The recent scanning of an app of a cybersecurity group had confirmed that the Chinese-based Baidu Android apps were accessible right at your fingertips through Google Playstore can collect sensitive information from its users. According to the report, the application Baidu Maps and Baidu Search box collect information such as Phone Model, its specification, user’s telecom provider, MAC address or International Mobile Subscriber Identity (IMSI), Android ID, and International Mobile Equipment Identity (IMEI) number. This information is believed when to fall in the adversaries can be able to track the user and further do malicious damage.
Using a specialized application, they were able to track the flaw within Baidu’s Push and Share SDK program in collaboration with Mobtech that also develops its in-house application that is compatible with different social media applications.
Upon receiving the report, Google immediately seized the Baidu android applications and instantly removed it from the Playstore in October after the violation has been confirmed.
Currently, the Baidu Search box is now available again on the store since November 19 while the Baidu Maps still on hiatus until the developer can secure that this information will not be compromised and can submit documents of compliance to the app host. Concerning this report, another app by Baidu called HomeStyler for interior designing was highlighted by the researcher that the app was observed leaking sensitive data is now under review.
An in-depth report believed that Google Playstore is on the top list of app hosts that spread malware on many android devices. Despite its rigorous campaign and filtering of apps to be hosted on their platform, many cybersecurity experts allegedly believed that most of the apps it hosted are injected with malicious code. An independent report confirmed that 67.5% of apps hosted in Google Playstore are allegedly compromised, whereas, from Google’s perspective, their filtering campaign contradicts the report and shows a different lower percentage of possible compromised apps that may have bypassed their security wall.
Users are advised to always check and review apps that they will install on their devices. These include inspecting comments and developer’s authenticity and reviews to ensure apps they want to install are secured and not compromised. Furthermore, check the permission of access you want to give to the app if it’s relevant for the app usage as this permission will become the gateway of these adversaries to infiltrate your device to steal sensitive information.
This has been published to spread awareness of possible intrusion on mobile devices that adversaries may take advantage of through the app even if it is downloaded on legitimate sources. As the current situation shows, many users rely more on mobile devices to do their work and perform a financial transaction, securing our devices should be our utmost priority to guard our assets.
