As if the Milan-based "offensive technology" company hadn't caused enough harm recently, it has now been revealed that Hacking Team was responsible for a fake news app on Android's Google Play store. This news comes in from Trend Micro whose researchers discovered a sample of the app's code used to evade Google's quality control procedures.
The app, entitled "BeNews" allegedly took influence from a now-obsolete legitimate news source of the same name to appear genuine. Despite Google's developer program policy designed specifically to prevent apps like this, Hacking Team managed to publish BeNews using backdoor exploit tools that take advantage of dynamic loading technologies.
This means that while, on the surface, there are no exploit codes to be discovered by Google in the app, the software is programmed to download and carry out an extension of its code from the Internet after being opened by the end-user.
The backdoor could potentially pose threats for users of Android devices anywhere from 2.2 Froyo to 4.4.4 KitKat with some additional devices also at risk. The mobile spy tool was available on the Google Play store as recently as July 7 and, dubiously enough, provided "detailed instructions on how customers can manipulate the backdoor as well as a ready-made Google Play account they can use".
Fortunately, this app in particular was only downloaded about 50 times, likely due to the ambiguity of its function. Nonetheless, the most alarming part of this story isn't the app itself but the principle behind it. If Hacking Team was able to break into Google Play, especially given its own history of security missteps, there is something to be said about the susceptibility of the Android marketplace. Surely, organizations will be more adamantly precautionary in regards to privacy after this month's exposé.