Kimbho saga: Fake apps continue to thrive, pose threat

“The Indian security community was able to find multiple critical security issues in the Kimbho app within hours of the launch. It was evident that the app was built by developers who had zero idea about security,” said Rahul Sasi, founder and chief technology officer at machine learning based cloud security company CloudSek.

The original app was "developed by newbies, and there was zero security level. Many ports were open, and even chat admin was easy to access," said Manan Shah, founder and CEO of Gujarat based cybersecurity firm Avalance Global Solutions.

He added that even though the data has been removed from the app web domain, there are several test pages that can still be accessed.

Kimbho, which is the Sanskrit equivalent of “what’s up?” was launched by Baba Ramdev’s fast-moving consumer group Patanjali last Wednesday.

However, following backlash from the security community on Twitter, including from a French security researcher who goes by the name of Elliot Alderson, the app was taken off Google Play Store as well as Apple’s app store.

The company cited extremely heavy traffic for withdrawing the app and later also said that the launched app was a trial version. It also warned users against the several fake apps doing the rounds.

Also read: Copycats of Patanjali's Kimbho app crop up on Google Play Store

“Scammers will try any means necessary to trick you into installing a fake app. Criminals use emails and SMS messages that appear to be from your bank, credit card company or other brands to trick people into downloading applications that will compromise their data,” notes security company Norton in a post.

“In the case of Kimbho, the app was storing all users data (messages, personal info) on the server unencrypted, because of this (security researchers) was able to read anyone's messages, personal info, etc. The app developers had zero knowledge about security,” said Sasi.

In a blog, Cloudsek explains how a seemingly harmless application it once found, about Christmas and Santa Claus was accessing contacts, SMS, call records, location information, calendar, camera, camera shots, video, environment recording, browser history, programme information, SIM card information and device status.

The malicious app also had a way to record anything the user spoke upon entering or leaving from a particular area.