Researchers Find 24 Dangerous Android Apps with 382M Installs

Shenzhen Hawk Internet Co. is identified as the parent company behind five app developers seeking excessive permissions in Android apps.

Security researchers have identified 24 Android applications seeking dangerous and excessive permissions, all of which come from app developers under Chinese company Shenzhen Hawk Internet Co., Ltd., and have a combined total of 382 million downloads.
One of these developers is Hi Security, the company behind Virus Cleaner 2019 (100 million installations) and Hi VPN, Free VPN (10 million). Hi Security first appeared on the radar of VPNPro researchers when they
analyzed
the companies behind VPN products, and again when they investigated the permissions that popular free antivirus apps were requesting from users.
This trend prompted researchers to look into Hi Security, which led them to Shenzhen Hawk and more of its developers, which also create apps built with malware and rogueware. These include Tap Sky, ViewYeah Studio, Alcatel Innovative Lab, Hawk App, and mie-alcatel.support. Its also worth noting Shenzhen Hawk is a subsidiary of TCL Corporation, a major Chinese company that owns licensing rights to Alcatel, BlackBerry, and RCA, among other organizations. TCL Corporation began as a state-owned enterprise and still has strong government ties.
Shenzhen Hawks company page lists 13 apps it claims to own, including Hi Security 2019 (5 million installations), Candy Selfie Camera (10 million), Super Battery (5 million), Candy Gallery (10 million), Hi VPN Pro (500,000), Net Master (5 million), filemanager (50 million), Sound Recorder (100 million), and Weather Forecast (10 million). However, when researchers looked into the developers behind these apps, they found 24 total apps in the Shenzhen Hawk network.
Each of these 24 apps, all of which are available on Google Play, requests excessive permissions: the ability to make phone calls, take pictures, and record audio or video, among others.
Jan Youngren, security researcher with VPNPro, points to the malware-infected Weather Forecast app as a dangerous example. They were guilty of harvesting user data and sending it to a server in China, and they were also secretly subscribing users to premium phone numbers, an act that led to high charges on victims phone bills. The app would also launch hidden browser windows and click ads from different web pages, Youngren notes in a
blog post
.
He lists the permissions requested by these apps in order of severity. Six apps request access to the devices camera, for example, and two request the ability to make a call directly from the app. Fifteen ask for permission to read through saved files, including system logs and other apps files. The same amount ask for permission to access the users specific GPS location.
This presents a high risk to privacy, since most apps dont seem to need it at all, he writes. This permission allows apps to use GPS, call data and/or WiFi to get a users precise location.
Fourteen apps request permission to gather information about a users device, including the phone number, cellular network information, connected registered phone accounts, and the status of ongoing calls. Two ask to look through the phones contacts, and one requests permission to record audio and store it either on the device or on the apps servers.
The aforementioned permissions are considered high-severity, Youngren says. Some apps request medium-severity permissions including the ability to gather a users general location, which is asked by 13 apps, as well as the permission to access a list of accounts in the Accounts Service (nine apps). Twenty-one apps ask permission to upload files to the users device storage, two ask to read through a personal calendar, and one asks to add calendar events.
Virus Cleaner 2019, for example, requests the ability to read contacts, read/write external storage, read phone state, access coarse and fine locations, call phone, access the camera, and get accounts. Candy Selfie Camera requests coarse and fine location, camera access, and the ability to get accounts, write external storage, and read external storage, logs, and phone state.
Most of these apps only request permissions from the user once, and then they continue to collect data in the background. Users need to be made aware of what these apps are doing on a consistent basis, says Youngren. He advises deleting these apps, for those still using them.
The most likely and legal reason companies are collecting this data is to sell it to third parties. Location data, both coarse and fine, is most lucrative: Apps can send location data 14,000 times per day, Youngren says, giving buyers an accurate depiction of users daily movements.
This isnt the first time Shenzhen Hawk has been known to develop apps with malware and privacy issues. The company creates seven apps specifically made for Alcatel phones; some of Alcatels built-in software, including the Weather Forecast app, has been known to infect devices with malware and adware. Some default Alcatel apps, including Gallery, were changed to Candy Gallery and the old app developer name was replaced with an entirely new one.
Related Content:
9 Things Application Security Champions Need to Succeed
Embracing a Prevention Mindset to Protect Critical Infrastructure
Two Vulnerabilities Found in Microsoft Azure Infrastructure
Assessing Cybersecurity Risk in Todays Enterprise
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
AppSec Concerns Drove 61% of Businesses to Change Applications
.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Researchers Find 24 Dangerous Android Apps with 382M Installs