WSJ: Google removes 10+ mobile apps after researchers find data-harvesting malware tied to US defense contractor

“Google has yanked dozens of apps from its Google Play store after determining that they include a software element that surreptitiously harvests data,” reported the Wall Street Journal.

According to the WSJ, a Panamanian company named Measurement Systems S. de R.L. wrote the code. Two researchers — Serge Egelman from the University of California, Berkeley, and Joel Reardon from the University of Calgary — first identified the code.

Pixalate also worked with the WSJ to analyze several apps suspected of harvesting consumer data. The WSJ wrote:

“The Measurement Systems SDK was in other popular Android consumer apps, including weather apps, QR code scanners and the highway-radar detection app. Pixalate, a third-party company that monitors app analytics, provided the Journal with data about the geographical distribution of users of apps running Measurement Systems. One weather app that the code was running inside was particularly popular in Iran.”

Google said it delisted the apps “for collecting users’ data outside the rules that Google has established,” per the WSJ, and that “the apps could be relisted if the software was removed.”

Publishing Pixalate’s research about apps suspected of data harvesting, related to the WSJ’s article

In this blog, Pixalate is publishing the research it shared with the WSJ. Below are a subset of the apps the Pixalate data science team reviewed as well as Pixalate’s key findings.

See the full data table here.

Al Quran Mp3 – 50 Reciters & Translation Audio

• App ID: com.quranmp3ramadan.readquran
• Country of Registry: India
• Countries With Highest User Reach (Per Pixalate): N/A
• Status as of 2022/03/31: Delisted
• Delisted Date (if identified by Pixalate): 2022/03/29
• Programmatic Ads (per Pixalate): No
• Permissions Requested: android.permission.INTERNET,android.permission.ACCESS_NETWORK_STATE,android.permission.READ_EXTERNAL_STORAGE,android.permission.WRITE_EXTERNAL_STORAGE,android.permission.RECEIVE_BOOT_COMPLETED,android.permission.ACCESS_COARSE_LOCATION,android.permission.ACCESS_FINE_LOCATION,android.permission.FOREGROUND_SERVICE,android.permission.WAKE_LOCK,android.permission.GET_ACCOUNTS,com.google.android.c2dm.permission.RECEIVE,com.myntra.android.permission.C2D_MESSAGE,android.permission.VIBRATE,android.permission.ACCESS_WIFI_STATE,android.permission.CHANGE_WIFI_STATE,com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE,android.permission.CHANGE_NETWORK_STATE

Al-Moazin Lite (Prayer Times)

• App ID: com.parfield.prayers.lite
• Country of Registry: Egypt
• Countries With Highest User Reach (Per Pixalate): Jordan, Egypt, Lebanon
• Status as of 2022/03/31: Delisted
• Delisted Date (if identified by Pixalate): 2022/03/28
• Programmatic Ads (per Pixalate): Yes
• Permissions Requested: android.permission.RECEIVE_BOOT_COMPLETED,android.permission.INTERNET,android.permission.ACCESS_COARSE_LOCATION,android.permission.ACCESS_FINE_LOCATION,android.permission.ACCESS_BACKGROUND_LOCATION,android.permission.ACCESS_NETWORK_STATE,android.permission.ACCESS_WIFI_STATE,android.permission.CHANGE_WIFI_MULTICAST_STATE,android.permission.READ_PHONE_STATE,android.permission.VIBRATE,android.permission.WAKE_LOCK,android.permission.READ_EXTERNAL_STORAGE,android.permission.ACCESS_NOTIFICATION_POLICY,android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS,android.permission.SCHEDULE_EXACT_ALARM,android.permission.FOREGROUND_SERVICE,android.permission.READ_CALENDAR,android.permission.WRITE_CALENDAR,android.permission.USE_FULL_SCREEN_INTENT,com.android.vending.CHECK_LICENSE,com.android.vending.BILLING,com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE,com.google.android.gms.permission.AD_ID

