This Chinese company is secretly behind 24 popular apps seeking dangerous permissions

Shenzhen HAWK Internet Co., Ltd is a Chinese company that’s secretly developing 24 popular apps, totaling more than 382 million installs, with some apps containing malware and rogueware, and often participating in unethical practices.

Update (February 4): after our story was published, Zak Doffman at Forbes got in contact with Google, which swiftly removed all 24 apps in the Shenzhen network from the Play store. Google responded that they take reports of security and privacy violations seriously. “If we find behavior that violates our policies, we take action.” 

Update (February 5): Shenzhen Hawk’s mega parent company, TCL Corporation, has now responded, claiming that they understand Google’s actions in removing all of the Shenzhen apps and are “actively working with them to better understand their concerns.” They are also planning on hiring an outside security consultant that will audit each of their apps to offer their customers “peace of mind and trust”. 

When we analyzed the 23 companies secretly behind 100+ VPN products, we first saw the developer Hi Security pop up, which had 3 VPN products under its name. Then, when we analyzed the amount of dangerous permissions popular free antivirus apps were requesting, Hi Security popped up again.

Our interests piqued, we dug further and discovered something startling:

Chinese company called Shenzhen HAWK is secretly behind not just the app developer Hi Security, but also 4 other app developers, for a total of 24 apps with 382 million combined installs. Some of these apps are known for containing malware and rogueware.

First, there’s the malware-infected Weather Forecast app that harvested millions of users’ data and sent that to a server in China. The app also subscribed users to premium phone numbers, leading to large charges on those users’ phone bills. To make matters worse, the app would launch hidden browser windows and click on ads from certain web pages.

Recommended read: Celo VPN review

In another case, the Indian government in 2017 also warned its army and paramilitary members to delete Virus Cleaner from their phones because they were identified as being spyware or other malware. In 2018, default apps on Alcatel phones, developed by Shenzhen HAWK, were replaced by adware-riddled apps, frustrating users with loads of advertisements.

All of these affected apps, by the way, are still available to download on Google Play. Our research has uncovered that they’re also asking for a huge amount of dangerous permissions, potentially putting users’ private data at risk. These dangerous permissions include the ability to make calls, take pictures and record video, record audio, and much more.

Because Google has so far failed to remove these apps from the Play store, we recommend users take matters into their own hands and question whether they need these apps at all. If they provide no real benefit, we recommend deleting them from your phone as soon as possible.

Shenzhen HAWK, TCL and China

On their company page, Shenzhen HAWK lists 13 apps as their products:

Included on their page are these apps and the names of their developers listed in Google Play:

1. Super Cleaner developed by Hawk App
2. Hi Security developed by Hi Security
3. Candy developed by ViewYeah Studio
4. Super Battery developed by Hawk App
5. Gallery developed by Alcatel Innovative Lab
6. Hi VPN developed by Hi Security
7. Net Master developed by Hi Security
8. filemanager developed by mie-alcatel.support
9. Apps (not in Google Play)
10. Calculator (not in Google Play)
11. Joy Recorder developed by mie-alcatel.support
12. Weather developed by mie-alcatel.support
13. Launcher developed by mie-alcatel.support

However, when we investigated each of the 5 app developers that create these apps, we discovered that there were actually 24 different apps in the Shenzhen HAWK network.

In their about page, Shenzhen HAWK lists itself as a wholly-owned subsidiary of the TCL Corporation, a major Chinese company also based in the Guangdong province. 

TCL Corporation has strong ties to the Chinese government, starting off in the early 2000s as a state-owned enterprise, and growing to be a large corporation through government support.

TCL Corporation has at least 52 subsidiaries around the world and owns the licensing rights to Alcatel, BlackBerry, and RCA, among others. It also has strong ties to the Chinese government, starting off in the early 2000s as a state-owned enterprise, and growing to be a large corporation through government support.

This can be quite problematic for privacy-seeking users: China is a defiantly repressive country with very strict data retention laws. It requires companies operating in China to store data on local servers and give unfettered access to those services to the authorities upon request.

China is also well-known for its strong desire for greater surveillance, both within its own borders and around the world.

But it’s not only the location that should be a worry for users.

It’s also the fact that Shenzhen HAWK has been exposed for serious privacy and security risks in the past.

Shenzhen HAWK’s spotty reputation

Some of Shenzhen HAWK’s apps have been in the news for issues related to malware, unethical practices, and inadequate privacy.

Alcatel apps secretly infecting phones with malware and adware

Since 2005, TCL Corporation has held the licensing rights for the Alcatel brand, and TCL’s subsidiary Shenzhen HAWK develops 7 apps made specifically for Alcatel phones.

ZDNet writes that one default Alcatel app, Weather Forecast, was compromised with malware, possibly infecting millions of users’ devices. According to the UK-based mobile security firm Upstream, the weather app harvested user data and sent it to a server in China.

The researchers noted that the app “collects and transmits geographic locations, email addresses, IMEIs to a server in China and has a number of privacy invasive permissions on the device.”

