May 31, 2020, Kathmandu
The recent Android devices have improved security that allows users to control the resources or areas an application can have access to. However, some applications may not even require such permission to operate. That’s where it becomes out of the user’s control to block any suspicious activities.
The research team at VPNpro came forward with a report that suggests a Chinese “spyware” app has affected over 100 million Android devices. If you thought that’s worst, wait till you hear this. The developer of the app has other possibly dangerous apps with at least 50M installs.
VPNpro suggests that these apps request “dangerous” permissions and hiding behind one of them is a malicious remote access trojan. These potentially malicious apps are available in both Google’s Play Store and Apple’s App Store.
You May Also Like: 7 Ways Hackers And Scammers Are Exploiting COVID-19 Panic
Who is behind this?
The Chinese developer we are talking about is the Hangzhou-based QuVIdeo Inc. Most android users might be familiar with one of its popular video editing app, VivaVideo. This app offers its services for free and has over 100M downloads in the Play Store.
Likewise, another app from the developer SlidePlus with over 1M downloads may also request for dangerous permissions. While it may seem that there are only 3 apps on Play Store from the developer, VPNpro found 5 apps in total within its network.
What does that mean?
Two apps in specific – VivaCut and Tempo are published under different developer names. That’s how they were hiding their connection to QuVideo Inc.
Despite gaining such popularity, the Indian government has listed VivaVideo as ‘malicious-ware’ or ‘spyware’ along with the other 40 Chinese apps.
Related: Android Users At High Risk During Coronavirus Outbreak
What Permissions do the Apps request?
Such apps request permissions to access phone numbers, location, and GPS data. These may be very basic but let us remind you that these are highly sensitive data. Similarly, some even request access to the camera, call log, microphone, or audio record permission.
Why a video editing app would need permission to access GPS data is quite confusing. Well, this permission allows apps to send location data up to 14,000 times per day. And, that includes the times when you are not using these apps.
These QuVideo apps have been found to be risky:
- VivaVideo
- VivaVideo PRO Video Editor HD
- SlidePlus – Photo Slideshow Maker
- Tempo – Music Video Editor with Effects
- VivaCut – Pro Video Editor APP
- VidStatus – Status Videos & Status Downloader
Also Read: What To Do If Your Data Was Breached? Have You Become a Victim?
What is Google doing to deal with Permission Abuse?
Such app permission abuse has been putting millions of users and their privacy at risk for a long time now. Google has started investigations and acting on it. It introduced a new “nudge” for developers last year in the hope to bring down privacy risks.
Basically, it warns developers that ask way too many permissions, suggesting them to rethink. Google has now said, “Nearly 60% of the warned apps removed permissions—across all Play Store categories.”
Google takes security and privacy violations seriously from what it told Zak Doffman, a cybersecurity expert. According to him, he shared the findings of “24 popular apps seeking dangerous permissions” with Google. Soon enough, these apps – with 380M downloads – were pulled from the Play Store.
