Feeds

Maybe don't install that groovy pirated Android keyboard

It could be loggin' your login, warn experts

Internet Security Threat Report 2014

A mobile software developer has turned an popular third party Android mobile keyboard called SwiftKey into a counterfeit package loaded with a trojan as a warning about the perils of using pirated or cracked apps from back-street app stores.

Georgie Casey, who runs a popular Android app-development blog in Ireland, created a modified (backdoored) version of SwiftKey using a tool called apktool combined with basic knowledge of Java and Android. The end result was a backdoored app called Keylogger SwiftKey APK, which Casey made available from his website (along with explicit warnings that it was to be used by interested parties and only to validate the problem).

"Apktool isn't keylogging software, it's an Android app dissassembler," Casey told El Reg.

"You dissassemble a Swiftkey keyboard, code your keylogger code that sends keylogs to my server, re-assemble with Apktool and now you've a keylogger. You still have to convince people to install it though."

Casey added that using pirated Android apps, especially from third-party stories, is a serious security risk. He reckons the threat also extends to iPhone apps on a jailbroken phone, a theme he expands upon in a blog post on his development of Keylogger SwiftKey APK that also provides a detailed explanation of how he pulled off the trick.

"Cracked copies of PC and iPhone apps can have malware as well, of course, but on both those platforms most software is compiled to machine code," Casey writes.

"Android apps are coded in Java and compiled to byte code that is run on the Dalvik VM and this byte code is not that hard to edit and insert back into an APK."

The backdoored code would have been capable of uploading any keystrokes entered by unwitting users (potentially credit card details, webmail logins and more) to a remote server. The exercise shows that the threat from pirated malware-laden apps extends beyond games to utilities such as SwiftKey.

Casey told El Reg:

"Should custom Android keyboards even be allowed? We can agree that TLS/SSL is great security against man in the middle attacks but it doesn't really matter if the custom keyboard you've installed is sending your bank PIN or CC numbers to an external server."

Statistics from Trend Micro show the problem of dodgy Android apps is far from isolated. The security software firm's Mobile App Reputation service sources and analyses Android apps from around the world, scoring the mobile software apps on the basis of maliciousness, resource utilisation and privacy.

Trend has surveyed some 2 million apps, or around three times the total number of apps on Google Play. More than one in ten of these apps (293,091) were classified as malicious with a further 150,203 classified as high risk, according to the latest figures.

Google Play is as much a part of the problem as unofficial app stores in the developing world.

"Of those 293,091 malicious apps, 68,740 were sourced directly from Google Play," writes Rik Ferguson, director of security research and communications at Trend Micro.

"It’s not just Chinese and Russian app stores."

And outright maliciousness is just a start of the problems.

One in five (22 per cent) of the apps were found to inappropriately leak user data over the network, SMS or telephone. The leaked data most often includes IMEI, contact data and telephone number. A few apps were even found to leak data using the microphone and camera. A further third (32 per cent) of the apps were classified as "poor" in terms of battery usage, a quarter (24 per cent) "poor" for network usage and a similar 28 per cent were memory hogs. ®

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.