Thousands of top Android apps found engaging in suspicious activities

Google's Android operating system has matured over the past couple of years. Lollipop -- the latest update -- added fresh paint to give the mobile OS more elegance and provided sophisticated encryption options to make things more secure. But in all these years, Google Play Store -- the marquee Android app store -- has largely remained free from any substantial improvement. In the past, we’ve witnessed plenty of cases where prominently showcased apps in Play Store have been found malicious, riddled with adult content, and spying elements. So it didn't come as a big surprise when this past week a new study uncovered many more of such dubious activities. This time, however, we're looking at apps that many of you are likely using on your devices.

Security researchers from Eurecom tested the top apps from all 25 categories -- summing up to about 2,000 apps -- and found that many of these were connecting to tracking and advertisement websites. Furthermore, many of these apps were pinging even more dubious portals. What’s even more striking is that the owners of these devices have no idea about the activities happening behind the curtain.

The team found that these 2,000 apps were connecting to a whopping 250,000 URLs that covered almost 2,000 top-level domains. To give you an example, one of the apps that folks at Eurecom tested was “Music Volume Eq”. A rather popular app with more than 10,000,000 downloads, that lets users adjust the volume. It needs no network access to function, but surprisingly it pings around 2,000 distinct URLs. It's not an isolated case, the team says that about 10 percent of the apps they tested connect to more than 500 distinct URLs. Signal.booster.conchi, Entrainments Quote, Simulateur laser, and The Weather Channel connect to more than 1500 different URLs.

The team also found that about 2.5 percent of these URLs are suspicious while about 2.9 percent are malicious, and 61 percent of the addresses were dubious but couldn’t be flagged as harmful.

The lack of a good safeguard in Android Play Store is evidently making it tough for users to avoid installing apps of dubious origin. “Our results reveal several interesting insights: (i) that a significant number of applications, some highly rated, download an excessive number of advertisements which indicate that users may not be as sensitive to advertisements as anecdotally conjectured; (ii) a large number of applications communicate with a multiplicity of online tracking entities, a fact to which users may not be aware; and (iii) we find some applications communicating with websites that have been deemed malicious by malware detection engines”, the team concludes (PDF).

Are you comfortable with knowing that so many of the popular apps you likely use on your Android device are indulging in dubious activities? Do you think it's time Google took major steps to fix this problem?

Photo credit: Ron Leishman/Shutterstock