In certain countries, the malicious code inside the app would try to subscribe users to premium phone numbers without their knowledge, leading to large charges on users’ phone bills. In Brazil, for example, 2.5 million transaction attempts were made in July-August 2018 from about 130,000 phone numbers.

The weather app would also run in the background, secretly launching hidden browser windows and clicking on ads from certain web pages, surreptitiously using 50MB-250MB of data per day.

Furthermore, in early 2018, Alcatel phone users noticed that some Alcatel apps had been updated to include advertisements – lots of advertisements. Some default Alcatel apps, like Gallery, were changed to Candy Gallery, with a completely new app developer name listed.

According to Reddit users, five other default apps had also been replaced by ad-supported content. SlashGear went as far as to call these “adware”.

Hi Security app banned by Indian government

In 2017, India’s government gave warning to the army and paramilitary to delete a number of Chinese-origin apps from their phones. These 42 mobile apps were identified by the government’s intelligence agency as being spyware or other types of malware.

Included in that list is one app, Virus Cleaner 2019 – Antivirus, Cleaner & Booster developed by Hi Security, which is owned by Shenzhen HAWK.

Virus Cleaner 2019 has already been downloaded 50 million times, according to Google Play.

What permissions are Shenzhen HAWK apps asking for?

Let’s look at each dangerous permission to understand what the permissions allow the apps to do, as well as what kind of privacy and security risk that presents to the user. The list below is organized from most risky to least risky.

Dangerous permissions by app

Not all Shenzhen HAWK apps are requesting more dangerous permissions than they need. For example, Word Crossy only asks for the ability to upload files to the device. However, Calendar Lite is asking for permission to read through users’ logs, even though it doesn’t require that function.

Table 2. Sample of dangerous permissions requests by 5 Shenzhen HAWK apps under different developer names.

From the table above, a lot of logical questions arise:

• Why does an antivirus need to use the camera?
• Why does a camera app need so many permissions, including the ability to read logs, read through their files, etc.?
• Why does a sound recorder need to use a camera?

Reasons for unnecessary dangerous permissions

When looking through these dangerous permissions being requested by these apps, it’s important to understand why they’re requesting them in the first place.

Selling data

The most probable, and legal, reason why apps want a lot of permissions is to sell that data to third parties. The most lucrative is your location data: coarse and fine location, which can pinpoint your location to within a few yards.

Apps can send your location data 14,000 times per day, meaning they’ll have a very good idea of your everyday movements. They can even see which floor you’re on in a building. With this location data, apps can make a lot of money – one company pays developers $4/month for every 1,000 active monthly users.

If apps have 1,000,000 monthly users, that can equal $4,000 every month for app users’ location data.

Illegal uses

Less scrupulous app developers can use these permissions for their own illegal purposes, such as launching ransomware once users grant them special permissions. Others can use data from dangerous permissions to sell on the black market, including your contacts’ information, private messages, pictures, videos and more.

Unfortunately for Shenzhen HAWK, this isn’t theoretical. One of their apps, Weather Forecast, was caught collecting user data and sending it to a server in China.

Apps have been discovered using the call phone permission to make malicious phone calls, plus harvesting and sending data to a remote site.

There are quite a lot of financially lucrative things, legal or illegal, that app developers can do with user data.

Bottom line

Apps under the Shenzhen HAWK umbrella have a few critical issues that should give users pause:

1. They have a history of malware, rogueware, or unethical practices
2. They ask for a large amount of unnecessary dangerous permissions

Put together, users should seriously consider whether the perceived benefits will outweigh these serious negatives. In general, when selecting apps to use – and especially when giving them access to sensitive parts of your phone – users need to be very vigilant.

Apps that seem innocent may actually be sending phishing emails, reading and changing your files, selling your data, or much worse. After all, at the end of the day, you are the last line of defense against malicious software.

We strongly recommend to think about your online privacy and use a VPN to protect yourself. Our team gathered best VPN providers for you. In case paid software is not an option here are top free VPN services.

Listings of best VPN for:

• VPN for Popcorn time
• VPN for Kodi
• Best VPN for Roobet

Free VPN options for:

• Free VPN for Windows
• Free VPN for Chrome
• Free VPN for Kodi
• Free VPN for Netflix
• Free VPN for Popcorn time

Check out our other research:

• Free antivirus apps requesting huge amounts of dangerous permissions they don’t need
• How to beat Google Play’s algorithm and get 280 million installs
• Hidden VPN owners unveiled: 101 VPN products run by just 23 companies
• Study: how the world’s top websites track your online behavior
• Who is dominating the rising VPN market in 2019? Here are the numbers
• VPN confidential: how private is your VPN purchase?
• What is a VPN?

Disclaimer:

We meticulously research our stories and endeavor to present an accurate picture for our readers.  We’re also human, and if you believe we have made a factual error (as opposed to disagreeing with an opinion), please contact us so that we may investigate and either correct or confirm the facts. Please reach out to us using our Contact Us page.