Popular Android apps expose millions of users to cyber criminals

Hundreds could allow hackers to steal data and remotely install malware on to smartphones

'These vulnerabilities can be exploited to cause severe damage,' say the researchers (Getty)

Hundreds of Google Play apps are potentially exposing Android users to hackers, according to a new study.

University of Michigan researchers used a custom-built tool called OPAnalyzer to scan 24,000 apps, and found 410 that could allow cyber criminals to steal users’ data and remotely install malware onto smartphones.

Several of those apps are extremely popular, having been downloaded by millions of users. One even comes pre-installed on some phones.

The issue concerns unprotected open ports, which are already known to pose a threat to computers.

“An open port (or a listening port) is a communication endpoint for accepting incoming connections in computer networking model, typically used by server applications to handle requests from remote clients,” explains the report.

“However, these ports can also be connected by malicious clients if not carefully protected, exposing potential vulnerability in the server software to remote exploitation.”

The 410 apps pinpointed by the researchers all create open ports on the smartphones they’re installed on, leaving users’ data vulnerable to thieves.

A small-scale scan carried out by the researchers took just two minutes to find 40 mobile devices potentially using the affected apps.

“From the identified vulnerable usage, we discover 410 vulnerable applications with 956 potential exploits in total,” the report reads. “We manually confirmed the vulnerabilities for 57 applications, including popular ones with 10 to 50 million downloads on the official market, and also an app that is pre-installed on some device models.

“These vulnerabilities can be exploited to cause highly severe damage such as remotely stealing contacts, photos, and even security credentials, and also performing sensitive actions such as malware installation and malicious code execution.”

The researchers haven’t named the apps, but say that the vulnerabilities have been reported.