Security firm identifies 22 flashlight apps as adware in Play Store

Security firm Check Point has said it has discovered 22 malicious flashlight apps in the Play Store, which have since been removed by Google. The Android apps showed ads to users even though they were disabled.

The company writes in an analysis that the apps use a malicious SDK called Solid. This has two functions. The first is to hide the icon of the app after it has been launched for the first time. The second function is to show advertisements, which also happens outside the app. Google has removed the affected apps from the Play Store after being notified by Check Point.

According to the company, there are several events that trigger the showing of ads. Examples include locking the screen, ending a call and connecting a charger. These functions of the sdk would be activated as soon as the app connects to a command and control server. Users could choose to disable ads, but this setting was ignored.

The display of advertisements is not linked to activity of the apps, making it difficult for users to determine where they come from. Check Point has made an estimate based on the number of downloads and arrives at a minimum of 1.5 million downloads. A package called Solid Union Call Recorder was responsible for most of the downloads, about a million.