Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

04:30 PM
Connect Directly

Researchers Find 24 'Dangerous' Android Apps with 382M Installs

Shenzhen Hawk Internet Co. is identified as the parent company behind five app developers seeking excessive permissions in Android apps.

Security researchers have identified 24 Android applications seeking dangerous and excessive permissions, all of which come from app developers under Chinese company Shenzhen Hawk Internet Co., Ltd., and have a combined total of 382 million downloads.

One of these developers is Hi Security, the company behind Virus Cleaner 2019 (100 million installations) and Hi VPN, Free VPN (10 million). Hi Security first appeared on the radar of VPNPro researchers when they analyzed the companies behind VPN products, and again when they investigated the permissions that popular free antivirus apps were requesting from users.

This trend prompted researchers to look into Hi Security, which led them to Shenzhen Hawk and more of its developers, which also create apps built with malware and rogueware. These include Tap Sky, ViewYeah Studio, Alcatel Innovative Lab, Hawk App, and mie-alcatel.support. It's also worth noting Shenzhen Hawk is a subsidiary of TCL Corporation, a major Chinese company that owns licensing rights to Alcatel, BlackBerry, and RCA, among other organizations. TCL Corporation began as a state-owned enterprise and still has strong government ties.

Shenzhen Hawk's company page lists 13 apps it claims to own, including Hi Security 2019 (5 million installations), Candy Selfie Camera (10 million), Super Battery (5 million), Candy Gallery (10 million), Hi VPN Pro (500,000), Net Master (5 million), filemanager (50 million), Sound Recorder (100 million), and Weather Forecast (10 million). However, when researchers looked into the developers behind these apps, they found 24 total apps in the Shenzhen Hawk network.

Each of these 24 apps, all of which are available on Google Play, requests excessive permissions: the ability to make phone calls, take pictures, and record audio or video, among others.

Jan Youngren, security researcher with VPNPro, points to the malware-infected Weather Forecast app as a dangerous example. "They were guilty of harvesting user data and sending it to a server in China, and they were also secretly subscribing users to premium phone numbers," an act that led to high charges on victims' phone bills. The app would also launch hidden browser windows and click ads from different web pages, Youngren notes in a blog post.

He lists the permissions requested by these apps in order of severity. Six apps request access to the device's camera, for example, and two request the ability to make a call directly from the app. Fifteen ask for permission to read through saved files, including system logs and other apps' files. The same amount ask for permission to access the user's specific GPS location.

"This presents a high risk to privacy, since most apps don't seem to need it at all," he writes. "This permission allows apps to use GPS, call data and/or WiFi to get a user's precise location."

Fourteen apps request permission to gather information about a user's device, including the phone number, cellular network information, connected registered phone accounts, and the status of ongoing calls. Two ask to look through the phone's contacts, and one requests permission to record audio and store it either on the device or on the app's servers.

The aforementioned permissions are considered high-severity, Youngren says. Some apps request medium-severity permissions including the ability to gather a user's general location, which is asked by 13 apps, as well as the permission to access a list of accounts in the Accounts Service (nine apps). Twenty-one apps ask permission to upload files to the user's device storage, two ask to read through a personal calendar, and one asks to add calendar events.

Virus Cleaner 2019, for example, requests the ability to read contacts, read/write external storage, read phone state, access coarse and fine locations, call phone, access the camera, and get accounts. Candy Selfie Camera requests coarse and fine location, camera access, and the ability to get accounts, write external storage, and read external storage, logs, and phone state.

Most of these apps only request permissions from the user once, and then they continue to collect data in the background. "Users need to be made aware of what these apps are doing on a consistent basis," says Youngren. He advises deleting these apps, for those still using them.

The most likely and legal reason companies are collecting this data is to sell it to third parties. Location data, both coarse and fine, is most lucrative: Apps can send location data 14,000 times per day, Youngren says, giving buyers an accurate depiction of users' daily movements.

This isn't the first time Shenzhen Hawk has been known to develop apps with malware and privacy issues. The company creates seven apps specifically made for Alcatel phones; some of Alcatel's built-in software, including the Weather Forecast app, has been known to infect devices with malware and adware. Some default Alcatel apps, including Gallery, were changed to "Candy Gallery" and the old app developer name was replaced with an entirely new one.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "AppSec Concerns Drove 61% of Businesses to Change Applications."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/4/2020 | 11:08:38 AM
Parent company
I think that the fact that they are partially state owned is pretty scary.    This adds a layer of 'what are they doing with the data' beyond simple reselling of the data for profit.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.