Contact us today!
(800) 588-4430

Telesys Voice and Data Blog

Telesys Voice and Data has been serving the Dallas/Fort Worth area since 1994, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.

Just Because an App is on the Google Play Store, Doesn’t Mean it’s Safe

Just Because an App is on the Google Play Store, Doesn’t Mean it’s Safe

If your employees are given an Android device to use for work, or if they bring in their own as a part of BYOD, you may want to pay special attention to what follows.

Google has just removed a piece of malware that managed to make its way into the listings of the Google Play Store. Disguised as a strategic card game called “Beaver Gang Counter,” the malware seemed at first glance to be a harmless enough app to download as a way to pass some time every now and then. This impression unfortunately turned out to be inaccurate for a few different reasons.

So Why Was it a Threat?
First, the app itself reportedly was a bit of a one-trick pony, losing any of its entertainment appeal very swiftly. Of course, what does one do with an app that one has grown bored with and no longer wants? One deletes it, to make room for other apps that one will have more use for, but not before the second factor that makes the “harmless” impression inaccurate comes into play.

The disguised malware would specifically target those whom also had Viber, the vastly more popular communications app, installed on their device. Once the Beaver Gang Counter app was installed, the malware would access the directories contained in Viber as well as uploading any of the user’s Viber images to an external website.

Google has since denied Beaver Gang Counter from the Play Store, and thus far it seems that little damage was done. However, the entire situation asks the question: how did this happen?

There were ultimately a number of factors that led to Beaver Gang Counter having the ability to access files belonging to another app - an ability that the Android platform is supposed to block. However, the measures put in place by Android do nothing to prevent the review of data saved on the SD removable storage.

Due to the expectation of inter-device compatibility that comes with SD cards, the inter-app file sharing that Android usually blocks is left unfettered in the SD storage, depending on the permissions granted at install. Therefore, if assigned to SD memory (as it would have been in almost all cases), Beaver Gang Counter could potentially access any and all data saved to the SD - the malware developers had simply chosen to target Viber users specifically.

So What Happened?
However, there’s an excellent case to be made that the app should never have reached the Google Play storefront at all, and that Google’s review process seems to need some work.

Upon opening the app, you are brought to the game’s main menu screen, with the following options: Help, Players, Statistics, and the all-important New Gane. Yes, you read that right. New Gane. There was a spelling mistake, right there on the most important element of the main menu, visible from the download screen itself, that Google either missed or disregarded without digging any deeper.

What Does this Mean for my Business?
While Beaver Gang Counter didn’t target anything that would likely damage a business if the malware infiltrated a business-provided or BYOD-implementing device, it really makes one consider how many other apps may be out there that could potentially cause harm to a business through similar actions. The only truly clear lesson to be learned from this story is that Google isn’t infallible, and so they cannot be relied upon to defend your company from all threats that are sent through their systems. Ultimately, it falls to you to pick up the slack, and so you should implement the following best practices.

  • Steer clear of unknown apps: If nobody is talking about an app, there’s a better chance that it is a less safe option (and that’s the best case scenario). Avoid utilizing unknown and unreviewed apps on business devices. Furthermore, despite their failure to catch Beaver Gang Counter, Google’s marketplaces for apps are still much safer than the unregulated Android marketplace that are out there.
  • Keep important data on your actual device: Clearly, Android prioritizes the protection of data on its native storage over that of data stored on removable media. Therefore, you should keep this in mind as you elect where to store data of different levels of importance, critical files on the device itself.
  • Set terms for employee devices: This will admittedly be simpler to enforce with company-provided devices, as BYOD relies on the employee using their own property and therefore a device that they have control of. While you may disable non-company approved apps in devices provided by the company, you may have to take a few extra steps to implement a BYOD policy. A mandatory security solution may be a fair term for an employee wishing to use their own device, as well as required security best practice training.
  • By implementing these practices, you just may be able to keep an issue like this one from affecting your company sometime down the line.

For more IT news and best practices, be sure to keep checking back on our blog, and be sure to reach out to Telesys Voice and Data if you have any questions about your own security. Give us a call at (800) 588-4430.


No comments yet
Already Registered? Login Here
Wednesday, 29 January 2020
If you'd like to register, please fill in the username, password and name fields.

Captcha Image

Free Consultation

Sign up today for a
FREE Network Consultation

How secure is your IT infrastructure?
Let us evaluate it for free!

Sign up Now!

