A Closer Look at Spyware Apps Distributed by Google

Phone apps and SDK’s

Software Developer kits (SDKs) are used to help developers quickly code their apps with advertising in mind. This way, they can receive advertising payments from their apps. Until recently, Google didn’t allow any changes to SDKs once they were checked into the play store. Enter Chinese SDK creator Lgexin.

Sneaky Lgexin SDK

Lgexin is responsible for more than 500 android apps in the Google Play store being corrupted. Previously they were not able to alter their SDK once it went to market, due to Google’s strict guidelines around SDK implementation. Their workaround for this was to get approval from the dev owner in order to make some small updates to the SDK package and re-submit it into the Google Play store. These small changes were masked and encrypted to try and hide the phone call tracing functionality that was being inserted.

What is the threat?

Lgexin could do whatever they like with the call data they would receive from users of their SDK applications. This call data could be sold to other companies for telemetry purposes or even to the government for global call tracking. Some of the apps include weather apps, teen related games, photo editors, radio and even some fitness apps. With over 100 million downloads of just one of these apps, Lgexin put a lot of people’s privacy and data at risk.

One of the most downloaded apps was called “Lucky Cash- Earn Free Money”, which would prompt the user with a fake google prompt to allow full access to the phone’s call functionality. Millions of users could have unknowingly granted this access. The plugin is called a “phonestatelistener” and can capture the time of the call, the state of the call and the calling number. The data is then sent encrypted to Lgexin’s API for purposes which remain unknown.

What can I do?

From a user perspective, whenever downloading an app from the app store, you should be prompted with any and all permissions that the application will need from your phone in order to operate. This is where common sense needs to come in. First, do you even need or want the app? Do the permissions requested seem reasonable for the app? i.e. does this calculator app really need access to your contact list or pictures? Once you download an app, you shouldn’t be prompted by the play store via pop up for additional permissions. Lastly, be sure to review your apps on occasion and uninstall any that you are no longer using.

Even following the suggestions above is no guarantee. Lgexin has put trusted downloads in a new light and serves as a reminder that you can no longer trust an app based primarily on the number of downloads it has.