Breaking Olds: Google Play Store Hosts Malicious Apps

May Ying Tee and Martin Zhang, writing for Symantec:

In recent times we’ve seen multiple malicious apps found in the Google Play Store by various cyber security firms, including Symantec, yet this problem doesn’t seem to be dissipating. We have uncovered another wave of malicious apps in the Play Store which have been downloaded more than 2.1 million times.

Does this surprise anyone? No? Okay. Lets call this “Breaking Olds”—old news, presented as new news. Today’s Breaking Olds headline: The Google Play Store is full of trash. 🗑

A total of 25 Android Package Kits (APKs), mostly masquerading as a photo utility app and a fashion app, were published under 22 different developer accounts […]
These 25 malicious hidden apps share a similar code structure and app content, leading us to believe that the developers may be part of the same organizational group or, at the very least, are using the same source code base.

What these apps do is essentially pose as a legitimate app (often from the same developer) so that you’ll install them. It initially functions as expected, but some time after a user first launches the app, it downloads a remote configuration file that hides the app icon so that the user won’t realize it’s still there. Classy.

Once the app’s icon is hidden, the malware begins displaying advertisements, which are shown even when the app is closed. Full-screen advertisements are displayed at random intervals with no app title registered in the advertisement window, so users have no way of knowing which app is responsible for the behavior.

It’s seems absolutely preposterous to think that a third party app can completely commandeer a device’s screen at any point in time. Ying Tee and Zhang recommend Android users install a strong antivirus app to help protect themselves from malware like this, and also that users only download apps from trusted sources, which, apparently, does include the Google Play Store. In the article, Ying Tee and Zhang also mentioned “Google Play’s rigorous security testing,” which seems like a funny way to describe whatever approval process Play store apps go through, given the circumstances.

I find it incredibly difficult to believe that anyone who truly cares about privacy or security would ever use an Android device. Imagine having to install antivirus software on your iPhone—there would be riots at Apple stores around the world.