Free Consultation

Tag Cloud

Security Tip of the Week Technology Cloud Business Computing Best Practices Hackers Malware Privacy Email Business Productivity Hosted Solutions Microsoft Network Security Software Internet IT Services Computer Windows 10 Productivity Managed Service Provider Backup Data Backup Ransomware Innovation Mobile Devices Business Continuity Smartphone Outsourced IT Hardware Efficiency Upgrade Google Data Android User Tips Data Recovery Disaster Recovery Social Media Managed IT services Browser Communication IT Support Workplace Tips IT Support Small Business Business Management Cloud Computing Managed IT Services Data Management Smartphones App Office Remote Monitoring Phishing Miscellaneous Server Holiday Microsoft Office Network Internet of Things Facebook VoIP Paperless Office communications WiFi Office 365 Cybersecurity Windows Password Save Money Encryption Spam Passwords Artificial Intelligence Gmail Big Data Tech Term Saving Money Robot Apps Hosted Solution Recovery Customer Relationship Management Collaboration Windows 10 Employer-Employee Relationship Document Management Risk Management Unified Threat Management Bandwidth Firewall Content Filtering Government Remote Computing Money Work/Life Balance Downtime Wi-Fi Managed IT Infrastructure Office Tips Chrome Windows 7 Tip of the week Analytics Vendor Management Apple Avoiding Downtime Word Hacker Customer Service Mobile Device Management Operating System Compliance How To Virtual Reality Managed Service Training Mobile Device Antivirus SaaS Presentation Redundancy Business Growth BYOD Social Data loss Project Management Website BDR Applications Outlook Business Technology Software as a Service Telephone Systems Two-factor Authentication File Sharing Settings Health The Internet of Things Automation Going Green Computers Vulnerability Alert Hacking Help Desk Printing Mobile Computing Data storage Data Security Tech Support Computing Education Healthcare IT Management Cybercrime Analyitcs IT solutions Safety Regulations Wireless Technology Tablet Upgrades Wireless Automobile Net Neutrality Budget Specifications Proactive End of Support Smart Technology Mouse Remote Monitoring and Management HIPAA YouTube Unified Communications User Router Mobile Security Legal Display LiFi Retail Twitter Best Practice Politics Monitors Lithium-ion battery Patch Management Travel Solid State Drive Identity Theft Google Drive Business Owner Scam Websites Physical Security Augmented Reality Taxes Access Control Marketing IBM Running Cable Botnet VPN Assessment Samsung Competition Server Management Licensing Bring Your Own Device Search Virtual Private Network Meetings Consultation Digital Payment Sports Storage Information Technology IT service Maintenance Cortana Laptops Computer Care Humor Virtualization Administration Point of Sale Corporate Profile Permissions Typing Drones Address Cost Management Active Directory Proactive IT Quick Tips Flexibility Google Calendar Buisness Troubleshooting Remote Worker Error History Fort Worth IT WannaCry Fraud Cryptocurrency Knowledge Hard Drive Windows Server IT Consulting MSP Time Management Operations Electronic Health Records Legislation Phone System Mobility Social Networking Professional Services Cabling DFW IT Service Web Server Bitcoin Update Staffing Experience Recycling User Management Data Breach Network Management Wearable Technology Cyberattacks 3D Printing Motherboard Virtual Assistant Administrator Cameras VoIP Internet Exlporer Windows 8 Chromebook GPS Management Batteries Domains Technology Laws Touchscreen Bookmarks Law Enforcement Google Maps Network Congestion Unsupported Software 5G Entrepreneur Voice over Internet Protocol Disaster Distributed Denial of Service CCTV Digital Emoji Tracking data services Application Lenovo Enterprise Resource Planning Remote Work Public Speaking Unified Threat Management WPA3 IT Technicians Favorites Gadget Technology Tips Users Mobile Data iPhone Hacks Shortcut Modem Uninterrupted Power Supply Managed IT Service Spyware Hotspot User Error Superfish Mobile File Management business communications systems Fleet Tracking Mirgation Conferencing Comparison Current Events Cookies Manufacturing Break Fix Telephone G Suite How To Language Processors Printer Laptop Hard Drives Company Culture Internet Protocol Asset Tracking Heating/Cooling Migration Employees Black Friday Virtual Desktop Nanotechnology Gadgets Motion Sickness Hard Disk Drive Dark Web Vulnerabilities Mobile VoIP Firefox Computing Infrastructure Supercomputer Halloween Google Docs Refrigeration Networking VoIP streamlines Remote Workers PowerPoint Servers Chatbots Zero-Day Threat Cyber Monday Writing Data Warehousing Deep Learning Personal Information Fun IoT Proactive Maintenance Geography Windows Server 2008 IT Consultant Alerts IT Budget SharePoint Scary Stories Consumers business network infrastructure Information Identity Backup and Disaster Recovery Machine Learning flu season Social Engineering Microsoft Excel Computer Repair Utility Computing Processor Techology Cables Co-Managed IT Cleaning Cooperation Notifications Downloads Undo eWaste IP Address Monitoring Statistics RMM Relocation Software Tips Fort Worth Blockchain Alt Codes Electronic Medical Records Google Wallet Mail Merge IT Sevices Webcam Disaster Resistance Wires Business Telephone Staff Crowdsourcing Multi-Factor Security Dark Data Environment Mobile Office Consulting Bluetooth Procurement Private Cloud flu shot

Top Blog

Don't be Afraid to Replace Got an older PC that's causing you a lot of issues? Older technology is typically more expensive to run, and after a while, it's cheaper to simply buy a new desktop than it is to continue pouring money into something that always seems broken. It's a great time to buy wo...