Audiosdroid Audio Studio DAW

• App ID: com.audiosdroid.audiostudio
• Country of Registry: Estonia
• Countries With Highest User Reach (Per Pixalate): Lao People’s Democratic Republic, New Caledonia, Hungary
• Status as of 2022/03/31: Active
• Delisted Date (if identified by Pixalate): 2022/03/29
• Programmatic Ads (per Pixalate): Yes
• Permissions Requested: android.permission.ACCESS_NETWORK_STATE,android.permission.GET_ACCOUNTS,android.permission.WRITE_EXTERNAL_STORAGE,android.permission.RECORD_AUDIO,android.permission.WAKE_LOCK,android.permission.INTERNET,android.permission.ACCESS_NETWORK_STATE,android.permission.ACCESS_WIFI_STATE,android.permission.CHANGE_WIFI_STATE,android.permission.RECEIVE_BOOT_COMPLETED,android.permission.SYSTEM_ALERT_WINDOW,com.android.browser.permission.READ_HISTORY_BOOKMARKS,com.android.browser.permission.WRITE_HISTORY_BOOKMARKS,com.android.launcher.permission.INSTALL_SHORTCUT,com.android.launcher.permission.UNINSTALL_SHORTCUT,android.permission.ACCESS_COARSE_LOCATION,android.permission.ACCESS_FINE_LOCATION,android.permission.BLUETOOTH,android.permission.BLUETOOTH_ADMIN,android.permission.READ_PHONE_STATE,com.google.android.gms.permission.ACTIVITY_RECOGNITION,com.android.vending.BILLING,com.samsung.android.providers.context.permission.WRITE_USE_APP_FEATURE_SURVEY,android.permission.ACCESS_BACKGROUND_LOCATION,android.permission.CAMERA,android.permission.FOREGROUND_SERVICE,android.permission.CHANGE_NETWORK_STATE,com.google.android.c2dm.permission.RECEIVE,com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE,android.permission.QUERY_ALL_PACKAGES

Full Quran MP3

• App ID: com.quranmp3.readquran
• Country of Registry: India
• Countries With Highest User Reach (Per Pixalate): N/A
• Status as of 2022/03/31: Delisted
• Delisted Date (if identified by Pixalate): 2022/03/21
• Programmatic Ads (per Pixalate): No
• Permissions Requested: android.permission.INTERNET,android.permission.ACCESS_NETWORK_STATE,android.permission.READ_EXTERNAL_STORAGE,android.permission.WRITE_EXTERNAL_STORAGE,android.permission.RECEIVE_BOOT_COMPLETED,android.permission.ACCESS_COARSE_LOCATION,android.permission.ACCESS_FINE_LOCATION,android.permission.FOREGROUND_SERVICE,android.permission.WAKE_LOCK,android.permission.GET_ACCOUNTS,com.google.android.c2dm.permission.RECEIVE,com.myntra.android.permission.C2D_MESSAGE,android.permission.VIBRATE,android.permission.ACCESS_WIFI_STATE,android.permission.CHANGE_WIFI_STATE,com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE,android.permission.CHANGE_NETWORK_STATE

