A study led by researchers from Purdue University has found that a notable number of Android applications marketed toward U.S. military personnel include software components developed by companies based in China, Russia, and other countries identified by the U.S. Department of Defense as adversarial nations.
The research, conducted in collaboration with the U.S. Military Academy at West Point and Florida International University, examined more than 220 Android applications obtained from Google Play and online military communities. According to the researchers, over one in every eight apps analyzed contained code associated with organizations headquartered in countries regarded as strategic competitors of the United States. The Pentagon declined to comment on the study's findings.
Rather than identifying malicious applications outright, the study highlights a growing software supply chain challenge created by third-party Software Development Kits (SDKs), which developers routinely integrate into applications to support features such as advertising, analytics, authentication, and push notifications. While these components simplify development, they can also introduce external code that developers may not fully inspect or even realize has been included.
Researchers found SDKs in approximately 64% of the analyzed applications. Among them, twelve apps contained Huawei's HMS Core framework, including applications developed for state National Guard organizations. In one instance, Huawei's software was not intentionally added by the application's developer. Instead, it was introduced indirectly through a commercial notification service that bundled Huawei's SDK as a dependency.
The researchers noted that this type of indirect integration presents an important security concern because SDKs can receive remote updates over time. Even if no sensitive information is transmitted today, future updates could potentially alter an application's behavior without users being aware. Although the study did not observe any data being sent to Huawei-controlled servers during testing, the researchers cautioned that the presence of such software should not automatically be considered harmless.
Beyond Huawei, the analysis also identified software associated with Russian technology companies. SDKs linked to Yandex advertising services were found in applications used by military-affiliated users. The study also referenced Pushwoosh, a Russian software company that previously presented itself as a U.S.-based business. Reuters reported in 2022 that Pushwoosh code had been embedded in official mobile applications operated by the U.S. Army and the U.S. Centers for Disease Control and Prevention (CDC). Both organizations subsequently removed the software following public disclosure.
The researchers also discovered discrepancies between application behavior and the privacy information disclosed through Google Play. Approximately 40% of the applications examined either collected or shared more user data than indicated by their app store privacy labels. Overall, around 7% of the analyzed applications contained software linked to companies headquartered in countries designated by the Pentagon as adversarial nations.
Lead author Joshua Shinkle of Purdue University said the team hopes the findings encourage stronger awareness among military personnel, application developers, platform providers, and policymakers. According to Shinkle, the research is intended to support more informed privacy decisions while encouraging discussions about improving transparency and addressing existing security gaps.
The study argues that the implications extend beyond software development practices. Researchers pointed to the commercial mobile advertising ecosystem, where applications routinely collect location and device information that can later be shared through data brokers. Such information has the potential to expose sensitive operational patterns, including troop movements, deployment routines, and activity around military installations.
The report references an April letter in which U.S. Central Command (CENTCOM) informed Senator Ron Wyden that it had received multiple threat reports indicating that adversaries were exploiting commercially available location data to monitor U.S. military personnel operating near Iran and the Strait of Hormuz. Lawmakers described the disclosure as the first official acknowledgement that commercially traded mobile data had been used to track troops deployed in an active conflict zone.
Researchers also surveyed 103 military-affiliated Americans to better understand attitudes toward mobile application privacy. More than 83% of respondents reported using at least one application whose data collection practices made them uncomfortable. Between 76% and 83% indicated they would be extremely uncomfortable using applications containing software developed by companies from adversarial nations.
Despite these concerns, participants expressed
[…]
Content was trimmed to protect the source. Please visit the original article for the full text.
Read the original article: