Thousands of apps contain code from Russian company
©APA/AFP
According to the Reuters news agency, the code of the Pushwoosh company, which claims to be an American company but is based in Russia, can be found in thousands of apps in the online stores of Apple and Google. Pushwoosh provides code and data processing support to software developers. They can use this to build profiles of users’ online activities and thus send customized notifications.
Customers included the US military, however, its use was discontinued in March for security reasons. The US disease agency CDC removed the Pushwoosh code from its app after Reuters pointed to the Russia connection. A spokesperson said, “The CDC assumed Pushwoosh was a Washington DC area company.”
In fact, in the US, the company is posing as a US company in official documents and on social media, which at times is said to be based in California, Maryland or Washington County. However, as can be seen from publicly available documents in Russia, the headquarters is in Novosibirsk. About 40 people are employed there, and last year sales amounted to $2.4 million (2.31 million euros). Pushwoosh is registered with the Russian authorities and pays taxes in Russia. In the past, authorities in Russia have forced local companies to hand over user data to secret services.
There were no indications of misuse of the data collected by Pushvush. “The data that Pushwoosh collects is very similar to the data that Facebook, Google or Amazon collects,” said Zach Edwards, a security researcher who discovered widespread use of the company’s code while working for Internet Safety Labs. “But the difference is that all Pushwoosh data in the US is sent to servers controlled by a company in Russia.” Google and Apple declined to comment specifically on Pushwoosh. According to the experts at Appfigures, the company’s code can be found in about 8,000 apps in their store.
Pushwoosh founder Max Konev said in an email to Reuters in September that his company has never tried to hide its Russian roots. “I am proud to be Russian and I will never hide it,” he wrote. After the research was published, the company explained in a blog post that it had never owned any company registered in the Russian Federation. Rather, Pushvush outsourced some functions to a Russian company in Novosibirsk. This contract was to be terminated in February 2022. Pushwoosh’s data will be stored in the US and Germany.
Freelance twitter maven. Infuriatingly humble coffee aficionado. Amateur gamer. Typical beer fan. Avid music scholar. Alcohol nerd.
