Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My iPhone has sent/received 900MB in 15 days from "com.busuu.japanese.a" I got this information from Onavo, which 'compresses' my data.

I have never heard of Busuu until today. It is a language learning service.

My iPhone is not jailbroken. I have used Chinese wall chargers, if that was actually a real thing.

How is this happening? Is it possible to install an invisible background application? At 900MB I would expect that my phone is a botnet node or a spam server.

Please help. This is frightening.

edit:

  • May 2013 - 50MB (from identifier com.busuu.japanese...)
  • June 2013 - 200MB
  • Half of July 2013 - 900MB
share|improve this question
3  
apple.stackexchange.com/questions/96446/… cross posting is highly discouraged. –  Lucas Kauffman Jul 15 '13 at 19:28
    
Yeah, I figured. I'll take down the Ask Different. Just wanted to get as much attention as possible. I'm pretty desperate, 900MB in 15 days! –  user Jul 15 '13 at 20:00

3 Answers 3

I'm the Head of Mobile at busuu. One of our web devs found this thread while investigating a problem with our site.

The entire set of content for our Japanese app runs to about 110MB in total, across five downloadable bundles. That download process is kicked off manually by the user and entirely in the foreground while the app is running. We also use analytics and ads, but if those were using that much data we'd know immediately.

Assuming Onavo is accurate, looks like something has hijacked our name for nefarious purposes - thanks for flagging it. If the OP didn't have busuu installed, whatever that something is is clearly not just parasitically stealing another valid process name on the device, so we might be baked into someone's malware. Yay.

Will be watching for this now. Any further info appreciated.

share|improve this answer
    
OP here. I had never heard of Busuu until seeing the strange identifier. Do you have an affiliate program? If so, you might want to investigate your top earners. Or maybe your bundle identifier was knowingly stolen (from a cheap host/repo perhaps?) so it could clear Apple's authentication- it being on the list of accepted identifiers. Whatever the case, I don't blame Busuu in the least. Hope you can sort out this mess with little trouble. –  user Sep 27 '13 at 18:27

I'm not sure why it's happening, it could be malware, but I haven't heard of malware in the wild which was sent through wall sockets, but it is possible(courtesy of Xander) .

Now if I were you I'd start with reformatting your iphone completely. Reinstall it from scratch, you should be ok with keeping your contacts.

share|improve this answer
    
I was looking for an article I'd read about a malicious charging station PoC, and found this instead. dailytech.com/… –  Xander Jul 15 '13 at 19:34
    
Would a backup still store hidden scripts? Because I've found record of com.busuu.japanese from May. –  user Jul 15 '13 at 20:23
3  
I didn't say backup, I said clean install :) –  Lucas Kauffman Jul 15 '13 at 20:30
    
I realize that is what you said, but I'm still asking. I have notes, pictures, and in-app settings I would like to keep if I knew backups ignored any hidden files. –  user Jul 15 '13 at 20:46
    
Just nuke it from orbit and start again. If problems persist, consult your healthcare professional. –  NULLZ Jul 16 '13 at 6:03

Follow-up for those curious:

I followed the advice of the commentators and nuked it. Everything seems normal now.

I found other people on forums who had the same problem, and linked it to the com.busuu.japanese.app process on their phone. They lost about 1GB of data in 15 days too.

The company Busuu doesn't seem to be malicious but obviously one of their affiliate marketers is.

The suspected culprit is either Chinese USB to 110V chargers, Chinese 'lightning' cables, or this Chinese app call Real Strike I downloaded while on a augmented reality streak. (Basically just blame it on China)

I'm wary of the possibility to install a hidden application from the code of an app-store app (through an obfuscated static library that calls private API's? I have no idea. Just making things up now.), and I hope this gets some attention before hundreds of people get screwed by maniacal script kiddies.

Oh- and a good number of people with this problem (that don't have a suspicious application bundle ID associated with the data loss) have an email in their outbox addressed to a non-existent address. It retries the email every few seconds indefinitely and reaps data.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.