The Register®

Original URL: http://www.theregister.co.uk/2013/09/24/dodgy_imessage_for_android_app_deepsixed_by_google/

Dodgy 'iMessage for Android' app deep-sixed by Google

Harvesting user credentials violates store policies

By Richard Chirgwin

Posted in Security, 24th September 2013 21:34 GMT

Google has yanked an app that purported to give Android users the ability to use iMessage.

As is discussed by Jay Freeman here, there was a catch in the app. It didn't “make iMessage run on Android”, but rather sent data off for pre-processing to a server in China.

And that meant users were being asked to submit their Apple ID and password to a third party – a no-no from any point of view (The Register would guess it's a good idea for anyone that tried the application to run a password reset immediately).

As Freeman writes, the “sub-optimal” operation of the app went like this: “Every packet from Apple is forwarded to 222.77.191.206, which then sends back exactly what data to send to Apple (along with extra packets that I presume tell the client what's happening so it can update its UI). Likewise, if the client wants to send a message, it first talks to the third-party server, which returns what needs to be sent to Apple. The data is re-encrypted as part of this process, but its size is deterministically unaffected.”

To convince the Apple iMessage servers it was legit, the app apparently disguised itself as a Mac Mini, as noted by developer Alan Bell on Twitter:

Bell also noted that a chunk of the APK file is obfuscated, while another Twitter user, developer Steve Troughton-Smith, asserted that the app also had the ability to background-download APK files.

Whether the app's behaviours were clumsy or a deliberate attempt to harvest user credentials, it violated Google Play's policies and has been dumped. The putative developer's Website, huluwa.org, is also offline at the time of publication. ®