Pushwoosh Software in Apps: How Much Risk?

The US Army and CDC discovered that software used in their apps and thousands of others was developed by Pushwoosh, a Russian company presenting itself as a US-based company. Is the fallout "lots of noise" or a real risk?

2 Min Read
US and Russian flags
Alamy

On Nov. 16, Reuters reported that push notification company Pushwoosh is Russian in origin despite presenting itself as a US-based company. Pushwoosh code was present in apps used by the Centers for Disease Control (CDC) and the US Army.

Reuters determined that Pushwoosh is registered with the Russian government and pays taxes there, but this information is not included in US regulatory filings. Pushwoosh published a statement in response to the Reuters report denying that it is based in Russia.

"Pushwoosh Inc. is the sole proprietor of all IP rights assigned to Pushwoosh Service and a primary legal entity of the Pushwoosh brand. Pushwoosh Inc. is a privately held C-Corp company incorporated under the state laws of Delaware, USA. Pushwoosh Inc. was never owned by any company registered in the Russian Federation," according to the statement.

The company did not respond to Reuters' request for evidence supporting its statement.

Importance of Origins

Why would a company obscure its origins? "This could be for any number of reasons such as trying to avoid sanctions imposed by the US government, trying to appear to be from the US in order to seem more trustworthy, trying to avoid any anti-Russian bias, and trying not to appear to be a Russian government entity," Nigel Houghton, director of marketplace and ecosystem development at threat intelligence company ThreatQuotient, explains.

Related:Threat Hunting Basics: What You Need To Know

Regardless of the motivation, the question of Pushwoosh's origins is a question of risk. "There is a certain amount of risk involved in using any application like this, but one that is actively trying to hide the fact that it is a Russian-owned and operated business should raise red flags," Houghton contends.

With Pushwoosh code in thousands of apps, all different kinds of organizations are likely using it for customer engagement. The level of concern could depend on the user.

Read the rest of this article on InformationWeek.

Read more about:

InformationWeek

About the Authors

InformationWeek

InformationWeek, a sister site to ITPro Today, is a trusted source for CIOs and IT leaders seeking comprehensive and authentic coverage of the constantly evolving world of technology and its impact on business. Our experienced and ethical journalists conduct in-depth examinations of crucial issues and the impact of global events on IT operations and strategies, helping forward-thinking executives stay at the forefront of their industries. InformationWeek also provides a platform for enterprise IT leaders and leading tech companies to share their insights and experiences through exclusive interviews, opinion pieces, and events, offering firsthand accounts of strategies, trends, and innovations.

Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like