Android app strips personal data

Trojan wallpaper app signals a rising mobile data threat

Mobile Trojan

A seemingly innocuous wallpaper app for Android phones is busy stripping personal data and sending it off to a Chinese server.

The One-Piece Wallpapers app, by Jackeey Wallpaper, allows the downloader to personalise the phone's background wallpaper. Ready-made wallpapers include My Little Pony and Star Wars themes.

In the background, the app collects the users phone number, subscriber identity and voicemail password. These are then dispatched to a server at www.imnet.us, housed in Shenzhen, China.

What the recipients will do with this data is not known, but it could be a proof of concept app which is a precursor of more serious exploits in the future.

Google vice president and Android co-founder Andy Rubin revealed recently 160,000 Android devices are activated daily. Exact download figures for the rogue app are not known but are believed to run into millions.

The exploit was uncovered by US security specialist Lookout, which is compiling the App Genome Project, a web site aiming to uncover apps with malicious code hidden inside.

Android apps are not screened for reliability and potential flaws in the way that iPhone apps are. Anyone can publish Android programs but the iTunes vetting process guards the Apple apps store.

This should make iPhone apps more trustworthy but data so far gathered by the Genome Project suggests that these programs are no more trustworthy than their Android equivalents. In fact, the Lookout data suggests that nearly twice as many free apps have the capability to access user's contact data on the iPhone 14 per cent compared with Android eight per cent.

A recent iPhone exploit involved an app called Handy Light which blanked the screen with a chosen colour to turn the phone into a low-powered flashlight.

Inside, the app was code that turned the phone into a 3G modem. This allowed users to surf the web from their computer through the iPhone for free. Not an illegal act but, in the US, AT&T would normally charge an extra $20 (12.80) per month.

Featured Resources

How virtual desktop infrastructure enables digital transformation

Challenges and benefits of VDI

Free download

The Okta digital trust index

Exploring the human edge of trust

Free download

Optimising workload placement in your hybrid cloud

Deliver increased IT agility with the cloud

Free Download

Modernise endpoint protection and leave your legacy challenges behind

The risk of keeping your legacy endpoint security tools

Download now

Recommended

What is a Trojan?
Security

What is a Trojan?

27 Aug 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

4 Jan 2022
Synology DiskStation DS2422+ review: A cube of great capacity
network attached storage (NAS)

Synology DiskStation DS2422+ review: A cube of great capacity

10 Jan 2022
Microsoft Exchange servers break thanks to 'Y2K22' bug
email delivery

Microsoft Exchange servers break thanks to 'Y2K22' bug

4 Jan 2022