Google removes Tizi app from Play Store for stealing user information

Most of us are guilty of sharing too much information on social media platforms. From going on a vacation to getting a new haircut, we tend to post about every small detail of our lives. However, have you ever sat back and wondered whether the information you are sharing is secure or not?

Apparently, the information you share on various social media platforms can be easily stolen. Google has found an app called 'Tizi' which steals user information from call records and also from social media including Facebook and WhatsApp. Furthermore, the app takes away photos without informing the owner or even switching on the display of the phone.

"Tizi is a fully featured backdoor that installs spyware to steal sensitive data from popular social media applications. The Google Play Protect security team discovered this family in September 2017 when device scans found an app with rooting capabilities that exploited old vulnerabilities," stated a Google security blog post.

Google took prompt action by removing the Tizi app from Google Play Store and notifying the affected devices. The search engine has also suspended the account of the developer.

The security blog post reveals that the previous version of the Tizi app did not have 'rooting' capabilities. However, the app gained rooting capabilities with a software update, after which it started to steal personal information of users from their devices.

According to the blog post, Tizi steals sensitive data "from popular social media apps like Facebook, Twitter, WhatsApp, Viber, Skype, LinkedIn, and Telegram."

What's more alarming is that the Tizi app had the backdoor capability like a commercial spyware. It could record calls from WhatsApp, Viber, and Skype, send and receive SMS messages, and access calendar events, call log, contacts, photos, Wi-Fi encryption keys.

"Tizi apps can also record ambient audio and take pictures without displaying the image on the device's screen," stated the post.

The good news is that Google fixed the vulnerabilities in devices which could have been affected by Tizi with new software codes after April 2016.

As noted by the Google security post, "If a Tizi app is unable to take control of a device because the vulnerabilities it tries to use are all patched, it will still attempt to perform some actions through the high level of permissions it asks the user to grant to it, mainly around reading and sending SMS messages and monitoring, redirecting, and preventing outgoing phone calls."