant immediate deletion and avoidance of these apps.
VIRUS REPORT
VIRUSTOTAL
QuVideo doesn’t make its ownership of ViStatus obvious, but those links can be found. “On the English language version of its website (vivavideo.tv),” VPNpero says, “QuVideo simply lists its company name as ‘VivaVideo’. However, on the Chinese language versions of its site (for both quvideo.com and xiaoying.tv), it goes by Hangzhou Zhuying Technology Co., Ltd.”
Mapping out this small network of apps, VPNpro reports that there are six from the same developer that should be treated with caution. “These apps have more than 157 million installs combined. But the number is likely much bigger—while VivaVideo’s Google Play page shows it has 100 million+ installs, its ’About Us’ page shows that it already has 380 million users worldwide.”
VivaVideo
VivaVideo PRO Video Editor HD
SlidePlus - Photo Slideshow Maker
Tempo - Music Video Editor with Effects
VivaCut - Pro Video Editor APP
VidStatus - Status Videos & Status Downloader
Unless and until Google makes permission adherence mandatory, putting an end to user data factories, or unless and until hundreds of millions of users vote with their feet (or fingers) and stop installing such apps, these dangers will persist.
As ever, decide if you need the plethora of apps casually installed on your phone. Be especially cautions of apps from China, which is where most of these networks of apps appear to originate. And pay attention to the permissions you grant these apps. If the list of requests seems out of step with the purpose of the app, you would be well advised to avoid installing it on your phone.
Both QuVideo and Google were approached for comment before publishing.
Follow me on Twitter or LinkedIn.
Zak Doffman
Zak Doffman
Source : Forbes
Comments