Home > News

146 Vulnerabilities Found in Preinstalled Android Apps

By Laura Tucker
News Android Vulnerabilities Featured

At this point we seem to have become nearly immune to the knowledge that there are malicious apps on the Google Play store. But what about those apps that are preinstalled on your Android?

The security research firm Kryptowire has found nearly 150 potentially malicious apps preinstalled on Android phones that are cheaply produced. You may think all Androids are the same, but they are not.

Preinstalled App Vulnerabilities

Through research that was funded by the United States Department of Homeland Security, Kryptowire found 146 preinstalled Android apps were secretly recording audio and changing phone settings. Sometimes the apps were even granting themselves the permissions to carry out these tasks.

Having carried out this research nearly every year before, Kryptowire found the vulnerabilities in manufacturer and carrier firmware shipped by 29 manufacturers, though the phone manufacturers were not disclosed. They did this with a new tool that scans firmware and searches for vulnerabilities without a physical phone being required.

Kryptowire CEO Angelos Stavrou believes there needs to be greater accountability on the part of Google. He believes “Google can demand more thorough code analysis and vendor responsibility for their software products that enter the Android ecosystems.”

“Legislators and policy-makers should demand that companies are accountable for putting the security and personal information of end-users at risk.”

News Android Vulnerabilities Phone

As it is, preinstalled apps carry a significantly larger security threat, as they are typically given more freedom than other types of apps to operate on a phone. They can be more difficult to remove as well.

Two years ago Kryptowire exposed similar security threats on Shanghai Adups Technology Android phones. It was discovered that the preinstalled software was sending device data to the company’s server in Shanghai unbeknownst to users. The company has said they resolved the issue last year.

Despite still finding similar vulnerabilities, Stavrou believes there is still some improvement with Google’s overall strategy.

“Securing the software supply chain is a very complex problem, and Google and the security research community are always making advances to address the problem,” he explained.

Android vs. Apple

Maddie Stone, a Google security researcher, said in a Black Hat 2019 presentation that an Android device can have anywhere from 100 to 400 preinstalled apps. If you’re a hacker, she noted, you “only have to convince one company to include your app, rather than thousands of users.”

That makes a lot of sense and is why you don’t find that in Apple. A hacker is not going to convince Apple to include its malicious software on an iPhone, making iPhones more secure for that reason: they’re just one manufacturer.

But if Android phone manufacturers operated the same way, you wouldn’t have all those apps pre-installed and would only have a small number similar to what iPhones include, and it wouldn’t be the same experience. Even though you know Android phones are more vulnerable, will you choose to stick with it as your preferred mobile OS? Tell us in the comments below.

Subscribe to our newsletter!

Our latest tutorials delivered straight to your inbox

Laura Tucker Avatar
Laura Tucker
Laura has spent more than 20 years writing news, reviews, and op-eds, with the majority of those years as an editor as well. She has exclusively used Apple products for the past 35 years. In addition to writing and editing at MTE, she also runs the site’s sponsored review program.

Read next

When the SS Great Eastern laid the first working transatlantic telegraph cable in 1866, a message that had taken ten days by steamship suddenly crossed the ocean in minutes, and the financial markets of London and New York were forced, within a single trading week, to invent the modern concept of synchronised global price.
From below of blue starry sky over radio telescope and trees with leaves
The Big Ear telescope was scanning at 1420.4056 megahertz on the night of 15 August 1977, the exact frequency at which hydrogen atoms vibrate across the universe, because Giuseppe Cocconi and Philip Morrison had argued years earlier that any species trying to be found would broadcast on that channel — and then, for 72 seconds, something did.
In 2016, archaeologists dated two rings of snapped stalagmites in France’s Bruniquel Cave to 176,500 years ago, evidence that Neanderthals had walked 336 metres into darkness with fire and built architecture deep underground long before modern humans reached Europe
Otto von Bismarck was 74 when Germany adopted the world’s first national old-age social insurance program in 1889, setting the pension age at 70 after years of fighting socialists with bans, laws, and a promise few workers would live long enough to use
When cosmonaut Valeri Polyakov stepped out of his Soyuz capsule in March 1995 after 437 consecutive days aboard Mir, doctors recorded him at several centimetres above his pre-flight height, and his spine had become so unaccustomed to gravity that the recovery team carried him to a chair rather than risk the compression of letting him walk.
When Bell Labs engineer Karl Jansky pointed a rotating antenna at the sky in 1932 looking for sources of transatlantic radio static, he kept picking up a faint hiss that peaked every 23 hours and 56 minutes, and he eventually realized he had become the first human to hear the center of the Milky Way.
A contemplative scene with two scientists in a vintage laboratory setting.
When Harvard astronomer Cecilia Payne submitted her 1925 doctoral thesis arguing that the Sun was made almost entirely of hydrogen, the field’s senior figure Henry Norris Russell talked her into adding a line calling the result ‘almost certainly not real,’ and then published the same conclusion himself four years later to widespread acclaim.
When seismic waves from the Chicxulub impact reached what is now North Dakota roughly ten minutes after the asteroid struck, they appear to have triggered a ten-metre standing wave in an inland river that flung fish onto the bank and buried them under glass beads still falling from the sky.