Pre-installed apps on Android riddled with malware and privacy issues, reveals new study

• A research study found that the pre-installed vendor apps which come on Android devices harbor backdoors as well as exhibit malicious behaviors.
• The study was conducted on Android devices made by more than 200 vendors.

While pre-installed apps on the latest Android devices might seem largely harmless, a new research study suggests otherwise.

According to a study by academics from Universidad Carlos III de Madrid, the apps provided by device vendors were flawed with regard to privacy and security implementations. The bloatware also collects sensitive data without the knowledge of the users.

The big picture

• The elaborate study analyzed over 424,584 firmware files (82,501 apps in total) gathered from 2,748 users with 1,742 unique devices. All these devices were from 214 different vendors.
• It also analyzed custom permissions set by hardware vendors, MNOs, third-party services, security firms, industry alliances, chipset manufacturers & Internet browsers. Some of these permissions circumvented Android’s permission model and were vulnerable to data exposure.
• Behavioral analysis conducted for half of the APKs revealed that these apps collected user data as well as had malware in them. User data ranged from personally identifiable information (PII) and geolocation information as well as personal emails, phone call metadata & contacts.

Why it matters - The researchers also disclosed a set of malware embedded in pre-installed apps in their study.

“We identified variants of well-known Android malware families that have been prevalent in the last few years, including Triada, Rootnik, SnowFox, Xinyin, Ztorg, Iop, and dubious software developed by GMobi,” the researchers wrote.

The study also disclosed that almost every pre-installed app had access to PII and was sending this information to third-party servers. In fact, some of them even collected email and phone call data and sent them to servers. Overall, the study suggests these apps did more hard than good for the users, due to the aforementioned security and privacy issues.