A Single Developer has made more than 4000 Android Apps that secretly record your audio

---

Recently, security researchers discovered that a single hacker has made more than 4000 apps since February that secretly, without your consent, record your audio, take photos with your camera, make calls and a variety of other things. Even more intriguing is the fact that some of these apps are actually available on the Google Play Store. The first app that the researchers discovered was an app called Soniac that was a slightly customized version of the Telegraph messaging app. The app worked like a normal messenger app on the surface, but int the background it connected to the central server located at port 2222 on the arshad93.ddns[.]net. Also, the app removes its icon from the launcher, so most non-enthusiast users won't be able to uninstall the app.  

But there are a lot more(4000+) similar apps with different names around the internet. Some other apps that are on the play store include ones called 'troy chat' and 'hulk messenger'. These apps look completely different on the surface,but do the same thing that Soniac does. The researchers notified Google about those apps, and they have now been removed from the Play Store.

---

My thoughts on Malware/Spyware on Android

I think malware on Android is primarily due to these reasons:

Android's openness compared to iOS

I have always thought of Android as more of a competitor to Windows/GNU+Linux than iOS. Android seems like it's built, from the ground up, for general purpose computing, while iOS seems to be built to be more similar to embedded platforms(although that has changed in recent years). This means that Android is always more willing to let applications access to different parts of the hardware, low-level APIs and such other things.

As an example of this, those who read Anandtech, will know that they do a lot of longform articles about mobile CPUs. If you notice them, they are all about SoCs running on Android phones. Why do you think that is the case? Because the benchmarks used in those kinds of articles are not even feasible to develop on iOS! iOS will never allow you to access lower-level APIs.

This means that the user has more freedom, the apps often do things that the ones on iOS can't. But it also means that malicious apps can wreck the system(and steal your data) much more easily. In this case, like in many other cases, security is the price you have to pay for liberty.

No examination of apps on the Google Play Store

Anyone who has any experience submitting apps to the Play Store will know that there is basically no examination of the apps that you upload to the store. In fact, the interface for submitting apps focuses more on the branding artwork for apps and less on the security aspects.

Another thing that either is not done, or not very effectively done, is actually examining the APKs that developers upload to the Play Store. Google is the one that develops Android. They obviously (should) know more about decompiling and scanning APKs than others. But it seems like they are either unable to, or unwilling to, scan apps for obvious patterns of malware or spyware.

Fragmentation on Android

The latest platform distribution numbers for Android show that there are 4 previous versions of Android that have more than 5% market share. The latest version of Android, even nearly a year after release, still only has ~10% market share. The latest version(codename O) will probably launch next month. The Android platform is much, much more fragmented than iOS.

This means that even though Google may fix vulnerabilities, those fixes don't always reach users in any reasonable amount of time. This means that if you have discovered some vulnerability, you can keep milking it for fun and profit for years, even after Google has fixed it in the latest version of Android.

Google has claimed that they are working on fixing this problem for many years, but the results have been less than encouraging. The latest effort, called Project Treble is about separating the hardware drivers, and firmware and other low level code from the top most parts of the OS, making it easier to update the upper levels. It is to be seen how well this solution works

In conclusion, unfortunately, the malware that plagues Android is caused by fundamental, deep-rooted problems which will require major changes(which, of course, would break backwards compatibility). One wonders whether Google has the courage(or even the intention) to carry out those changes

---

Thank you for reading this post.If you liked this post, follow me for more content like this :-)

@harshallele

Other Recent Posts

• Neutron Stars - The Weirdest Stars of the Universe
• Now even DNA can be used to hack computers!
• Borda Count - The Better Election System

---

Sources

https://arstechnica.com/information-technology/2017/08/android-users-bombarded-with-4000-spy-apps-three-land-in-google-play/
https://blog.lookout.com/sonicspy-spyware-threat-technical-research
https://developer.android.com/about/dashboards/index.html