Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

04:30 PM
Connect Directly

Researchers Find 24 'Dangerous' Android Apps with 382M Installs

Shenzhen Hawk Internet Co. is identified as the parent company behind five app developers seeking excessive permissions in Android apps.

Security researchers have identified 24 Android applications seeking dangerous and excessive permissions, all of which come from app developers under Chinese company Shenzhen Hawk Internet Co., Ltd., and have a combined total of 382 million downloads.

One of these developers is Hi Security, the company behind Virus Cleaner 2019 (100 million installations) and Hi VPN, Free VPN (10 million). Hi Security first appeared on the radar of VPNPro researchers when they analyzed the companies behind VPN products, and again when they investigated the permissions that popular free antivirus apps were requesting from users.

This trend prompted researchers to look into Hi Security, which led them to Shenzhen Hawk and more of its developers, which also create apps built with malware and rogueware. These include Tap Sky, ViewYeah Studio, Alcatel Innovative Lab, Hawk App, and mie-alcatel.support. It's also worth noting Shenzhen Hawk is a subsidiary of TCL Corporation, a major Chinese company that owns licensing rights to Alcatel, BlackBerry, and RCA, among other organizations. TCL Corporation began as a state-owned enterprise and still has strong government ties.

Shenzhen Hawk's company page lists 13 apps it claims to own, including Hi Security 2019 (5 million installations), Candy Selfie Camera (10 million), Super Battery (5 million), Candy Gallery (10 million), Hi VPN Pro (500,000), Net Master (5 million), filemanager (50 million), Sound Recorder (100 million), and Weather Forecast (10 million). However, when researchers looked into the developers behind these apps, they found 24 total apps in the Shenzhen Hawk network.

Each of these 24 apps, all of which are available on Google Play, requests excessive permissions: the ability to make phone calls, take pictures, and record audio or video, among others.

Jan Youngren, security researcher with VPNPro, points to the malware-infected Weather Forecast app as a dangerous example. "They were guilty of harvesting user data and sending it to a server in China, and they were also secretly subscribing users to premium phone numbers," an act that led to high charges on victims' phone bills. The app would also launch hidden browser windows and click ads from different web pages, Youngren notes in a blog post.

He lists the permissions requested by these apps in order of severity. Six apps request access to the device's camera, for example, and two request the ability to make a call directly from the app. Fifteen ask for permission to read through saved files, including system logs and other apps' files. The same amount ask for permission to access the user's specific GPS location.

"This presents a high risk to privacy, since most apps don't seem to need it at all," he writes. "This permission allows apps to use GPS, call data and/or WiFi to get a user's precise location."

Fourteen apps request permission to gather information about a user's device, including the phone number, cellular network information, connected registered phone accounts, and the status of ongoing calls. Two ask to look through the phone's contacts, and one requests permission to record audio and store it either on the device or on the app's servers.

The aforementioned permissions are considered high-severity, Youngren says. Some apps request medium-severity permissions including the ability to gather a user's general location, which is asked by 13 apps, as well as the permission to access a list of accounts in the Accounts Service (nine apps). Twenty-one apps ask permission to upload files to the user's device storage, two ask to read through a personal calendar, and one asks to add calendar events.

Virus Cleaner 2019, for example, requests the ability to read contacts, read/write external storage, read phone state, access coarse and fine locations, call phone, access the camera, and get accounts. Candy Selfie Camera requests coarse and fine location, camera access, and the ability to get accounts, write external storage, and read external storage, logs, and phone state.

Most of these apps only request permissions from the user once, and then they continue to collect data in the background. "Users need to be made aware of what these apps are doing on a consistent basis," says Youngren. He advises deleting these apps, for those still using them.

The most likely and legal reason companies are collecting this data is to sell it to third parties. Location data, both coarse and fine, is most lucrative: Apps can send location data 14,000 times per day, Youngren says, giving buyers an accurate depiction of users' daily movements.

This isn't the first time Shenzhen Hawk has been known to develop apps with malware and privacy issues. The company creates seven apps specifically made for Alcatel phones; some of Alcatel's built-in software, including the Weather Forecast app, has been known to infect devices with malware and adware. Some default Alcatel apps, including Gallery, were changed to "Candy Gallery" and the old app developer name was replaced with an entirely new one.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "AppSec Concerns Drove 61% of Businesses to Change Applications."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
2/4/2020 | 11:08:38 AM
Parent company
I think that the fact that they are partially state owned is pretty scary.    This adds a layer of 'what are they doing with the data' beyond simple reselling of the data for profit.


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...