Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/3/2020
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Researchers Find 24 'Dangerous' Android Apps with 382M Installs

Shenzhen Hawk Internet Co. is identified as the parent company behind five app developers seeking excessive permissions in Android apps.

Security researchers have identified 24 Android applications seeking dangerous and excessive permissions, all of which come from app developers under Chinese company Shenzhen Hawk Internet Co., Ltd., and have a combined total of 382 million downloads.

One of these developers is Hi Security, the company behind Virus Cleaner 2019 (100 million installations) and Hi VPN, Free VPN (10 million). Hi Security first appeared on the radar of VPNPro researchers when they analyzed the companies behind VPN products, and again when they investigated the permissions that popular free antivirus apps were requesting from users.

This trend prompted researchers to look into Hi Security, which led them to Shenzhen Hawk and more of its developers, which also create apps built with malware and rogueware. These include Tap Sky, ViewYeah Studio, Alcatel Innovative Lab, Hawk App, and mie-alcatel.support. It's also worth noting Shenzhen Hawk is a subsidiary of TCL Corporation, a major Chinese company that owns licensing rights to Alcatel, BlackBerry, and RCA, among other organizations. TCL Corporation began as a state-owned enterprise and still has strong government ties.

Shenzhen Hawk's company page lists 13 apps it claims to own, including Hi Security 2019 (5 million installations), Candy Selfie Camera (10 million), Super Battery (5 million), Candy Gallery (10 million), Hi VPN Pro (500,000), Net Master (5 million), filemanager (50 million), Sound Recorder (100 million), and Weather Forecast (10 million). However, when researchers looked into the developers behind these apps, they found 24 total apps in the Shenzhen Hawk network.

Each of these 24 apps, all of which are available on Google Play, requests excessive permissions: the ability to make phone calls, take pictures, and record audio or video, among others.

Jan Youngren, security researcher with VPNPro, points to the malware-infected Weather Forecast app as a dangerous example. "They were guilty of harvesting user data and sending it to a server in China, and they were also secretly subscribing users to premium phone numbers," an act that led to high charges on victims' phone bills. The app would also launch hidden browser windows and click ads from different web pages, Youngren notes in a blog post.

He lists the permissions requested by these apps in order of severity. Six apps request access to the device's camera, for example, and two request the ability to make a call directly from the app. Fifteen ask for permission to read through saved files, including system logs and other apps' files. The same amount ask for permission to access the user's specific GPS location.

"This presents a high risk to privacy, since most apps don't seem to need it at all," he writes. "This permission allows apps to use GPS, call data and/or WiFi to get a user's precise location."

Fourteen apps request permission to gather information about a user's device, including the phone number, cellular network information, connected registered phone accounts, and the status of ongoing calls. Two ask to look through the phone's contacts, and one requests permission to record audio and store it either on the device or on the app's servers.

The aforementioned permissions are considered high-severity, Youngren says. Some apps request medium-severity permissions including the ability to gather a user's general location, which is asked by 13 apps, as well as the permission to access a list of accounts in the Accounts Service (nine apps). Twenty-one apps ask permission to upload files to the user's device storage, two ask to read through a personal calendar, and one asks to add calendar events.

Virus Cleaner 2019, for example, requests the ability to read contacts, read/write external storage, read phone state, access coarse and fine locations, call phone, access the camera, and get accounts. Candy Selfie Camera requests coarse and fine location, camera access, and the ability to get accounts, write external storage, and read external storage, logs, and phone state.

Most of these apps only request permissions from the user once, and then they continue to collect data in the background. "Users need to be made aware of what these apps are doing on a consistent basis," says Youngren. He advises deleting these apps, for those still using them.

The most likely and legal reason companies are collecting this data is to sell it to third parties. Location data, both coarse and fine, is most lucrative: Apps can send location data 14,000 times per day, Youngren says, giving buyers an accurate depiction of users' daily movements.

This isn't the first time Shenzhen Hawk has been known to develop apps with malware and privacy issues. The company creates seven apps specifically made for Alcatel phones; some of Alcatel's built-in software, including the Weather Forecast app, has been known to infect devices with malware and adware. Some default Alcatel apps, including Gallery, were changed to "Candy Gallery" and the old app developer name was replaced with an entirely new one.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "AppSec Concerns Drove 61% of Businesses to Change Applications."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
bob.m3.1415926
50%
50%
bob.m3.1415926,
User Rank: Apprentice
2/4/2020 | 11:08:38 AM
Parent company
I think that the fact that they are partially state owned is pretty scary.    This adds a layer of 'what are they doing with the data' beyond simple reselling of the data for profit.

 

 
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4537
PUBLISHED: 2020-02-26
IBM WebSphere Service Registry and Repository 8.5 could allow a user to obtain sensitive version information that could be used in further attacks against the system. IBM X-Force ID: 165593.
CVE-2019-4596
PUBLISHED: 2020-02-26
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2019-4597
PUBLISHED: 2020-02-26
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 167880.
CVE-2019-4598
PUBLISHED: 2020-02-26
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 167881.
CVE-2019-4726
PUBLISHED: 2020-02-26
IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 172363.