Cybersecurity experts in the United States examined 224 mobile apps advertised as utilities for the US military and found that one in eight of them contained elements developed in Russia or China. The code created by the Russian startup Elfsight was also found in the White House application for federal officials, the development of which cost more than $1 million, TechRadar reports, citing experts from Atomic Computer.
The military applications study was conducted by Purdue University, West Point Military Academy and Florida International University. As the authors of the work noted, the applications were generally positioned as helping US military personnel deal with finances, select medical services, or contact each other.
More than 60% of them contained third-party application development kits (SDKs), including those from the Chinese company Huawei. They, in particular, were contained in programs that were officially used by the National Guard in a number of states. At least 40% of the apps studied also appeared to collect more data than what was stated on their Google Play and App Store pages, the experts added.
7% of applications contained program code written in countries recognized by the Pentagon as adversaries of the United States. At least two applications were entirely developed in Russia and used Yandex advertising services as a method of monetization.
“We recommend that federal authorities, the Department of Defense, and app stores and devices take action to reduce the risk to this vulnerable population,” the study authors said, without disclosing whether there was a data breach.
The Russian code was also found in a separate investigation into a White House app that was promoted by President Donald Trump's administration as a way to get instant news from Washington. Ohio startup 45Press received $1.4 million in development funding, and installation of the application became a mandatory requirement for federal officials.
As TechRadar writes, specialists from Atomic Computer discovered that the servers of Elfsight, which is based in Andorra, but was founded in Tula in 2016, are responsible for running JavaScript files in the application. In one session on the White House app, experts tracked the receipt of at least ten cookies from Elfsight.
White House spokeswoman Olivia Wales said in a comment to the publication that, according to her information, the only Elfsight development script is used when launching the tax calculator in the application, and no cookies are required to use it. She also emphasized that Elfsight has previously passed a security check and its developments are actively used by sports organizations UFC, FIFA and NBA (NBA), as well as the luxury brand Cartier. She did not specify the reason for using the developments of a Russian company in the White House application.
