22 apps with 2 million+ Google Play downloads had a malicious backdoor

arstechnica.com...

Just a heads uo for everybody in case anyone may have downloaded any of these.

The 22 apps listed by Sophos are:

com.sparkle.flashlight Sparkle FlashLight
com.mobilebt.snakefight Snake Attack
com.mobilebt.mathsolver Math Solver
com.mobilebt.shapesorter ShapeSorter
com.takatrip.androidTak A Trip
com.magnifeye.android Magnifeye
com.pesrepi.joinup Join Up
com.pesrepi.zombiekiller Zombie Killer
com.pesrepi.spacerocket Space Rocket
com.pesrepi.neonpong Neon Pong
dapp.mobile.justflashlight Just Flashlight
com.mobile.tablesoccer Table Soccer
com.mobile.cliffdiver Cliff Diver
com.mobile.boxstack Box Stack
cnet.kanmobi.jellysliceJelly Slice
com.maragona.akblackjackAK Blackjack
com.maragona.colortiles Color Tiles
com.beacon.animalmatch Animal Match
com.beacon.roulettemania Roulette Mania
com.atry.hexafall HexaFal
com.atry.hexablocks HexaBlocks
com.atry.pairzapPairZap

a reply to: dug88

it never ceases to amaze me - the ammount of utter crap people have on thier mobile phones

a reply to: ignorant_ape
I bet half of them were not even intentional. Probably some really bad programmer just copy pasted some code into their application to hurry up their job rather than coding it all themselves. Then who ever originated the code and gave it out 'for free" collected all of that information and sold it.

originally posted by: dubiousatworst
a reply to: ignorant_ape
I bet half of them were not even intentional. Probably some really bad programmer just copy pasted some code into their application to hurry up their job rather than coding it all themselves. Then who ever originated the code and gave it out 'for free" collected all of that information and sold it.

This is exactly why I hate using _javascript libraries and prefer to work with my own scripts. I've seen other people's code and some code is terrifying, but nothing touches what you discover when you start working with Google analytics.

Easter egg comments from other developers are hilarious though. My personal favourite is "See this here? We don't need it. It's a complete waste, so why is it here? Because my boss is an ID-10-t". It hits two notes...dumbass bosses and useless code.

a reply to: wtfatta

The comment tags are almost always a good read.