If you’ve ever bought an Android phone, there’s a good chance you booted it up to find it pre-loaded with junk you definitely didn’t ask for. These pre-installed apps can be clunky, annoying to remove, rarely updated… and, it turns out, full of security holes. Security firm Kryptowire built a tool to automatically scan a large number of Android devices for signs of security shortcomings and, in a study funded by the U.S.