Pose like an American company: A Russian software company leaves code in thousands of apps

Posing as an American company
A Russian software company leaves code in thousands of apps

11/16/2022 11:32 PM

Google, Apple, and many US authorities have long assumed that software maker Pushwoosh is an American company. But then there are doubts. According to one report, the company hails from Russia. The founder claims he has never hidden his origins.

According to the Reuters news agency, thousands of apps in Apple’s and Google’s online stores contain code from Pushwoosh, which claims to be an American company but is based in Russia.

Pushwoosh provides code and data handling assistance to software developers. They can use it to create profiles of users’ online activities and thus send personalized notifications. Among the customers was the US military, which stopped using it in March for security reasons. The US Agency for Disease Control and Prevention (CDC) removed the Pushwoosh code from its apps after Reuters pointed out the Russia connection. “The CDC assumed Poochoosh to be a Washington, D.C., area company,” a spokeswoman said.

In fact, in the US, the company pretends to be an American company in official documents and on social media, which is said to be based in California, Maryland, or Washington County at various times. However, as evidenced by documents publicly available in Russia, the headquarters are located in Novosibirsk. About 40 people work there, and the turnover last year amounted to the equivalent of $2.4 million. Pushwoosh is registered with the Russian authorities and pays taxes in Russia.

Russia requests user data from companies

In the past, officials in Russia have forced local companies to hand over users’ data to secret services. There were no indications of misuse of the data collected by Pushwoosh. “The data Bochoosh collects is similar to what Facebook, Google or Amazon might collect,” said security researcher Zack Edwards, who discovered the company’s code spread while working at Internet Security Labs. “But the difference is that all Pushwoosh data in the US is sent to servers controlled by a company in Russia.”

Google and Apple declined to comment specifically on Pushwoosh. According to Appfigures experts, the company’s icon can be found on nearly 8,000 apps in their stores. Bochoosh founder Max Konev said in an email to Reuters in September that his company had never tried to hide its Russian roots. “I am proud to be Russian and will never hide it,” he wrote. After publishing the research, the company clarified in a blog post that it had never owned a company registered in the Russian Federation. Instead, Bouchouche outsourced some of the tasks to a Russian company in Novosibirsk. This contract was terminated in February 2022. Pushwoosh data will be stored in the United States and Germany.