Sonic Apps Put More Than 120 Million at Risk

There are many fake apps in the Google Play Store that can destroy your privacy, but that's another story.

Sonic Dash, Sonic the Hedgehog Classic and Sonic Dash 2: Sonic Boom tracks much more user information than they need and can filter that information to third parties with shadows. Together, these games have over 120 million downloads, which means that millions of Android users are exposed to a hedgehog security risk.


The information comes from Pradeo, a company security company based in Paris. Of course, Pradeo wanted to draw attention to the dangers of downloading games, but their secondary message is pretty clear: if a big company like Sega can run into poor security, that's going to be too much for you.

The problems with the applications are pretty simple. If you want to spend time with your favorite Fire Blue Hedgehog during your daily journey, you will also be given permission to access your website. Aside from the question of why a non-augmented reality game actually needs a location, Pradeo noted that the three apps communicate user locations with 11 different servers, including three that are not certified. Two of these three servers use an Android / Inmobi.D protocol, which is recognized by most anti-virus programs as adware distributors.

In addition, Pradeo discovered 15 vulnerabilities in the Open Web Application Project (OWASP) that could lead to "denial of service" [and] leakage of confidential data, according to the company's report as a mediator attacks and weaknesses in the encrypted data transfer of an application. The bottom line is that the vulnerabilities are low and there probably is not anyone who exploits them, but they are completely useless and should not initially be applied at a higher level.

Currently, Sega is investigating the problem and should soon have a solution, according to ZDNet's correspondence with the company. Fortunately, most users now have a solution. Android users (version 6.0 and above) can individually enable or disable permissions in their preferences. (Tap Settings, Apps, Sonic app, Permissions). The games will work even if you disable the location, contacts, and storage permissions so you can still play without worrying about Sega's filtering of your personal information.