Feeds

Maybe don't install that groovy pirated Android keyboard

It could be loggin' your login, warn experts

Beginner's guide to SSL certificates

A mobile software developer has turned an popular third party Android mobile keyboard called SwiftKey into a counterfeit package loaded with a trojan as a warning about the perils of using pirated or cracked apps from back-street app stores.

Georgie Casey, who runs a popular Android app-development blog in Ireland, created a modified (backdoored) version of SwiftKey using a tool called apktool combined with basic knowledge of Java and Android. The end result was a backdoored app called Keylogger SwiftKey APK, which Casey made available from his website (along with explicit warnings that it was to be used by interested parties and only to validate the problem).

"Apktool isn't keylogging software, it's an Android app dissassembler," Casey told El Reg.

"You dissassemble a Swiftkey keyboard, code your keylogger code that sends keylogs to my server, re-assemble with Apktool and now you've a keylogger. You still have to convince people to install it though."

Casey added that using pirated Android apps, especially from third-party stories, is a serious security risk. He reckons the threat also extends to iPhone apps on a jailbroken phone, a theme he expands upon in a blog post on his development of Keylogger SwiftKey APK that also provides a detailed explanation of how he pulled off the trick.

"Cracked copies of PC and iPhone apps can have malware as well, of course, but on both those platforms most software is compiled to machine code," Casey writes.

"Android apps are coded in Java and compiled to byte code that is run on the Dalvik VM and this byte code is not that hard to edit and insert back into an APK."

The backdoored code would have been capable of uploading any keystrokes entered by unwitting users (potentially credit card details, webmail logins and more) to a remote server. The exercise shows that the threat from pirated malware-laden apps extends beyond games to utilities such as SwiftKey.

Casey told El Reg:

"Should custom Android keyboards even be allowed? We can agree that TLS/SSL is great security against man in the middle attacks but it doesn't really matter if the custom keyboard you've installed is sending your bank PIN or CC numbers to an external server."

Statistics from Trend Micro show the problem of dodgy Android apps is far from isolated. The security software firm's Mobile App Reputation service sources and analyses Android apps from around the world, scoring the mobile software apps on the basis of maliciousness, resource utilisation and privacy.

Trend has surveyed some 2 million apps, or around three times the total number of apps on Google Play. More than one in ten of these apps (293,091) were classified as malicious with a further 150,203 classified as high risk, according to the latest figures.

Google Play is as much a part of the problem as unofficial app stores in the developing world.

"Of those 293,091 malicious apps, 68,740 were sourced directly from Google Play," writes Rik Ferguson, director of security research and communications at Trend Micro.

"It’s not just Chinese and Russian app stores."

And outright maliciousness is just a start of the problems.

One in five (22 per cent) of the apps were found to inappropriately leak user data over the network, SMS or telephone. The leaked data most often includes IMEI, contact data and telephone number. A few apps were even found to leak data using the microphone and camera. A further third (32 per cent) of the apps were classified as "poor" in terms of battery usage, a quarter (24 per cent) "poor" for network usage and a similar 28 per cent were memory hogs. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.