Key Takeaways:
- Mobile apps are a primary source of Corporate Data Leakage
- MDM and MTD don’t detect what mobile apps are doing with your data to help with this
- App store approval doesn’t equal enterprise security
- Mobile app vetting fills a critical gap for data loss prevention (DLP) in the enterprise
How do mobile apps contribute to corporate data leakage and how can enterprises address with mobile specific data loss prevention (DLP)? Find out today with a live example from the App Store.
A document scanner gets the paper people would not hand to a stranger: passports, driver’s licenses, contracts, work documents. This week I ran one of the most popular scanners on the Apple App Store through Q-scout. During the analysis it connected to nine servers in mainland China and Hong Kong. Its maker is in Shanghai, and the app is built on Chinese cloud, sharing and advertising services from the ground up.
What the app is
It sits in the top 30 of the App Store’s Productivity category with 4.8 stars from almost two million ratings. The Android build is past half a billion installs on Google Play, and the maker says it has more than 300 million users. It does the job well. Photograph a page, straighten it, OCR it, save a PDF, sync to the maker’s cloud and it is on every device you own.
The developer is headquartered in Shanghai and listed on a Shanghai exchange in 2024. Its own filings say this app is roughly three quarters of its revenue and that about a third of that revenue comes from outside China. So when you ask where your scans go, the answer starts with who holds them, and that is a Chinese company operating under Chinese law.
Note: The app name has been anonymized. Reach out to us directly to get the name and the de-anonymized risk information.
What we observed
Q-scout runs the app on a real device and records every connection it makes.
Nine of those connections went to mainland China and Hong Kong. Two to Alibaba Cloud in Hangzhou, three to Tencent Cloud in Shanghai and Hong Kong, four to China Telecom, China Mobile and Sina networks in Beijing, Fujian and Guangzhou. I pulled the network owners from the regional internet registry records. All nine were encrypted end to end to China.
Q-scout also runs an automated man-in-the-middle attack against every connection, and several of this app’s gave way to it. In the app’s own API traffic, hosted in our US session on Amazon’s cloud in California, it saw a persistent device identifier, the phone model, OS version, app version and device language go out on a routine update check. If an automated attack can decrypt that, so can anyone between the phone and the server.
Then the code. The software bill of materials and the URLs embedded in the binary show a Baidu cloud storage API, WeChat and Weibo integrations, a Tencent advertising SDK, a Tencent analytics beacon, two Chinese customer-chat widgets and a Tencent network transport library. This app was built for a Chinese user base and shipped everywhere else afterward, including to many US Government and US Enterprise phones.
It also requests more access than it needs to do the scanning. Location while in use, with an always-on location entry declared. Bluetooth. Local network. At runtime it reads the clipboard and checks what other apps are installed. A big consumer app asking for all of that is not rare but with the context of the developer and where this data is going, it presents a new risk.
Why it matters
If you scanned your passport with this, a company in Shanghai is storing and syncing it on an app that talks to Chinese infrastructure as a matter of design.
On a managed fleet this is exactly the app that gets on phones because it works and nobody vetted it. Receipts first, then a signed contract, then whatever is on the desk. The MDM console shows a scanner with a 4.8 rating. It does not show nine connections to Chinese cloud providers or a Baidu storage API in the binary.
A store listing and a privacy label tell you what the maker chose to declare. The binary and the network tell you what the app does.
Without the insights that an app vetting tool like Q-scout can provide, apps are leaking sensitive corporate data right under the MDM and MTD without detection. We have observed this specific app on US Government, Global Government, US Enterprise, and many other customer networks when we first install. The risk is not hypothetical, it is observed in some of the most sensitive deployments, all who already have in place a leading MDM and MTD product.
How we found it
Q-scout works from the compiled app, no source code, and runs it on a sandboxed device while recording the network. The static side gives the permissions, the embedded URLs, the behaviors (clipboard reads, dynamic code loading, installed-app checks) and a version-specific software bill of materials that names the SDKs inside the binary, including the closed-source ones. The dynamic side gives the real connections with a geolocation for each, and runs the man-in-the-middle attack against them to show what an attacker on the network could read.
I then checked it the way we would for a customer report. Each China-bound address was looked up in the regional registry to name the owner, and the decrypted request was read rather than keyword-matched.
What to do
Know who makes your scanner app and where it syncs. Turn off cloud sync if you do not need it. A high rating says nothing about where the data goes.
If you run managed devices, vet the apps on them for what they do rather than what they say. Scanners, keyboards, VPNs and file managers are where the gap between the listing and the behavior is widest. Q-scout will tell you which apps on your devices talk to which countries, and what they send when it can be read.
Contact Quokka to learn which app this is and whether it is on your devices.
