Android Wallpaper App that Steals Your Data Was Downloaded by Millions

[gagan007]

The app in question came from Jackeey Wallpaper, and it was uploaded to the Android Market, where users can download it and use it to decorate their phones that run the Google Android operating system. It includes branded wallpapers from My Little Pony and Star Wars, to name just a couple.

Update: Lookout notes it does not capture browsing history and text messages: It collects your browsing history, text messages, your phone’s SIM card number, subscriber identification, and even your voicemail password, as long as it is programmed automatically into your phone. It sends the data to a web site, imnet[dot]us. That site is evidently owned by someone in Shenzhen, China. The app has been downloaded anywhere from 1.1 million to 4.6 million times. The exact number isn’t known because the Android Market doesn’t offer precise data. The search through the data showed that Jackeey Wallpaper and another developer known as iceskysl@1sters! (which could possibly be the same developer, as they use similar code) were collecting personal data. The wallpaper app asks for permission to access your “phone calls,” but that isn’t necessarily a clear warning.

The Lookout executives found the questionable app as part of their App Genome Project. Lookout is a mobile security firm, and it logged data from more than 100,000 free Android and iPhone apps as part of the project to analyze how apps behave. It found that the apps access your personal data quite often. On Android, each user is asked if they give their permission to access an app, but on the iPhone, where Apple approves apps, no permission is needed.

Roughly 47 percent of Android apps access some kind of third-party code, while 23 percent of iPhone apps do. The executives also found that many apps use third-party software programs to do things such as feed ads into an app. Often, developers unquestioningly use the software development kits of those third parties in their apps, even if they don’t know what they do. In many cases, there is a good reason for the use of personal information. Ads, for instance, can be better targeted if the app knows a user’s location.

Read More Here:

What could I say...disadvantages of open source!!!!

 

[Faun]

not necessarily a disadvantage.

 

[topgear]

Google Suspends Android Wallpaper Apps

Android wallpaper apps have been acquiring personal information like subscriber identifiers and voicemail numbers.

Wednesday during the Black Hat security conference held in Las Vegas, mobile security firm Lookout--which provides free anti-virus software for the Android, BlackBerry and Windows Mobile platforms--said that a batch of wallpaper applications found on the Android Market were collecting unnecessary user data.

One of the apps in question was created by Jackeey Wallpaper and included familiar, seemingly harmless images based on Star Wars, My Little Pony and more. According to Lookout, the app was downloaded somewhere between 1.1 million to 4.6 million times--the number varies because Android Market apparently doesn't offer precise data. The app didn't throw up any red flags initially because it only asked permission for "phone info."

However it was discovered that the app collected information such as the device’s phone number, subscriber identifier, and the currently entered voicemail number on the phone. It was also reported that the apps passed the information on to a website owned by someone in Shenzhen, China.

"While this sort of data collection from a wallpaper application is certainly suspicious, there’s no evidence of malicious behavior," Lookout said in a blog. "There have been cases in the past on other mobile platforms where well-intentioned developers are simply over-zealous in their data gathering, without having malicious intent."

Lookout also said there was another developer known as iceskysl@1sters! collecting identical information with other wallpaper apps. Lookout believes that the two could possibly be connected, as both developers share the same common code inside a class named "SyncDeviceInfoService."

The suspicious wallpaper apps were discovered as part of Lookout's App Genome Project. As of this writing, a quick search for "Jackeey Wallpaper" on the Android Market provided zero results--apparently the developer name has been changed to "callmejack."

"We’ve been working with Google to investigate these apps and they’re on top of it," Lookout said. Google has supposedly suspended the apps until further investigation.

Source