A mobile software developer has turned an popular third party Android mobile keyboard called SwiftKey into a counterfeit package loaded with a trojan as a warning about the perils of using pirated or cracked apps from back-street app stores.
Georgie Casey, who runs a popular Android app-development blog in Ireland, created a modified (backdoored) version of SwiftKey using a tool called apktool combined with basic knowledge of Java and Android. The end result was a backdoored app called Keylogger SwiftKey APK, which Casey made available from his website (along with explicit warnings that it was to be used by interested parties and only to validate the problem).
"Apktool isn't keylogging software, it's an Android app dissassembler," Casey told El Reg.
"You dissassemble a Swiftkey keyboard, code your keylogger code that sends keylogs to my server, re-assemble with Apktool and now you've a keylogger. You still have to convince people to install it though."
Casey added that using pirated Android apps, especially from third-party stories, is a serious security risk. He reckons the threat also extends to iPhone apps on a jailbroken phone, a theme he expands upon in a blog post on his development of Keylogger SwiftKey APK that also provides a detailed explanation of how he pulled off the trick.
"Cracked copies of PC and iPhone apps can have malware as well, of course, but on both those platforms most software is compiled to machine code," Casey writes.
"Android apps are coded in Java and compiled to byte code that is run on the Dalvik VM and this byte code is not that hard to edit and insert back into an APK."
The backdoored code would have been capable of uploading any keystrokes entered by unwitting users (potentially credit card details, webmail logins and more) to a remote server. The exercise shows that the threat from pirated malware-laden apps extends beyond games to utilities such as SwiftKey.
Casey told El Reg:
"Should custom Android keyboards even be allowed? We can agree that TLS/SSL is great security against man in the middle attacks but it doesn't really matter if the custom keyboard you've installed is sending your bank PIN or CC numbers to an external server."
Statistics from Trend Micro show the problem of dodgy Android apps is far from isolated. The security software firm's Mobile App Reputation service sources and analyses Android apps from around the world, scoring the mobile software apps on the basis of maliciousness, resource utilisation and privacy.
Trend has surveyed some 2 million apps, or around three times the total number of apps on Google Play. More than one in ten of these apps (293,091) were classified as malicious with a further 150,203 classified as high risk, according to the latest figures.
Google Play is as much a part of the problem as unofficial app stores in the developing world.
"Of those 293,091 malicious apps, 68,740 were sourced directly from Google Play," writes Rik Ferguson, director of security research and communications at Trend Micro.
"It’s not just Chinese and Russian app stores."
And outright maliciousness is just a start of the problems.
One in five (22 per cent) of the apps were found to inappropriately leak user data over the network, SMS or telephone. The leaked data most often includes IMEI, contact data and telephone number. A few apps were even found to leak data using the microphone and camera. A further third (32 per cent) of the apps were classified as "poor" in terms of battery usage, a quarter (24 per cent) "poor" for network usage and a similar 28 per cent were memory hogs. ®