Android app strips personal data

Trojan wallpaper app signals a rising mobile data threat

Mobile Trojan

A seemingly innocuous wallpaper app for Android phones is busy stripping personal data and sending it off to a Chinese server.

The One-Piece Wallpapers app, by Jackeey Wallpaper, allows the downloader to personalise the phone's background wallpaper. Ready-made wallpapers include My Little Pony and Star Wars themes.

In the background, the app collects the users phone number, subscriber identity and voicemail password. These are then dispatched to a server at www.imnet.us, housed in Shenzhen, China.

What the recipients will do with this data is not known, but it could be a proof of concept app which is a precursor of more serious exploits in the future.

Google vice president and Android co-founder Andy Rubin revealed recently 160,000 Android devices are activated daily. Exact download figures for the rogue app are not known but are believed to run into millions.

The exploit was uncovered by US security specialist Lookout, which is compiling the App Genome Project, a web site aiming to uncover apps with malicious code hidden inside.

Android apps are not screened for reliability and potential flaws in the way that iPhone apps are. Anyone can publish Android programs but the iTunes vetting process guards the Apple apps store.

This should make iPhone apps more trustworthy but data so far gathered by the Genome Project suggests that these programs are no more trustworthy than their Android equivalents. In fact, the Lookout data suggests that nearly twice as many free apps have the capability to access user's contact data on the iPhone 14 per cent compared with Android eight per cent.

A recent iPhone exploit involved an app called Handy Light which blanked the screen with a chosen colour to turn the phone into a low-powered flashlight.

Inside, the app was code that turned the phone into a 3G modem. This allowed users to surf the web from their computer through the iPhone for free. Not an illegal act but, in the US, AT&T would normally charge an extra $20 (12.80) per month.

Featured Resources

Consumer choice and the payment experience

A software provider's guide to getting, growing, and keeping customers

Download now

Prevent fraud and phishing attacks with DMARC

How to use domain-based message authentication, reporting, and conformance for email security

Download now

Business in the new economy landscape

How we coped with 2020 and looking ahead to a brighter 2021

Download now

How to increase cyber resilience within your organisation

Cyber resilience for dummies

Download now

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

16 Jun 2021
EU plans to launch bloc-wide cyber task force
cyber attacks

EU plans to launch bloc-wide cyber task force

22 Jun 2021
What is HTTP error 400 and how do you fix it?
Network & Internet

What is HTTP error 400 and how do you fix it?

16 Jun 2021