Sidebar

Exclusive Reports

29
Fri, Mar

Google uncovers Socially Engineered Spyware on Play Store

Tech Security
Typography
  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

Google has detected an app called Tizi on Google Play store that installs spyware on mobile devices with rooting capabilities that could exploit steal sensitive data from popular social media applications.

Tizi is a fully featured backdoor app that had been stealing information from call records and social media apps like Facebook, WhatsApp, Twitter, Viber, Skype, LinkedIn and also take pictures from mobile phones without even displaying them on the screen of the device.

According to a post on Google security blog, the Google Play Protect security team made the discovery in September 2017, when mobile device scans found as app with rooting capabilities that exploited old vulnerabilities.

The post said that an earlier version of Tizi did not have rooting capabilities but it was developed later on and thereafter started stealing sensitive information from devices.

Google has removed the app from Play Store and have notified all known affected devices and suspended the account of the app developer.

According to cybersecurity expert, Jiten Jain "The rooting capabilities grants an app full control of the device. It can bypass all restriction posted on it by Android security system".

The backdoor capability of Tizi was common to commercial spyware, such as recording calls from WhatsApp, Viber, and Skype, sending and receiving SMS messages, and accessing calendar events, call log, contacts, photos, Wi-Fi encryption keys, and a list of all installed apps.

The post said that in and after April 2016, vulnerabilities in devices which could have been affected by Tizi were fixed with new software code.

"If a Tizi app is unable to take control of a device because the vulnerabilities it tries to use are all patched, it will still attempt to perform some actions through the high level of permissions it asks the user to grant to it, mainly around reading and sending SMS messages and monitoring, redirecting, and preventing outgoing phone calls."

BLOG COMMENTS POWERED BY DISQUS