Around 500 apps have been removed from the Google Play Store due to malicious code that could allow hackers to change what your app does after you have downloaded it. The apps had amassed 100 million downloads altogether before Google struck the ban hammer.
The discovery of the code was announced by Lookout, a mobile security firm. The code made its way to the apps in the form of a compromised Software Development Kit (SDK) used to serve third party advertisements to people using the free version of the apps.
When the malicious app is installed, the SDK will load up and allow hackers to remotely upload new code onto the user’s device. It can be anything from viruses to serving pop-up ads. However, the most serious vulnerability is that the hackers can use these apps to download your contacts and you call logs. This is called “call log exfiltration.”
The security firm informed Google regarding the apps before publishing its findings. Google has removed the apps from Play Store and those which had been downloaded, have been replaced by a safe version where the SDK has been removed. Lookout advises that users keep their apps up-to-date in order to avoid Spyware apps. We should also carefully read app descriptions and avoid downloading apps from third party websites to keep our phones safe.
Source – Consumer Reports
