Smartphone owners warned over 'harmless' apps in hacking surge

Smartphone owners warned over 'harmless' apps in hacking surge Experts at Which? say the vast majority of cases involving hacked phones dealt with by its technical support team can be traced back to a dodgy app Smartphone owners have been warned that a seemingly harmless app could leave their device at the mercy of hackers. Experts at Which? say that the vast majority of cases involving hacked phones dealt with by its technical support team can be traced back to a dodgy app. The rogue software can masquerade as something useful - such as a PDF reader or QR-code scanner - before bombarding the victims with adverts, demanding suspicious permissions or encouraging them to download yet more software. In the worst cases, the apps can even take over the appearance of the phone, making it harder for users to find their way into settings and remove them. Which? Technical Support Adviser Conor Houlihan said rogue apps and unwanted pop-ups were a common problem encountered by the organisation's experts. He said it could be particularly alarming when adverts suddenly appear across the entire screen or familiar menus on a phone are changed. One Which? member reported their Samsung phone had become virtually unusable because of constant pop-ups and adverts. The messages encouraged the victim to call a telephone number or install another app – but restarting the phone did nothing to stop them. Which? said its experts had encountered rogue apps capable of replacing the phone's launcher, the software responsible for controlling the appearance and behaviour of the home screen and app drawer. Some had even imitated the Android Settings screen, potentially making it harder for owners to work out what was wrong and remove the offending app. The consumer group highlighted a fake PDF reader as an example of how an innocent-looking app could become a menace. The app displayed an alarming warning that the device needed 'cleaning' and offered a supposed solution. But it also requested permission to send and view SMS messages – something Which? says should immediately raise suspicions for a basic PDF reader. The danger signs Which? experts advise smartphone owners to be particularly wary if their phone suddenly starts behaving strangely. Warning signs include: - Pop-ups appearing constantly, including when other apps are being used. - Apps appearing that you do not remember installing. - Unexpected changes to the home screen or app drawer. - Alarming messages claiming the phone needs cleaning or urgent attention. - An app demanding permissions that appear unrelated to its purpose. - Prompts telling you to telephone a number or download another app. The crucial advice is simple: do not do what the pop-up tells you to do. Do not call a number displayed in a suspicious warning and do not install another app because you have been instructed to do so. Instead, Which? recommends checking the apps recently installed on the phone. On Android devices, owners can go to Settings > Apps and look for anything they do not recognise, particularly software installed around the time the problems started. If an unwanted app refuses to be removed, Which? recommends trying Safe Mode, which temporarily disables apps installed by the user. On many Android phones, users can open the power menu and press and hold Power off until the Safe Mode option appears. Once the phone restarts, the suspicious app can be removed through Settings > Apps before the device is restarted normally. It may not even be a hacked phone Which? also warns that some apparently frightening pop-ups can actually be browser notifications from a website. On Chrome, users can check these by going to the three-dot menu, then Settings > Site settings > Notifications. Notifications from websites they do not recognise or trust should be blocked. But anyone who has entered bank, payment or other sensitive details into a suspicious app or website should act quickly. Which? advises contacting the bank using a trusted telephone number or its official app and changing passwords for accounts that may have been put at risk. Android users face particular risk The Which? experts say most of the cases they see involve Android phones. One reason is that Android allows apps to be installed from outside the Google Play Store. That does not mean Google Play is completely safe, however, as harmful apps have occasionally slipped through its checks. iPhones sold in Britain have tighter restrictions on installing software from outside Apple's App Store. But Which? warns that iPhone users can still encounter scam apps and nuisance browser notifications. How to avoid downloading a rogue app Which? recommends sticking to official app stores where possible and checking an app carefully before installing it. Look at the developer's name and recent reviews, paying particular attention to complaints about intrusive adverts, unexpected subscriptions or persistent pop-ups. And think twice before downloading an app simply because a website tells you that you need one. Your phone may already have the feature you are looking for. For example, both Android phones and iPhones can scan QR codes using their built-in cameras, so there is usually no need for a separate QR scanner. Permissions are another major warning sign. If an app asks for access that appears to have nothing to do with its function, users should stop and think before granting it. A QR-code scanner asking for access to contacts, for example, should set alarm bells ringing. Android owners should also make sure Google Play Protect is switched on. This can be checked through the Google Play Store by going to the profile picture, Play Protect and Settings, and ensuring 'Scan apps with Play Protect' is enabled. Keeping the phone and its apps updated is also important because security updates can protect against newly discovered threats. And users should be especially suspicious of unexpected links arriving by text, email or social media – particularly if they are being urged to install software or change their phone's settings. The Which? warning comes with a reassuring message too. Its experts say many rogue-app problems can be fixed once the offending software has been identified and removed, or unwanted browser notifications have been blocked. But the first step is recognising that the frightening warning flashing up on your screen may itself be the trap. More information here.