Google Suspends Android Wallpaper Apps

Android wallpaper apps have been acquiring personal information like subscriber identifiers and voicemail numbers.

Wednesday during the Black Hat security conference held in Las Vegas, mobile security firm Lookout--which provides free anti-virus software for the Android, BlackBerry and Windows Mobile platforms--said that a batch of wallpaper applications found on the Android Market were collecting unnecessary user data.

One of the apps in question was created by Jackeey Wallpaper and included familiar, seemingly harmless images based on Star Wars, My Little Pony and more. According to Lookout, the app was downloaded somewhere between 1.1 million to 4.6 million times--the number varies because Android Market apparently doesn't offer precise data. The app didn't throw up any red flags initially because it only asked permission for "phone info."

However it was discovered that the app collected information such as the device’s phone number, subscriber identifier, and the currently entered voicemail number on the phone. It was also reported that the apps passed the information on to a website owned by someone in Shenzhen, China.

"While this sort of data collection from a wallpaper application is certainly suspicious, there’s no evidence of malicious behavior," Lookout said in a blog. "There have been cases in the past on other mobile platforms where well-intentioned developers are simply over-zealous in their data gathering, without having malicious intent."

Lookout also said there was another developer known as iceskysl@1sters! collecting identical information with other wallpaper apps. Lookout believes that the two could possibly be connected, as both developers share the same common code inside a class named "SyncDeviceInfoService."

The suspicious wallpaper apps were discovered as part of Lookout's App Genome Project. As of this writing, a quick search for "Jackeey Wallpaper" on the Android Market provided zero results--apparently the developer name has been changed to "callmejack."

"We’ve been working with Google to investigate these apps and they’re on top of it," Lookout said. Google has supposedly suspended the apps until further investigation.