A seemingly innocuous wallpaper app for Android phones is busy stripping personal data and sending it off to a Chinese server.
The One-Piece Wallpapers app, by Jackeey Wallpaper, allows the downloader to personalise the phone's background wallpaper. Ready-made wallpapers include My Little Pony and Star Wars themes.
In the background, the app collects the users phone number, subscriber identity and voicemail password. These are then dispatched to a server at www.imnet.us, housed in Shenzhen, China.
What the recipients will do with this data is not known, but it could be a proof of concept app which is a precursor of more serious exploits in the future.
Google vice president and Android co-founder Andy Rubin revealed recently 160,000 Android devices are activated daily. Exact download figures for the rogue app are not known but are believed to run into millions.
The exploit was uncovered by US security specialist Lookout, which is compiling the App Genome Project, a web site aiming to uncover apps with malicious code hidden inside.
Android apps are not screened for reliability and potential flaws in the way that iPhone apps are. Anyone can publish Android programs but the iTunes vetting process guards the Apple apps store.
This should make iPhone apps more trustworthy but data so far gathered by the Genome Project suggests that these programs are no more trustworthy than their Android equivalents. In fact, the Lookout data suggests that nearly twice as many free apps have the capability to access user's contact data on the iPhone 14 per cent compared with Android eight per cent.
A recent iPhone exploit involved an app called Handy Light which blanked the screen with a chosen colour to turn the phone into a low-powered flashlight.
Inside, the app was code that turned the phone into a 3G modem. This allowed users to surf the web from their computer through the iPhone for free. Not an illegal act but, in the US, AT&T would normally charge an extra $20 (12.80) per month.
