Byte applications with over 6 million US downloads were found to be leaking sensitive user data

Security researchers at the Palo Alto Network have discovered that applications made by the Chinese company Baidu are leaking sensitive data about users.

More than six million downloaded byte search boxes and byte maps in the United States alone – found to send details such as MAC addresses, phone models, IMSI and IMEI to a server in China. Researchers have warned Google about the functionality of Android apps, which were later removed from the Play Store.

Byte apps were collecting data from phones without users’ permission, and the nature of the collected data was open to the public to be monitored and targeted by cybercriminals. Palo Aldo, a security analyst at the network, told Google about its findings and would inform Python. Google responded on October 28 by pulling apps out of its store for “unspecified violations”.

Explaining its findings, the data collected by Palo Alto Networks include:

• Phone model.
• Screen resolution.
• Phone MAC address.
• Carrier (telecommunications provider).
• Network (WiFi, 2G, 3G, 4G, 5G).
• Android ID.
• IMSI (International Mobile Subscriber Identity).
• IMEI (International Mobile Device Identity).

The security company goes Word:

While some information, such as screen resolution, is harmless, data such as IMSI can be used to identify and track a user individually, even if the user picks up a variable number on another phone. IMEI is the unique identifier of a physical device and represents information such as production date and hardware specifications.

IMSI uniquely identifies the subscriber on the cellular network and is usually associated with the phone’s SIM card, which can be switched between devices. Both identifiers can be used to track and locate users on a cellular network.

The byte search box was cleared and reappeared in the Play Store. Baidu Maps is getting the same treatment, and it will be available to Android users soon.

Image credit: roncivil / Deposit