18

While traversing the 'installed' list of Google Play, I noticed a very odd app named "Souper Android Development".

What's so suspicious about it is:

  • It does absolutely nothing to explain what it is, what it does, or what permissions are required
  • There is no option to open/uninstall
  • I cannot find it by searching for it
  • It is dimmed in the list with the other apps
  • It is not listed when I browse play.google.com/apps
  • Nobody (in the comments) seems to know where they got it.

Notice the app is dimmed (grayed out)

App is dimmed in the list of apps

I scrolled to the top of the page during screen capture. Notice how many standard features are missing

App's market page doesn't conform to standard

I have no idea where it came from. I imagine it was either part of the humongous set of bloatware provided by Verizon or, what I'm thinking is more likely, the method used to root my phone: Pete's Motorola Root Tools. I have scanned my phone with Lookout but it hasn't found anything.

  1. Can anyone provide any insight as to what this app is?
  2. How should I remove this app? I am having difficulty locating it in "System App Remover".
  3. Should I be suspicious of the rooting tool I used and take any action? I have been told this is legit. Whether it is or not, it doesn't seem to be in any way part of the problem.
  4. How can you trace a market app to its package name?

Update

While searching for other complaints on this app, I dug up:

  • A link to it on Google Play(removed). I'm still curious as to how someone obtained this link, I couldn't find it in a search or any references to it.
  • It says it's not compatible with any of my devices but it's installed.
  • No one has found any traces of it on their phone (probably because it's 'linking' to com.motorola.contacts.preloaded)
  • It seems to only be affecting Droid 3 users.

Update 3/28/2012

Final update/Brief summary:

  • 3/26: App showed up without user-approved install under the name "Brett Henderson" with no option to open or uninstall. Later renamed "Souper Android Development".
  • 3/27: Clicked the app's "share" button to view its link to the app on phone (com.motorola.contacts.preloaded). This confirms Richard's suspicion that it was merely sharing its name with a legit system app as opposed to installing junk on the phone. Further reading revealed that each app has a unique ID to prevent one app from providing "updates" to another with the same name.
  • 3/28: The app was removed from the app market place. As pointed out by Matthew Read, a similar bug happened not too long ago. As of now, I haven't read anything official on this instance.
Improve this question
4
  • 6
    I wouldn't be surprised if it was someone exploiting this bug.
    – Matthew Read
    Mar 27, 2012 at 22:09
  • @Matthew: I'm trying to find what this market app is "linked" to on my phone. From ADB I ran pm list packages -f, but didn't see "SOUPER" anywhere. Do you know how to see the app's displayed name?
    – Gary
    Mar 28, 2012 at 0:01
  • Hmm, not sure. You could potentially grep in /system/app/*.apk for "souper".
    – Matthew Read
    Mar 28, 2012 at 0:56
  • Thanks again Matthew. Nothing different in *.apk but I believe this app is pretending to be com.motorola.contacts.preloaded.
    – Gary
    Mar 28, 2012 at 13:42

1 Answer 1

Reset to default
8

There's nothing malicious here. A developer uploaded an app to the Play Store that has the same package name as a system app from your phone.
The new Play Store update tweaked the detection of system apps and it linked the apps. This will probably be resolved soon. No need to bring big guns.

Lookout and other "antivirus" tools don't show anything malicious because they couldn't tell Angry Birds apart from a nuclear bomb. They are completely useless against any sophisticated attack.

Improve this answer
9
  • 3
    There could very well be something malicious here. This doesn't look like an honest mistake (like in the case of the Russian mobile carrier app that Matthew Read linked in his comment.) This very much looks like a deliberate attempt to fool the Market into "upgrading" a system app with this junk. Even more suspicious is the fact that this app seems to have already been pulled off the Play Store, mere hours after it's been flagged.
    – Chahk
    Mar 27, 2012 at 23:00
  • How can I confirm this? Surely there is a way see this link (ie Trace a market app back to the installed app). As far as app "antivirus", I know it's a joke to say the least. The only reason I bothered mentioning it was to prevent someone from asking me if I did it.
    – Gary
    Mar 27, 2012 at 23:31
  • 1
    Every app is signed with the developers keys. If the keys of the update and the original app don't match Android will refuse to install the update. Unless the attacker somehow managed to get Motorola's private key this attack is not feasible.
    – user13391
    Mar 28, 2012 at 7:20
  • That makes sense, but is there a way to see the what the package name is of the app while it's on the market? What I'd like to do is see [market app with name "abc"] == [phone app with name "abc"]. I know I'm being a little paranoid, but I'm just hoping to have something more tangible than "don't worry about it".
    – Gary
    Mar 28, 2012 at 11:39
  • 1
    No. For the past few versions Google started to handle linking apps on the servers instead of letting the market app do it. This also resulted in apps that you got elsewhere (Amazon) to show up as purchased in market, but unable to download or buy there. Really annoying.
    – user13391
    Mar 28, 2012 at 15:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .