A study released this week by researchers at Virginia Tech has found that not only do Android apps leak data but they also mine smartphone users’ data by secretly colluding with each other.

The study, described as the “first ever large-scale and systematic study of exactly how the trusty apps on Android phones are able to talk to one another and trade information” involved the analysis of more than 100,000 Android apps. It found that pairs of apps can trade information, a capability that can lead to serious ramifications in terms of security.

“Researchers were aware that apps may talk to one another in some way, shape, or form,” Assistant Professor Gang Wang said in a blog post. “What this study shows undeniably with real-world evidence over and over again is that app behavior, whether it is intentional or not, can pose a security breach depending on the kinds of apps you have on your phone.”

Interestingly, while the study found that malware apps that were specifically designed to steal information were obviously stealing data from other apps, standard non-nefarious apps were also engaging in what is described as security breaches, though in many cases unintentionally.

Nikolaos Chrysaidos, Avast Software s.r.o.‘s head of mobile threat intelligence and security, told SiliconANGLE that Android users should be cautious and not partake in risky behavior such as downloading apps from third-party sites.

“If an app contains malware, it is likely the goal of its developer to gather as much information about the user and to re-sell this on underground forums to support spamming, premium SMS cons and other lucrative schemes,” Chrysaidos said. “Given there is no need for such apps to be secure, a big percentage of this data is usually transferred over the network with no encryption, which adds further risk to the user and their data. Genuine apps also seek to collect user data.”

“Paid apps usually are looking to improve their service with this behavioral information,” he added. “Free apps may gather data as widely as possible again to improve their offering but also as a monetization strategy to enable greater targeted advertising opportunities. Finally, another category of apps known as potentially unwanted programs (often referred to as PUP) also pose a risk to user data. A good antivirus will detect these and flag to the customer who can then chose not to use the app if they are concerned.”

Image: mstable/Flickr