"Draw over other apps" -permission allows it pretty much steal anything on your UI, including things you type on the keyboard (read: passwords). On top of that an anonymous server in Hong Kong... uh oh...