Handcent Next SMS-Text

• App ID: com.handcent.app.nextsms
• Country of Registry: China
• Countries With Highest User Reach (Per Pixalate): United States, Belgium, Denmark
• Status as of 2022/03/31: Active
• Delisted Date (if identified by Pixalate): 2022/03/29
• Programmatic Ads (per Pixalate): Yes
• Permissions Requested: android.permission.REQUEST_DELETE_PACKAGES,android.permission.ACCESS_FINE_LOCATION,android.permission.ACCESS_COARSE_LOCATION,android.permission.FOREGROUND_SERVICE,android.permission.CAMERA,android.permission.SYSTEM_ALERT_WINDOW,android.permission.SYSTEM_OVERLAY_WINDOW,android.permission.RECEIVE_BOOT_COMPLETED,android.permission.CALL_PHONE,android.permission.READ_CONTACTS,android.permission.WRITE_CONTACTS,android.permission.RECEIVE_SMS,android.permission.RECEIVE_MMS,android.permission.SEND_SMS,android.permission.VIBRATE,android.permission.INTERNET,android.permission.READ_SMS,android.permission.WRITE_SMS,android.permission.ACCESS_NETWORK_STATE,android.permission.CHANGE_NETWORK_STATE,android.permission.READ_PHONE_STATE,android.permission.WAKE_LOCK,android.permission.DISABLE_KEYGUARD,android.permission.GET_TASKS,android.permission.WRITE_EXTERNAL_STORAGE,android.permission.SET_WALLPAPER,android.permission.BROADCAST_STICKY,android.permission.INSTALL_DRM,android.permission.READ_SETTINGS,android.permission.KILL_BACKGROUND_PROCESSES,android.permission.RESTART_PACKAGES,jp.co.sharp.android.permission.GET_LIMIT_STATUS,com.yahoo.mobile.client.android.permissions.YAHOO_INTER_APP,android.permission.RECORD_AUDIO,android.permission.ACCESS_WIFI_STATE,android.permission.CHANGE_WIFI_STATE,com.android.vending.BILLING,com.htc.launcher.permission.UPDATE_SHORTCUT,com.sonyericsson.home.permission.BROADCAST_BADGE,com.sonymobile.home.permission.PROVIDER_INSERT_BADGE,com.huawei.android.launcher.permission.CHANGE_BADGE,com.huawei.android.launcher.permission.READ_SETTINGS,com.huawei.android.launcher.permission.WRITE_SETTINGS,android.permission.READ_EXTERNAL_STORAGE,com.android.launcher.permission.INSTALL_SHORTCUT,com.android.launcher.permission.UNINSTALL_SHORTCUT,com.android.launcher.permission.READ_SETTINGS,com.android.launcher.permission.WRITE_SETTINGS,com.android.launcher2.permission.READ_SETTINGS,com.android.launcher2.permission.WRITE_SETTINGS,com.android.launcher3.permission.READ_SETTINGS,com.android.launcher3.permission.WRITE_SETTINGS,com.google.android.launcher.permission.READ_SETTINGS,com.google.android.launcher.permission.WRITE_SETTINGS,org.adw.launcher.permission.READ_SETTINGS,org.adw.launcher.permission.WRITE_SETTINGS,com.htc.launcher.permission.READ_SETTINGS,com.htc.launcher.permission.WRITE_SETTINGS,com.qihoo360.launcher.permission.READ_SETTINGS,com.qihoo360.launcher.permission.WRITE_SETTINGS,com.lge.launcher.permission.READ_SETTINGS,com.lge.launcher.permission.WRITE_SETTINGS,net.qihoo.launcher.permission.READ_SETTINGS,net.qihoo.launcher.permission.WRITE_SETTINGS,org.adwfreak.launcher.permission.READ_SETTINGS,org.adwfreak.launcher.permission.WRITE_SETTINGS,org.adw.launcher_donut.permission.READ_SETTINGS,org.adw.launcher_donut.permission.WRITE_SETTINGS,com.huawei.launcher2.permission.READ_SETTINGS,com.huawei.launcher2.permission.WRITE_SETTINGS,com.huawei.launcher3.permission.READ_SETTINGS,com.huawei.launcher3.permission.WRITE_SETTINGS,com.fede.launcher.permission.READ_SETTINGS,com.fede.launcher.permission.WRITE_SETTINGS,com.sec.android.app.twlauncher.settings.READ_SETTINGS,com.sec.android.app.twlauncher.settings.WRITE_SETTINGS,com.samsung.android.launcher.permission.READ_SETTINGS,com.samsung.android.launcher.permission.WRITE_SETTINGS,com.anddoes.launcher.permission.READ_SETTINGS,com.anddoes.launcher.permission.WRITE_SETTINGS,com.tencent.qqlauncher.permission.READ_SETTINGS,com.tencent.qqlauncher.permission.WRITE_SETTINGS,com.android.mylauncher.permission.READ_SETTINGS,com.android.mylauncher.permission.WRITE_SETTINGS,com.ebproductions.android.launcher.permission.READ_SETTINGS,com.ebproductions.android.launcher.permission.WRITE_SETTINGS,com.oppo.launcher.permission.READ_SETTINGS,com.oppo.launcher.permission.WRITE_SETTINGS,com.lenovo.launcher.permission.READ_SETTINGS,com.lenovo.launcher.permission.WRITE_SETTINGS,telecom.mdesk.permission.READ_SETTINGS,telecom.mdesk.permission.WRITE_SETTINGS,dianxin.permission.ACCESS_LAUNCHER_DATA,android.permission.USE_FINGERPRINT,android.permission.BLUETOOTH,android.permission.BLUETOOTH_ADMIN,com.samsung.accessory.permission.ACCESSORY_FRAMEWORK,com.samsung.android.providers.context.permission.WRITE_USE_APP_FEATURE_SURVEY,com.samsung.WATCH_APP_TYPE.Companion,com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE,com.google.android.c2dm.permission.RECEIVE,com.handcent.app.nextsms.permission.C2D_MESSAGE,com.handcent.app.nextsms.permission.C2D_MESSAGE

