SEGA's Sonic Android Games Is Alleged To Be Leaking Users Data

SEGA's Sonic Android games has been accused of leaking users location data and device info,and the the Japanese video game publishers says that it’s investigating the claims.

The allegations were made by cyber security company Pradeo who identified three of the Sonic games that as responsible for leaking user location data and device info. The affected games are Sonic the Hedgehog Classic, Sonic Dash, and Sonic Dash 2: Sonic Boom. Based on the download estimate offered by Google Play Store, between 120 million and 600 million users could be affected by the leaks from the trio.

The mentioned games are said to collect the data and info and then sending it to uncertified servers, likely for marketing purposes. Out of three servers accepting the information, two are used to host the Android/Inmobi.D advertisement library which is widely considered to be a security threat.

Pradeo also said it found two critical issues that could make it possible for malicious third parties to intercept sensitive data. The security firm also identified a number of issues that could potentially lead to encryption weakness and denial of service attacks. On average, Pradeo said the Sonic games have 15 vulnerabilities each.

None of the issues identified by the company appear to be affecting Sonic Runners Adventure, a new version of SEGA’s autorunner revised and published by Gameloft.

In response to all these allegations, SEGA says that it’s checking to determine the veracity of the claims, promising to take quick corrective actions if any its third party partners is found to be responsible for the claimed leaks.

Malware issues are not new on Play Store. Just earlier this month, another security firm Check Point found malware hidden in 22 apps within the Store, which had been downloaded between 1.5 million and 7.5 million times.

As with the malware on Sonic games, most malware are created to help generate ad revenue by repeatedly displaying pop-up adverts in ways that forced the user to click them before they could continue using their device.