Google yanks sketchy iMessage clone for Android from app store

People who probed the app's innards suspected it was harvesting Apple ID credentials

An app that purportedly spoofed a Mac so that Android smartphone and tablet owners could send and receive text-like messages through Apple's iMessage service disappeared today from the Google Play app store.

Google confirmed that it yanked the app for violating its store policies.

Dubbed "iMessage Chat," the app came under quick fire Monday from other app developers who said the program may have been harvesting Apple ID usernames and passwords by passing packets through a China-based server.

The app first appeared on Google Play on Sept. 12 and was available as late as Monday. By today, however, it had been scrubbed from the app store.

iMessage is Apple's proprietary technology that is embedded in the Message apps for iOS 5 and later and OS X Mountain Lion. When users text another iOS device or a Mac, they sidestep their mobile carrier's traditional SMS (short message service), avoiding texting charges.

The Android app was designed to let users piggyback on Apple's iMessage service to send and receive texts.

But concerns about the implications quickly surfaced.

"iMessage for Android app has code to download APKs in the background? TOTALLY SAFE. Not rootkit-ing your phone or anything? :D," tweeted Steve Troughton-Smith, an app developer with High Caffeine Content, on Monday.

The term "APK" in Troughton-Smith's tweet referred to the file format used by Android to install apps and other code on the operating system.

Others pointed out that users of the app were required to log in using their Apple ID username and password, and that the developer may have simply built the program to collect those valuable credentials, which are used to access iOS devices remotely for data wiping, purchasing content on iTunes and buying goods, including iPhones and Macs, through Apple's online store.

Jay Freeman, who goes by the online nickname "saurik," dug inside the app and tracked the packets it sent and received. Freeman is best known as the developer of Cydia, the open-source application installer that acts as an App Store substitute for jailbroken iPhones.

He found that iMessage Chat for Android essentially inserted itself into the middle of the normal back-and-forth between a user and Apple's iMessage servers. In a thread on Hacker News, Freeman spelled out his findings.

"I believe that this application actually does connect to Apple's servers from the phone, but it doesn't then interpret the protocol on the device," Freeman wrote on the thread. "Instead, it ferries the data to the third-party developer's server, parses everything remotely, figures out what to do with the data, and sends everything back to the client decoded along with responses to send back to Apple."

Commenters on Freeman's Google+ page, where he also discussed iMessage Chat, pointed out the danger of trusting a third-party app with an Apple ID. "Seems to be a quick way to get pwnd in some way or another," said Hugo Visser, a Dutch developer of Android apps.

Commenters also noted that the China-based server was running SQL Server, which was accessible from the Internet, posing yet another threat to anyone who used iMessage Chat. Even if the developer was on the up-and-up, and wasn't harvesting Apple IDs, the server could be hacked by others, who would then be able to sweep up the credentials.

Someone who identified themselves as "Hu LuWa" -- the name used for the developer's website, according to Google Play -- dropped in on Freeman's Google+ page to post one comment, but did not answer any of the several questions others posed.

The developer's website -- huluwa.org -- was offline Tuesday. A message left on a Google+ page assigned to Hu LuWa was not returned.

A Google spokeswoman confirmed the company had pulled the app. "We remove apps from Google Play that violate our policies," she wrote in an email reply to questions.

This article, Google yanks sketchy iMessage clone for Android from app store, was originally published at Computerworld.com.

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Cybercrime and HackingAppleGooglesecurityapplication securityAccess control and authenticationmobile apps

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?