Qibla Compass – Ramadan 2022

• App ID: com.qiblafinder.prayertime.hijricalendar
• Country of Registry: India
• Countries With Highest User Reach (Per Pixalate): N/A
• Status as of 2022/03/31: Active
• Delisted Date (if identified by Pixalate): N/A
• Programmatic Ads (per Pixalate): No
• Permissions Requested: android.permission.FOREGROUND_SERVICE,android.hardware.location.gps,android.permission.INTERNET,android.permission.VIBRATE,android.permission.ACCESS_COARSE_LOCATION,android.permission.ACCESS_FINE_LOCATION,android.permission.ACCESS_NETWORK_STATE,android.permission.ACCESS_WIFI_STATE,android.permission.CHANGE_WIFI_STATE,com.google.android.gms.permission.ACTIVITY_RECOGNITION,android.permission.RECEIVE_BOOT_COMPLETED,android.permission.READ_EXTERNAL_STORAGE,android.permission.WRITE_EXTERNAL_STORAGE,android.permission.WAKE_LOCK,android.permission.GET_TASKS,android.permission.SYSTEM_ALERT_WINDOW,android.permission.CHANGE_WIFI_MULTICAST_STATE,com.google.android.c2dm.permission.RECEIVE,android.permission.CHANGE_NETWORK_STATE,com.google.android.gms.permission.AD_ID,com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE,com.qiblafinder.prayertime.hijricalendar.permission.C2D_MESSAGE,com.qiblafinder.prayertime.hijricalendar.permission.C2D_MESSAGE

QR & Barcode Scanner

• App ID: com.gamma.scan
• Country of Registry: China
• Countries With Highest User Reach (Per Pixalate): Burundi, Panama, Bosnia & Herzegovina
• Status as of 2022/03/31: Active
• Delisted Date (if identified by Pixalate): N/A
• Programmatic Ads (per Pixalate): Yes
• Permissions Requested: android.permission.CAMERA,android.permission.INTERNET,android.permission.ACCESS_NETWORK_STATE,android.permission.ACCESS_WIFI_STATE,android.permission.CHANGE_WIFI_STATE,android.permission.CHANGE_WIFI_MULTICAST_STATE,android.permission.VIBRATE,android.permission.READ_EXTERNAL_STORAGE,android.permission.WRITE_EXTERNAL_STORAGE,android.permission.FLASHLIGHT,android.permission.WAKE_LOCK,com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE,android.permission.RECEIVE_BOOT_COMPLETED

Simple weather & clock widget

• App ID: net.difer.weather
• Country of Registry: Poland
• Countries With Highest User Reach (Per Pixalate): Iran, Kazakhstan, S. Korea
• Status as of 2022/03/31: Active
• Delisted Date (if identified by Pixalate): N/A
• Programmatic Ads (per Pixalate): Yes
• Permissions Requested: android.permission.INTERNET,android.permission.ACCESS_NETWORK_STATE,android.permission.ACCESS_WIFI_STATE,android.permission.CHANGE_WIFI_MULTICAST_STATE,android.permission.ACCESS_COARSE_LOCATION,android.permission.ACCESS_FINE_LOCATION,android.permission.ACCESS_BACKGROUND_LOCATION,android.permission.RECEIVE_BOOT_COMPLETED,android.permission.FOREGROUND_SERVICE,android.permission.QUERY_ALL_PACKAGES,android.permission.READ_PHONE_STATE,android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS,com.sec.android.app.clockpackage.permission.READ_ALARM,oppo.permission.OPPO_COMPONENT_SAFE,com.huawei.permission.external_app_settings.USE_COMPONENT,com.google.android.gms.permission.AD_ID,android.permission.READ_EXTERNAL_STORAGE,android.permission.CHANGE_WIFI_STATE,android.permission.WAKE_LOCK,com.google.android.c2dm.permission.RECEIVE,com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE,com.android.vending.BILLING,android.permission.BROADCAST_STICKY,com.hihonor.permission.MANAGE_FOLD_SCREEN,com.hihonor.permission.MANAGE_FOLD_SCREEN_PRIVILEGED

