Feeds

Maybe don't install that groovy pirated Android keyboard

It could be loggin' your login, warn experts

Protecting against web application threats using SSL

A mobile software developer has turned an popular third party Android mobile keyboard called SwiftKey into a counterfeit package loaded with a trojan as a warning about the perils of using pirated or cracked apps from back-street app stores.

Georgie Casey, who runs a popular Android app-development blog in Ireland, created a modified (backdoored) version of SwiftKey using a tool called apktool combined with basic knowledge of Java and Android. The end result was a backdoored app called Keylogger SwiftKey APK, which Casey made available from his website (along with explicit warnings that it was to be used by interested parties and only to validate the problem).

"Apktool isn't keylogging software, it's an Android app dissassembler," Casey told El Reg.

"You dissassemble a Swiftkey keyboard, code your keylogger code that sends keylogs to my server, re-assemble with Apktool and now you've a keylogger. You still have to convince people to install it though."

Casey added that using pirated Android apps, especially from third-party stories, is a serious security risk. He reckons the threat also extends to iPhone apps on a jailbroken phone, a theme he expands upon in a blog post on his development of Keylogger SwiftKey APK that also provides a detailed explanation of how he pulled off the trick.

"Cracked copies of PC and iPhone apps can have malware as well, of course, but on both those platforms most software is compiled to machine code," Casey writes.

"Android apps are coded in Java and compiled to byte code that is run on the Dalvik VM and this byte code is not that hard to edit and insert back into an APK."

The backdoored code would have been capable of uploading any keystrokes entered by unwitting users (potentially credit card details, webmail logins and more) to a remote server. The exercise shows that the threat from pirated malware-laden apps extends beyond games to utilities such as SwiftKey.

Casey told El Reg:

"Should custom Android keyboards even be allowed? We can agree that TLS/SSL is great security against man in the middle attacks but it doesn't really matter if the custom keyboard you've installed is sending your bank PIN or CC numbers to an external server."

Statistics from Trend Micro show the problem of dodgy Android apps is far from isolated. The security software firm's Mobile App Reputation service sources and analyses Android apps from around the world, scoring the mobile software apps on the basis of maliciousness, resource utilisation and privacy.

Trend has surveyed some 2 million apps, or around three times the total number of apps on Google Play. More than one in ten of these apps (293,091) were classified as malicious with a further 150,203 classified as high risk, according to the latest figures.

Google Play is as much a part of the problem as unofficial app stores in the developing world.

"Of those 293,091 malicious apps, 68,740 were sourced directly from Google Play," writes Rik Ferguson, director of security research and communications at Trend Micro.

"It’s not just Chinese and Russian app stores."

And outright maliciousness is just a start of the problems.

One in five (22 per cent) of the apps were found to inappropriately leak user data over the network, SMS or telephone. The leaked data most often includes IMEI, contact data and telephone number. A few apps were even found to leak data using the microphone and camera. A further third (32 per cent) of the apps were classified as "poor" in terms of battery usage, a quarter (24 per cent) "poor" for network usage and a similar 28 per cent were memory hogs. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.