Study shows pre-installed apps come with more unethical backdoors behaviour than other apps.
HIGHLIGHTS
- 4,028 tested apps seem to be checking for blacklisted words
- Researchers scanned 150,000 apps using a tool called InputScope
- 4.5 percent of apps from Baidu indulged in blacklisting
Undocumented backdoors include :
secret access keys, master passwords, and secret privileged commands, and blacklists of unwanted items include censorship keywords, cyber-bulling expressions, and weak passwords.
The percentage of undocumented backdoor instances on pre-installed apps was around 16 percent, while Google Play Store apps were at 6.8 percent.
A new study claims that thousands of Android apps may come with input-triggered secrets such as backdoors and blacklists of unwanted items. A total of 150,000 apps have been analysed using a newly developed tool called InputScope. Out of these, 12,706 apps were found to have presence of backdoors, and over 4,028 apps seem to be checking for blacklisted words. From the 150,000 apps, 100,000 apps were from Google Play Store and 30,000 apps were pre-installed ones on Samsung phones.
The new study (link to it) comes from researchers at Ohio State University, New York University, and the Helmholtz Center for Information Security (CISPA).
InputScope tool helped in automatic detection of both the execution context of user input validation and the content involved in the validation to automatically expose hidden functionality.
As mentioned, the pool of apps had Android apps from Google Play Store, pre-installed apps from Samsung phones, and 20,000 apps from Chinese market Baidu as well.
For blacklisting, 4.5 percent of apps were from Baidu, 3.9 percent apps were from pre-installed apps, and 2 percent apps were from Google. These secret backdoors and blacklists on apps can allow for
Remote login,
Reset user passwords,
top users from accessing content,and
Let hackers bypass payment interfaces.
All of these exist without any user knowledge, and this poses as another great threat in the chaotic Android ecosystem.
Article link
