Lookout reported in August 2017 that more than 500 Google Play apps included the Igexin advertising SDK, and said the apps were removed from Google Play or updated after it alerted Google. That did not mean every app was proven to spy, or that Google remotely deleted every installed copy. Lookout said the affected apps had accumulated more than 100 million downloads across Android; that figure counts downloads of apps containing the SDK, not confirmed spyware infections.
What is Igexin spyware?
Igexin was an advertising software development kit (SDK) that app developers could embed to provide ad-related functionality. The concern Lookout identified was that certain versions also contained a plugin framework capable of fetching and loading code controlled by a remote server. That made the SDK a potential route for spyware behavior, but SDK presence alone did not establish that a particular app downloaded or ran a malicious plugin.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Google Play gift code | $200.00 | Buy on Amazon |
| 2 |
|
Google Play gift code | $50.00 | Buy on Amazon |
| 3 |
|
Google Play gift code | $25.00 | Buy on Amazon |
| 4 |
|
Google Play gift code | $100.00 | Buy on Amazon |
| 5 |
|
Google Play gift code | $200.00 | Buy on Amazon |
Lookout’s August 21, 2017 report, “Igexin Advertising Network Put User Privacy at Risk”, described more than 500 Google Play apps containing the SDK. The apps spanned categories including games, weather, radio, photo editing, education, health and fitness, travel, emoji, and home video cameras.
How could the Igexin SDK load code remotely?
In the versions Lookout examined, an app could contact an Igexin REST API. The server could respond with encoded JSON that directed the SDK to download encrypted JAR files. The SDK decrypted those files and used Android’s DexClassLoader and reflection to load a specified class. Because the server could select the code, the behavior could change without an app update. Lookout noted that API traffic was encoded, but not encrypted.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems#1 Best Overall
- No returns and no refunds on gift cards. Good for use on the US Google Play Store only. Terms apply - see below.
- Google Play gift codes can be used on the Google Play Store, the official app store for Android, to purchase apps, games, and more.
- To redeem, enter code in the Play Store app or play.google.com.
- Endless games to explore: Find and play old and new favorites – from mind-bending puzzles to epic quests and more.
- Just the app you’re looking for: Millions of apps means millions of ways to get things done, learn something new, and maybe even meet someone special.
Lookout summarized the reach of this design with a warning: “The only limitations on what could potentially be run are imposed by the Android permissions system.” That describes the framework’s potential, not proof that every app exercised it or that every downloaded plugin had the same behavior.
What information could the Igexin SDK collect?
The most serious behavior Lookout said it observed was call-log data leaving a device. Its report described plugins registering an Android PhoneStateListener when a relevant setting was enabled and the app had the android.permission.READ_PHONE_STATE permission. The listener recorded call time, calling number, and call state—idle, ringing, or off hook—and periodically sent that information to an Igexin endpoint.
Rank #2
- No returns and no refunds on gift cards. Good for use on the US Google Play Store only. Terms apply - see below.
- Google Play gift codes can be used on the Google Play Store, the official app store for Android, to purchase apps, games, and more.
- To redeem, enter code in the Play Store app or play.google.com.
- Endless games to explore: Find and play old and new favorites – from mind-bending puzzles to epic quests and more.
- Just the app you’re looking for: Millions of apps means millions of ways to get things done, learn something new, and maybe even meet someone special.
This was conditional: the plugin setting had to enable the behavior, and the app needed the permission. Android’s permission system also limited what loaded code could access. The report does not establish that all apps containing Igexin collected call data or that every user of those apps had data exposed.
Was my app spying on me just because it used Igexin?
No. Lookout explicitly cautioned that it had not confirmed the spying capability in every app that used Igexin. Three claims should be kept separate:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- No returns and no refunds on gift cards. Good for use on the US Google Play Store only. Terms apply - see below.
- Google Play gift codes can be used on the Google Play Store, the official app store for Android, to purchase apps, games, and more.
- To redeem, enter code in the Play Store app or play.google.com.
- Endless games to explore: Find and play old and new favorites – from mind-bending puzzles to epic quests and more.
- Just the app you’re looking for: Millions of apps means millions of ways to get things done, learn something new, and maybe even meet someone special.
- SDK presence: Lookout found more than 500 apps using the SDK.
- Capability: certain SDK versions could fetch and execute remotely selected plugins.
- Observed activity: Lookout observed plugins that could transmit call-related data under the stated permission and setting conditions.
The reported total of more than 100 million downloads was the reach of apps containing the affected SDK across Android, not a count of devices infected, users spied on, or confirmed plugin executions.
Did Google remove 500 apps from the Play Store?
Lookout said it informed Google, after which affected apps were removed from Google Play or updated with invasive features removed. The headline shorthand that Google “killed” 500 apps should not be read as proof that every one was confirmed malicious, or that every app was permanently removed rather than corrected through an update.
Rank #4
- No returns and no refunds on gift cards. Good for use on the US Google Play Store only. Terms apply - see below.
- Google Play gift codes can be used on the Google Play Store, the official app store for Android, to purchase apps, games, and more.
- To redeem, enter code in the Play Store app or play.google.com.
- Endless games to explore: Find and play old and new favorites – from mind-bending puzzles to epic quests and more.
- Just the app you’re looking for: Millions of apps means millions of ways to get things done, learn something new, and maybe even meet someone special.
Removal from the store is also different from uninstalling copies already on phones. Lookout’s report describes store removals and app updates; it does not say Google automatically uninstalled all previously downloaded copies.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What did Google’s IcicleGum report add?
Google’s Android Security 2017 Year in Review separately described IcicleGum, a spyware potentially harmful application (PHA) family that used Igexin SDK variants with dynamic code loading. Google said IcicleGum fetched encrypted DEX files over HTTP from command-and-control servers, decrypted and loaded them through class reflection, then read and sent call logs and other data. Google also noted that some developers embedding the SDK may not have known about remotely selected code.
Best Value
- No returns and no refunds on gift cards. Good for use on the US Google Play Store only. Terms apply - see below.
- Google Play gift codes can be used on the Google Play Store, the official app store for Android, to purchase apps, games, and more.
- New finds, old favorites, one card. Choose a unique gift card design featuring your favorite games or apps. This card can also be used for anything else on Google Play. There’s something for everyone, so find what’s yours. Go Play.
- Easy to use: With a Google Play gift code, you never have to worry about expiration dates or fees.
- Endless games to explore: Find and play old and new favorites – from mind-bending puzzles to epic quests and more.
The report’s figures apply to IcicleGum, not to all apps containing Igexin: 70% of IcicleGum downloads came from Google Play, and Russia accounted for more than 21% of those downloads. These statistics should not be combined with Lookout’s count of apps using the SDK or its estimate of their total downloads.
How does Google define spyware now?
Google’s current Play Protect malware guidance describes spyware as malicious code or behavior that collects, exfiltrates, or shares data unrelated to policy-compliant functionality. It includes third-party SDK code that transmits data unexpectedly or without adequate notice or consent. Google Play’s spyware policy guidance likewise says an app is responsible for third-party SDK behavior and cites unexpected transmission of call logs and other sensitive information as examples.
Those current policies help explain why an advertising component can raise a privacy issue when its behavior exceeds the app’s disclosed, expected function. They do not establish that a current app still contains Igexin.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
