University of Michigan researchers have discovered that hundreds of applications in Google Play turn Android phones into a server that allow the user to connect the phone directly to a PC and leave open insecure ports available on the smartphone.

What does this mean? It means attackers can use the open insecure port to get into the smartphone and steal data, contacts, photos, music and install malware.

The researchers scanned 100,000 popular apps in the Google Play app store to determine if any of them allowed the user to connect directly to their PC to send text messages, transfer files or use the phone to connect to the Internet. They found that 1,632 apps allowed the connections, and of those, 410 had no or weak protection in allowing access to open ports. 57 of those were completely open basically allowing any hacker access.

Two apps are being called “particularly dangerous.” Wifi File Transfer, which has more than 10 million downloads allows an attacker to get full access to the phone because there is no authentication. The second, AirDroid, allows Android users full control of their PC through their Android phone. Because of an authentication flaw, malicious intruders could gain access through the port. When the researchers alerted the developers of the app, they patched it.

Nonetheless, there are numerous apps that are available through Google Play that contain this flaw. It is important to note that neither Google nor the user can fix the flaw—it is up to the app developers. The only thing you can do is to uninstall the vulnerable app.

The tip this week is that no matter what kind of smartphone you own, be cautious when downloading apps, including reading the app’s Privacy Policy and Terms of Use and keep up to date on vulnerabilities of apps that you have on your phone. Although they are convenient, not all apps need to be downloaded.

[View source.]