Viva-video App Is No Longer Safe! Please Uninstall All The Apps In This Article Until Further Notice

Beyond the reported technical abuses, the report also highlights the issue of obfuscation—we have seen networks of related developers hiding their links before, and here we have allegations that the Chinese developer masked its origins behind local subsidiaries in presenting apps on Play Store.

There have been multiple reports now into both of these issues. To its credit, Google has pulled networks of apps that abuse permissions or spew adware once installed. The permissions issue, though, is more complex. Google has taken steps to encourage developers to keep in line but that is not enforced. It should be mandatory. There is no excuse for permission abuse that puts hundreds of millions of users at risk for the sake of ruthless monetisation, especially as it also opens the door to much more malicious threats.

The developer in question this time is Hangzhou-based QuVideo Inc, its most popular app being VivaVideo. VPNpro describes this as “one of the biggest free video editing apps for Android, with at least 100 million installs on Play Store.” We shouldn’t be too shocked at the claims the app is up to no good—it was one of 40 Chinese apps listed by the Indian government in 2017 as “either spyware or ‘malicious-ware’.” Military personnel were instructed to delete it immediately.

According to VPNpro, QuVideo has three apps on Play Store, although it appears to be networked to others as well. It also has apps on the iOS App Store, but the permission situation with iOS is different and not open to the same abuse.

There are some permissions VivaVideo needs to function properly—those arguably include the ability to read/write to external drives, albeit once that permission is granted it’s not limited. Why the app would need to know a user’s “specific GPS location,” though is less clearcut. Until, that is, you realise that this permission allows apps “to send your location data up to 14,000 times per day​, even when you’re not using their apps.” We saw the scale of this recently, when the U.S. turned to this type of marketing data for coronavirus phone tracking.

This isn’t an isolated example, of course, VivaVideo’s stablemate VidStatus (50 million installs) “asks for a whopping ​9 dangerous permissions​, including GPS, the ability to read phone state, read contacts, and even go through a user’s call log.” The app was flagged by Microsoft as malware, hiding the AndroRat trojan.

“When we checked​ ​VidStatus on VirusTotal​, it came back positive,” VPNpro warns. “These kinds of trojans can steal people’s bank, cryptocurrency or PayPal funds.” Putting the alleged malware to one side, the permission abuse is enough to warrant immediate deletion and avoidance of these apps.

QuVideo doesn’t make its ownership of ViStatus obvious, but those links can be found. “On the English language version of its website (vivavideo.tv),” VPNpro says, “QuVideo simply lists its company name as ‘VivaVideo’. However, on the Chinese language versions of its site (for both quvideo.com and xiaoying.tv), it goes by Hangzhou Zhuying Technology Co., Ltd.”

Mapping out this small network of apps, VPNpro reports that there are six from the same developer that should be treated with caution. “These apps have ​more than 157 million installs combined​. But the number is likely much bigger—while ​VivaVideo​’s Google Play page shows it has 100 million+ installs, its​ ​’About Us’ page​ shows that it already has 380 million users worldwide.”