Dodgy 'iMessage for Android' app deep-sixed by Google

Harvesting user credentials violates store policies


Google has yanked an app that purported to give Android users the ability to use iMessage.

As is discussed by Jay Freeman here, there was a catch in the app. It didn't “make iMessage run on Android”, but rather sent data off for pre-processing to a server in China.

And that meant users were being asked to submit their Apple ID and password to a third party – a no-no from any point of view (The Register would guess it's a good idea for anyone that tried the application to run a password reset immediately).

As Freeman writes, the “sub-optimal” operation of the app went like this: “Every packet from Apple is forwarded to 222.77.191.206, which then sends back exactly what data to send to Apple (along with extra packets that I presume tell the client what's happening so it can update its UI). Likewise, if the client wants to send a message, it first talks to the third-party server, which returns what needs to be sent to Apple. The data is re-encrypted as part of this process, but its size is deterministically unaffected.”

To convince the Apple iMessage servers it was legit, the app apparently disguised itself as a Mac Mini, as noted by developer Alan Bell on Twitter:

Bell also noted that a chunk of the APK file is obfuscated, while another Twitter user, developer Steve Troughton-Smith, asserted that the app also had the ability to background-download APK files.

Whether the app's behaviours were clumsy or a deliberate attempt to harvest user credentials, it violated Google Play's policies and has been dumped. The putative developer's Website, huluwa.org, is also offline at the time of publication. ®


Keep Reading

New Google rules mandate Android 'Poundland' Edition, Go, for sub-2GB RAM phones once Android 11 is out

Chocolate Factory actively pushing lightweight OS on less powerful devices

A lot has changed since Android 11 was but a twinkle in Google's eye – so mobile OS has been delayed a month

'Extra time for you to test,' you lucky, lucky developers

That's infotainment, that's infotainment: Android Automotive OS goes virtual with new reference platform

The screech of brakes and lamplights blinking... Google and pals tackle heterogeneous hardware subsystems

Android user chucks potential $10bn+ sueball at Google over 'spying', 'harvesting data'... this time to build supposed rival to TikTok called 'Shorts'

These are the class-action-suit-joining 'droids lawyers are looking for. (We'll get our coats)

Go Huawei, Android: Chinese telco biz claims it will spread Harmony OS for smartphone to devs come December

Homegrown system – previously a 'lightweight' OS for IoT – punted onto smartphones

Who cares what Apple's about to announce? It owes us a macOS x86 virtual appliance for non-Mac computers

Comment Shift to Arm processors will maroon some users – and Hackintoshes are problematic

You, Apple Mac fan. Put down the homemade oat-milk latte, you need to patch a load of security bugs, too

Patch Thursday is for you, Patch Tuesday is for everyone else

Google promises another low-end Android effort as it buys into Indian mega-carrier Jio Platforms

$4.5bn splash turns out to be first installment in $10bn ‘Digitisation fund’ and development template for new products

Biting the hand that feeds IT © 1998–2020