Smart Kit 360

• App ID: com.kafuiutils
• Country of Registry: Ghana
• Countries With Highest User Reach (Per Pixalate): Colombia, Indonesia, Mexico
• Status as of 2022/03/31: Delisted
• Delisted Date (if identified by Pixalate): 2022/03/09
• Programmatic Ads (per Pixalate): Yes
• Permissions Requested: android.permission.CAMERA,android.permission.READ_CONTACTS,android.permission.WRITE_CONTACTS,android.permission.ACCESS_FINE_LOCATION,android.permission.ACCESS_COARSE_LOCATION,android.permission.RECORD_AUDIO,android.permission.READ_PHONE_STATE,android.permission.WRITE_EXTERNAL_STORAGE,android.permission.READ_EXTERNAL_STORAGE,android.permission.FOREGROUND_SERVICE,com.kafuiutils.permission.MAPS_RECEIVE,android.permission.FLASHLIGHT,android.permission.VIBRATE,android.permission.ACCESS_LOCATION_EXTRA_COMMANDS,android.permission.WRITE_SETTINGS,android.permission.WAKE_LOCK,android.permission.INTERNET,android.permission.ACCESS_NETWORK_STATE,android.permission.CHANGE_WIFI_STATE,android.permission.ACCESS_WIFI_STATE,android.permission.SYSTEM_ALERT_WINDOW,android.permission.GET_TASKS,android.permission.ACTIVITY_RECOGNITION,android.permission.CHANGE_WIFI_MULTICAST_STATE,android.permission.ACCESS_NOTIFICATION_POLICY,android.permission.CHANGE_NETWORK_STATE,android.permission.MODIFY_PHONE_STATE,android.permission.UPDATE_DEVICE_STATS,android.permission.DEVICE_POWER,android.permission.BLUETOOTH_PRIVILEGED,android.permission.WRITE_SECURE_SETTINGS,android.permission.BIND_REMOTEVIEWS,android.permission.MODIFY_AUDIO_SETTINGS,android.permission.BATTERY_STATS,android.permission.BLUETOOTH_ADMIN,android.permission.BLUETOOTH,android.permission.READ_SYNC_SETTINGS,android.permission.WRITE_SYNC_SETTINGS,android.permission.RECEIVE_BOOT_COMPLETED,android.permission.KILL_BACKGROUND_PROCESSES,android.permission.CLEAR_APP_CACHE,com.android.browser.permission.WRITE_HISTORY_BOOKMARKS,android.permission.RESTART_PACKAGES,android.permission.GET_PACKAGE_SIZE,com.google.android.gms.permission.ACTIVITY_RECOGNITION,com.android.browser.permission.READ_HISTORY_BOOKMARKS,com.android.launcher.permission.INSTALL_SHORTCUT,com.google.android.providers.gsf.permission.READ_GSERVICES,com.kafuiutils.permission.MAPS_RECEIVE,com.kafuiutils.timezones.permission.WRITE_APP_DATA

Speed Camera Radar

• App ID: com.lelic.speedcam
• Country of Registry: United States
• Countries With Highest User Reach (Per Pixalate): Thailand, Saudi Arabia, India
• Status as of 2022/03/31: Active
• Delisted Date (if identified by Pixalate): N/A
• Programmatic Ads (per Pixalate): Yes
• Permissions Requested: com.lelic.speedcam.permission.MAPS_RECEIVE,android.permission.FOREGROUND_SERVICE,android.permission.BLUETOOTH,android.permission.INTERNET,com.google.android.providers.gsf.permission.READ_GSERVICES,android.permission.ACCESS_NETWORK_STATE,android.permission.ACCESS_FINE_LOCATION,android.permission.ACCESS_COARSE_LOCATION,android.permission.ACCESS_BACKGROUND_LOCATION,android.permission.VIBRATE,android.permission.WAKE_LOCK,android.permission.SYSTEM_ALERT_WINDOW,android.permission.ACCESS_WIFI_STATE,android.permission.RECEIVE_BOOT_COMPLETED,android.permission.WRITE_EXTERNAL_STORAGE,android.permission.READ_PHONE_STATE,android.permission.READ_EXTERNAL_STORAGE,android.permission.CHANGE_WIFI_MULTICAST_STATE,android.permission.FLASHLIGHT,com.google.android.gms.permission.ACTIVITY_RECOGNITION,com.android.vending.BILLING,com.google.android.c2dm.permission.RECEIVE,com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE,com.lelic.speedcam.permission.MAPS_RECEIVE

WiFi Mouse (remote link control PC)

• App ID: com.necta.wifimousefree
• Country of Registry: United Kingdom
• Countries With Highest User Reach (Per Pixalate): Costa Rica, Switzerland, S. Africa
• Status as of 2022/03/31: Active
• Delisted Date (if identified by Pixalate): N/A
• Programmatic Ads (per Pixalate): Yes
• Permissions Requested: android.permission.INTERNET,android.permission.VIBRATE,android.permission.CHANGE_WIFI_STATE,android.permission.ACCESS_WIFI_STATE,com.android.vending.BILLING,android.permission.ACCESS_NETWORK_STATE,android.permission.RECEIVE_BOOT_COMPLETED,android.permission.WAKE_LOCK,android.permission.CHANGE_WIFI_MULTICAST_STATE,android.permission.TRANSMIT_IR,com.google.android.c2dm.permission.RECEIVE,com.google.android.gms.permission.AD_ID,android.permission.FOREGROUND_SERVICE

Explore Publisher Trust Indexes to find more insights about mobile and CTV apps.