{"id":163518,"date":"2023-01-25T16:31:14","date_gmt":"2023-01-26T00:31:14","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=163518"},"modified":"2023-07-11T11:16:05","modified_gmt":"2023-07-11T18:16:05","slug":"the-rise-and-risks-of-ai-art-apps","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/the-rise-and-risks-of-ai-art-apps\/","title":{"rendered":"The Rise and Risks of AI Art Apps"},"content":{"rendered":"

Authored by Fernando Ruiz<\/p>\n

The popularity of AI-based mobile applications that can create artistic images based on pictures, such as the \u201cMagic Avatars\u201d from Lensa, and the OpenAI service DALL-E 2 that generates them from text, have increased the mainstream interest of these tools. Users should be aware of those seeking to take advantage to distribute Potential Unwanted Programs (PUPs) or malware, such as through deceptive applications that promise the same or similar advanced features but are just basic image editors or otherwise repackaged apps that can drain your data plan and battery life with Clicker and HiddenAds behaviors, subscribe you to expensive services that provide little or no value over alternatives \u00a0(Fleeceware), or even steal your social media account<\/a> credentials (FaceStealer).<\/p>\n

\"\"<\/p>\n

Dozens of apps surface daily claiming to offer AI image creation. Some of them might be legitimate or based on open-source projects such as Stable Diffusion, but in the search for a free application that produces quality results, users might try new apps that could compromise their privacy, user experience, wallet and\/or security.<\/p>\n

The McAfee Mobile Research Team recently discovered a series of repackaged image editors on the Google Play app store which presented concerning behaviors. \u00a0McAfee Mobile Security products help protect against such apps, including those classified as Android\/FakeApp, Android\/FaceStealer, Android\/PUP.Repacked and Android\/PUP.GenericAdware.<\/p>\n

McAfee, a member of the App Defense Alliance<\/a> focused on protecting users by preventing threats from reaching their devices and improving app quality across the ecosystem, reported the discovered apps to Google, which took prompt action and the apps are no longer available on Google Play.<\/p>\n

We now discuss various types of privacy and\/or security risks associated with the types of apps recently removed from the app store.<\/p>\n

FaceStealer<\/h2>\n

\u201cPista <\/span>– <\/span>Cartoon Photo <\/span>E<\/span>ffect\u201d<\/span> and \u201cNewProfilePicture\u201d<\/span> are<\/span> example<\/span>s<\/span> of app<\/span>s<\/span> that <\/span>offered <\/span>compelling visual<\/span> results<\/span>,<\/span> however<\/span>,<\/span> each<\/span> was <\/span>based on the sam<\/span>e<\/span> image editor<\/span> with basic filters <\/span>and<\/span> trojanized<\/span> with Android\/<\/span>FaceStealer<\/span>,<\/span> which is <\/span>a well-known <\/span>malware<\/span> capable of <\/span>compromis<\/span>ing<\/span> a <\/span>victim\u2019s Facebook<\/span> or Instagram<\/span> account.<\/span> The<\/span> app<\/span>s<\/span> could<\/span> capture user <\/span>credentials <\/span>during a<\/span> Facebook login <\/span>by<\/span> embed<\/span>ding<\/span> a javascript function <\/span>loaded from <\/span>a <\/span>remote server<\/span> (to evade detection)<\/span> into a flutter webview activity that <\/span>displays <\/span>the <\/span>F<\/span>acebook login<\/span> screen<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/div>\n

\u201cNewProfilePicture\u201d and \u201cPista \u2013 Cartoon Photo Effect\u201d are examples of FaceStealer malware that posed as a cartoon avatar creator.<\/p>\n

The same <\/span>image<\/span> editor <\/span>which was <\/span>repackaged into the above two apps <\/span>has <\/span>also<\/span> been <\/span>repackaged<\/span> alternatively <\/span>with adware modules and distributed by <\/span>other<\/span> developers<\/span> under<\/span> other <\/span>app <\/span>names<\/span>,<\/span> such as \u201cCartoon Effect | Cartoon Photo<\/span>\u201d:<\/span> <\/span>\u00a0<\/span><\/p>\n

 <\/p>\n

\"\"<\/p>\n

Fleeceware<\/h2>\n

Fleeceware refers to mobile apps that use various tactics to enroll users into subscriptions with high fees, typically after a free trial period, and often with little or no value to the subscriber beyond cheaper or free alternatives. If the user does not take care to cancel their subscription, they continue to be charged even after deleting the app.<\/p>\n

\u201cToonify Me\u201d, which is no longer available on the Play Store, cost $49.99 per week after 3 days \u2013 almost $2,600 per year \u2013 for what featured<\/span> AI-generated illustrations <\/span>in the app description<\/span>,<\/span> but<\/span> was<\/span> a<\/span>nother<\/span> repackaged<\/span> version of the same image <\/span>editor<\/span> functionality <\/span>found within <\/span>\u201cNewProfilePicture\u201d and \u201cPista \u2013 Cartoon Photo Effect\u201d<\/span>.<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/div>\n

In this case, the \u201cToonify Me\u201d app did not allow feature access without enrolling in the subscription, and the \u201cCONTINUE\u201d button which initiated the subscription was the only option to tap in the app once it was launched.<\/p>\n

Adware<\/h2>\n

Promoted by ads<\/span> that described<\/span> it <\/span>as <\/span>capable of transforming<\/span> picture<\/span>s<\/span> into<\/span> artistic draw<\/span>ings,<\/span> the \u201c<\/span>Fun Coloring \u2013 Paint by Number<\/span>\u201d<\/span> app <\/span>is an example of <\/span>a <\/span>repackaged <\/span>version of a different, legitimate<\/span> pixel <\/span>painting <\/span>app<\/span>.\u00a0 It <\/span>lacked <\/span>the advertised AI effects and was <\/span>plagued with adware-like behavior<\/span>.\u00a0<\/span><\/span>\u00a0<\/span><\/p>\n

\"\"<\/p>\n

Advertisement of \u201cFun Coloring \u2013 Paint by Number\u201d on social media which included app store link<\/span><\/span>\u00a0<\/span><\/p>\n

Consistent with many rev<\/span>iews complaining about unexpected ad<\/span>s <\/span>out of the context of the app<\/span>, o<\/span>nce installed<\/span>,<\/span> the app <\/span>start<\/span>ed<\/span> a service <\/span>that <\/span>communicate<\/span>d<\/span> in the background with <\/span>F<\/span>acebook <\/span>G<\/span>raph <\/span>API<\/span> every 5 seconds<\/span> and might pull ads based on received commands<\/span> after some time of execution<\/span>.<\/span> The app contained<\/span> multiple <\/span>injected <\/span>SDK<\/span> modules from <\/span>AppsFlyer<\/span>, <\/span>Fyber<\/span>, <\/span>InMobi<\/span>, <\/span>IAB, <\/span>Mintegral<\/span>, <\/span>PubNative<\/span> and <\/span>Smaato<\/span> (<\/span>none of which are <\/span>in the original app<\/span>,<\/span> which was repackaged<\/span> to <\/span>include these<\/span>)<\/span>, which would help<\/span> monetize <\/span>installations without regard for user experience.<\/span><\/span>\u00a0<\/span><\/p>\n

Conclusion<\/h2>\n

When new types of apps become popular and new ones appear on the market to offer similar features, users should act with caution to avoid becoming victim to those wanting to exploit public interest.<\/p>\n

When installing an app that causes you doubt, make sure you:<\/p>\n