Rogue Android app sent personal info to legit version's developer, claims AVAST

01.04.2011
A malicious Android app that shamed users for pirating software transmitted personal information to a URL controlled by the legitimate app's developer, a security company said today.

The developer of "Walk and Text," the app whose code was recompiled and re-released on unauthorized online stores, denied the claim by AVAST Software, an anti-virus firm based in Prague.

Walk and Text, which costs $1.54 to download from the official Android Market, uses the smartphone's camera to show what's in front of users as they simultaneously walk and text, theoretically preventing them from slamming into signposts or stepping off curbs into traffic.

The Trojanized version of the app includes malicious code that texts an to each contact in the phone's address book.

"Hey, just downlaoded [sic] a pirated App off the Internet," the message reads. "Walk and Text for Android. Im [sic] stupid and cheap, it costed [sic] only 1 buck. Don't steal like I did!"

The rogue app -- which Symantec yesterday named "Android.Walkinwat" and identified as a Trojan horse -- also pilfers personal data from the phone, including the phone number and the device's unique identifier, and sends it to a remote server.