Columbia Engineering Team Finds Thousands of Secret Keys in Android Apps

June 18, 2014

In a paper presented—and awarded the prestigious Ken Sevcik Outstanding Student Paper Award—at the ACM SIGMETRICS conference on June 18, Jason Nieh, professor of computer science at Columbia Engineering, and PhD candidate Nicolas Viennot reported that they have discovered a crucial security problem in Google Play, the official Android app store.

Jason Nieh and Nicolas Viennot

“Google Play has more than one million apps and over 50 billion app downloads, but no one reviews what gets put into Google Play—anyone can get a $25 account and upload whatever they want. Very little is known about what’s there at an aggregate level,” says Nieh, who is also a member of the University’s Institute for Data Sciences and Engineering’s Cybersecurity Center. “Given the huge popularity of Google Play and the potential risks to millions of users, we thought it was important to take a close look at Google Play content.”

Read more: http://engineering.columbia.edu/columbia-engineering-team-finds-thousands-secret-keys-android-apps-0

-- Columbia Engineering 2014-06-18

"Other findings of the research include:

• showing that roughly a quarter of all Google Play free apps are clones: these apps are duplicative of other apps already in Google Play" - astounding 555

......while the worst rated, still had more than a million downloads: it purports to be a scale that measures the weight of an object placed on the touchscreen of an Android device, but instead displays a random number for the weight.

......while the worst rated, still had more than a million downloads: it purports to be a scale that measures the weight of an object placed on the touchscreen of an Android device, but instead displays a random number for the weight.

Pity. That would have been very handy to weigh airmail letters.