Some mobile phone apps may contain hidden behaviors that users never see

ronjor · Mar 31, 2020

by Laura Arenschield, The Ohio State University March 31, 2020

For this study, the research team evaluated 150,000 apps. They selected the top 100,000 based on the number of downloads from the Google Play store, the top 20,000 from an alternative market, and 30,000 from pre-installed apps on Android smartphones.
They found that 12,706 of those apps, about 8.5 percent, contained something the research team labeled "backdoor secrets"—hidden behaviors within the app that accept certain types of content to trigger behaviors unknown to regular users. They also found that some apps have built-in "master passwords," which allow anyone with that password to access the app and any private data contained within it. And some apps, they found, had secret access keys that could trigger hidden options, including bypassing payment.
Click to expand...

Adric · Apr 1, 2020

The article would have been more interesting if it had included a link to the list of apps that were found with hidden behaviors.

guest · Apr 4, 2020

12k+ Android apps contain master passwords, secret access keys, secret commands

"Meanwhile, we also discovered a popular screen locker app (5 million installs) uses an access key to reset arbitrary users' passwords to unlock the screen and enter the system.
"In addition, we also found that a live streaming app (5 million installs) contains an access key to enter its administrator interface, through which an attacker can reconfigure the app and unlock additional functionality.
"Finally, we found a popular translation app (1 million installs) contains a secret key to bypass the payment for advanced services such as removing the advertisements displayed in the app.

The research team said they notified all the app developers where they found hidden behavior or a backdoor-like mechanism. However, not all app devs responded.
As a result, some of the apps that were provided as examples in the team's white paper have had their names redacted to protect their users.
Click to expand...

Automatic Uncovering of Hidden Behaviors From Input Validation in Mobile Apps (PDF):
https://panda.moyix.net/~moyix/papers/inputscope_oakland20.pdf

jaypeecee · May 16, 2020

Adric said: ↑

The article would have been more interesting if it had included a link to the list of apps that were found with hidden behaviors.
Click to expand...

I couldn't agree more. It is, in my opinion, little more than a scaremongering article. Or, am I missing something?

JPC

longshots · May 16, 2020

jaypeecee said: ↑

I couldn't agree more. It is, in my opinion, little more than a scaremongering article. Or, am I missing something?
Click to expand...

The only thing that's missing is substance.

Some studies may contain hidden information that users never see

For this study, the research team evaluated 150,000 apps. They selected the top 100,000 based on the number of downloads from the Google Play store, the top 20,000 from an alternative market, and 30,000 from pre-installed apps on Android smartphones.

They found that 12,706 of those apps, about 8.5 percent, contained something the research team labeled "backdoor secrets"—hidden behaviors within the app that accept certain types of content to trigger behaviors unknown to regular users. They also found that some apps have built-in "master passwords," which allow anyone with that password to access the app and any private data contained within it. And some apps, they found, had secret access keys that could trigger hidden options, including bypassing payment.
Click to expand...

Adric said: ↑

The article would have been more interesting if it had included a link to the list of apps that were found with hidden behaviors
Click to expand...

+1. They say there are 12,706 suspect apps, but not one example?

Log in or Sign up

Some mobile phone apps may contain hidden behaviors that users never see

ronjor Global Moderator

Adric Registered Member

guest Guest

jaypeecee Registered Member

longshots Registered Member

Log in or Sign up

Some mobile phone apps may contain hidden behaviors that users never see

ronjor Global Moderator

Adric Registered Member

guest Guest

jaypeecee Registered Member

longshots Registered Member

Useful Searches