Thousands of applications contain code from the Russian company
© APA / AFP
According to the Reuters news agency, code from Pushwoosh, which claims to be an American company but is based in Russia, can be found in thousands of apps in the Apple and Google online stores. Pushwoosh provides code and data handling assistance to software developers. They can use it to create profiles of users’ online activities and thus send personalized notifications.
Among the customers was the US military, which stopped using it in March for security reasons. The US Agency for Disease Control and Prevention (CDC) removed the Pushwoosh code from its apps after Reuters pointed out the Russia connection. “The CDC assumed Poochoosh to be a Washington, D.C., area company,” a spokeswoman said.
In fact, in the US, the company pretends to be an American company in official documents and on social media, which is said to be based in California, Maryland, or Washington County at various times. However, as evidenced by documents publicly available in Russia, the headquarters are located in Novosibirsk. About 40 people work there, and last year’s sales amounted to the equivalent of $2.4 million (2.31 million euros). Pushwoosh is registered with the Russian authorities and pays taxes in Russia. In the past, officials in Russia have forced local companies to hand over users’ data to secret services.
There were no indications of misuse of the data collected by Pushwoosh. “The data Bochoosh collects is similar to what Facebook, Google or Amazon might collect,” said security researcher Zack Edwards, who discovered the company’s code spread while working at Internet Security Labs. “But the difference is that all Pushwoosh data in the US is sent to servers controlled by a company in Russia.” Google and Apple declined to comment specifically on Pushwoosh. According to Appfigures experts, the company’s icon can be found on nearly 8,000 apps in their stores.
Pushwoosh founder Max Konev said in an email to Reuters in September that his company had never tried to hide its Russian roots. “I am proud to be Russian and will never hide it,” he wrote. After publishing the research, the company clarified in a blog post that it had never owned a company registered in the Russian Federation. Instead, Bouchouche outsourced some of the tasks to a Russian company in Novosibirsk. This contract was terminated in February 2022. Pushwoosh data will be stored in the United States and Germany.
