Android apps can ask for or require certain permissions on the device, including access to body sensors, calendar, camera, contacts, location, microphone, phone, SMS, storage, Wi-Fi, and access to Google accounts. [186]
In July 2017, Google described a new security effort called "peer grouping", in which apps performing similar functionalities, such as calculator apps, are grouped together and attributes compared. If one app stands out, such as requesting more device permissions than others in the same group, Google's systems automatically flag the app and security engineers take a closer inspection. Peer grouping is based on app descriptions, metadata, and statistics such as download count. [187] [188]
Security issues
In early March 2011, DroidDream, a trojan rootkit exploit, was released to the then-named Android Market in the form of several free applications that were, in many cases, pirated versions of existing priced apps. This exploit allowed hackers to steal information such as IMEI and IMSI numbers, phone model, user ID, and service provider. The exploit also installed a backdoor that allowed the hackers to download more code to the infected device. [189] The exploit only affected devices running Android versions earlier than 2.3 "Gingerbread". [190] Google removed the apps from the Market immediately after being alerted, [191] but the apps had already been downloaded more than 50,000 times, according to Android Police's estimate. [189] Android Police wrote that the only method of removing the exploit from an infected device was to reset it to a factory state, although community-developed solutions for blocking some aspects of the exploit were created. [191] A few days later, Google confirmed that 58 malicious apps had been uploaded to Android Market, and had been downloaded to 260,000 devices before being removed from the store. [192] Google emailed affected users with information that "As far as we can determine, the only information obtained was device-specific (IMEI/IMSI, unique codes which are used to identify mobile devices, and the version of Android running on your device)" as opposed to personal data and account information. [192] It also announced the then-new "remote kill" functionality, alongside a security update, that lets Google remotely remove malicious apps from users' devices. [192] However, days later, a malicious version of the security update was found on the Internet, though it did not contain the specific DroidDream malware. [193] New apps featuring the malware, renamed DroidDream Light, surfaced the following June, and were also removed from the store. [194]
At the Black Hat security conference in 2012, security firm Trustwave demonstrated their ability to upload an app that would circumvent the Bouncer blocker system. The application used a JavaScript exploit to steal contacts, SMS messages, and photos, and was also capable of making the phone open arbitrary web pages or launch denial-of-service attacks. Nicholas Percoco, senior vice president of Trustwave's SpiderLabs advanced security team, stated that "We wanted to test the bounds of what it's capable of". The app stayed on Google Play for more than two weeks, being repeatedly scanned by the Bouncer system without detection, with Percoco further saying that "As an attack, all a malware attacker has to do to get into Google Play is to bypass Bouncer". Trustwave reached out to Google to share their findings, but noted that more manual testing of apps might be necessary to detect apps using malware-masking techniques. [195] [196]
According to a 2014 research study released by RiskIQ, a security services company, malicious apps introduced through Google Play increased 388% between 2011 and 2013, while the number of apps removed by Google dropped from 60% in 2011 to 23% in 2013. The study further revealed that "Apps for personalizing Android phones led all categories as most likely to be malicious". [197] [198] According to PC World , "Google said it would need more information about RiskIQ's analysis to comment on the findings." [199]
In October 2016, Engadget reported about a blog post named "Password Storage in Sensitive Apps" from freelance Android hacker Jon Sawyer, who decided to test the top privacy apps on Google Play. [200] Testing two applications, one named "Hide Pictures Keep Safe Vault" and the other named "Private Photo Vault", Sawyer found significant errors in password handling in both, and commented, "These companies are selling products that claim to securely store your most intimate pieces of data, yet are at most snake oil. You would have near equal protection just by changing the file extension and renaming the photos." [201] [202]
In April 2017, security firm Check Point announced that a malware named "FalseGuide" had been hidden inside approximately 40 "game guide" apps in Google Play. [203] The malware is capable of gaining administrator access to infected devices, where it then receives additional modules that let it show popup ads. The malware, a type of botnet, is also capable of launching DDoS attacks. [204] [203] After being alerted to the malware, Google removed all instances of it in the store, [204] but by that time, approximately two million Android users had already downloaded the apps, the oldest of which had been around since November 2016. [203]
In June 2017, researchers from the Sophos security company announced their finding of 47 apps using a third-party development library that shows intrusive advertisements on users' phones. Even after such apps are force-closed by the user, advertisements remain. Google removed some of the apps after receiving reports from Sophos, but some apps remained. When asked for comment, Google didn't respond. [205] In August 2017, 500 apps were removed from Google Play after security firm Lookout discovered that the apps contained an software development kit that allowed for malicious advertising. The apps had been collectively downloaded over 100 million times, and consisted of a wide variety of use cases, including health, weather, photo-editing, Internet radio and emoji. [206] [207]
In all of 2017, over 700,000 apps were banned from Google Play due to abusive contents; this is a 70% increase over the number of apps banned in 2016. [208]
In March 2020, Check Point discovered 56 apps containing a malware program that had infected a total of 1 million devices. The program, called Tekya, was designed to evade detection by Google Play Protect and VirusTotal and then fraudulently click on ads. Around the same time, Dr. Web discovered at least six apps with 700,000 total downloads containing at least 18 modifications program called Android.Circle.1. In addition to performing click fraud, Android.Circle.1 can also operate as adware and perform phishing attacks. [209]
On July 1, 2021, Dr. Web discovered malicious apps on Google Play that steal Facebook users' logins and passwords. Their specialists uncovered 9 trojans that were available on Google Play Store with over 5.8 million installs among them. The apps tricked victims into logging into their Facebook accounts and hijacked the credentials via JavaScript code. [210] Google removed these apps later on. [211]
On September 29, 2021, Zimperium zLabs recently discovered a large-scale malware campaign has infected more than 10 million Android devices from over 70 countries and likely stole hundreds of millions from its victims by subscribing to paid services without their knowledge. GriftHorse, the trojan used in these attacks, was discovered by researchers who first spotted this illicit global premium services campaign. This campaign has been active for roughly five months, between November 2020 and April 2021, when their malicious apps were last updated. The malware was delivered using over 200 trojanized Android applications delivered through Google's official Play Store and third-party app stores. Google has removed the apps after being notified of their malicious nature but this malware are still available for download on third-party repositories. [212]
On November 30, 2021, ThreatFabric, researchers explain how they discovered four different malware dropper campaigns distributing banking trojans on the Google Play Store. This evolution includes creating small realistic-looking apps that focus on common themes such as fitness, cryptocurrency, QR codes, and PDF scanning to trick users into installing the app. Once these "dropper" apps are installed, they will silently communicate with the threat actor's server to receive commands. When ready to distribute the banking trojan, the threat actor's server will tell the installed app to perform a fake "update" that "drops" and launches the malware on the Android device. [213]
