Researchers from the Helmholtz Center for Information Security (CISPA), Ohio State University, and New York University are studying hidden functionalities in applications for the Android platform. They analyzed 100,000 mobile applications from the Google Play catalog, 20,000 from an alternative catalog (Baidu), and 30,000 pre-installed applications from various smartphones extracted from 1,000 firmware versions with SamMobile, , revealing that 12,706 (8.5%) of the programs contain functionalities hidden from the user but can be activated using special sequences, which can be classified as backdoors.
In particular, 7,584 applications included built-in secret access keys, 501 included hardcoded master passwords, and 6,013 contained hidden commands. Problematic applications were found across all examined software sources — in percentage terms, backdoors were identified in 6.86% (6,860) of the studied programs from Google Play, 5.32% (1,064) from the alternative catalog, and 15.96% (4,788) from the list of pre-installed applications. The identified backdoors allow anyone with knowledge of the keys, activation passwords, and sequences to invoke commands to access the application and all associated data.
For example, in a sports streaming application with 5 million installations, a built-in key for accessing the admin interface was found, which allows changing application settings and accessing additional functionality. In a screen lock application with 5 million installations, an access key was found that enables resetting the user-set password for device unlocking. In a translation app with 1 million installations, a key exists that allows making in-app purchases and upgrading to the pro version without actual payment.
In the remote management program for lost devices, which has 10 million installations, a master password was discovered that allows users to bypass locks set in case of device loss. In a note-taking application, a master password was found that unlocks secure notes. Many applications also revealed debug modes that open access to low-level capabilities; for example, in a shopping app, entering a specific combination would launch a proxy server, and in a training program, there was a way to bypass test completions.
In addition to backdoors, 4,028 (2.7%) applications were found to contain blacklists used to censor information from users. The blacklists contain sets of words that are prohibited from being mentioned, including names of political parties and politicians, as well as typical phrases used for intimidation and discrimination against certain social groups. Blacklists were found in 1.98% of the analyzed programs from Google Play, in 4.46% from alternative directories, and in 3.87% from the list of pre-installed applications.
To conduct the analysis, researchers used a toolkit named InputScope, the code of which will soon be available on GitHub (previously, researchers had already published a static analyzer , which automatically detects information leaks in applications).
Source: opennet.ru
