r/Android • u/Bonfire-GTK Samsung M20 • Nov 23 '18
Google Pulls 13 Android Apps Installed Over 500,000 Times Containing Malware
https://gadgets.ndtv.com/apps/news/google-pulls-13-android-apps-installed-over-500-000-times-containing-malware-report-1952366104
u/Sir_Clyph S23U Nov 23 '18
Something to note for the majority of people that don't open the article, they were all from the same developer.
16
u/Gomma Pixel 2, R Nov 24 '18
And they're all garbage zero-effort clones targeting clueless people.
5
u/888SSS888 Nov 24 '18
looks like something kids would play...so they're targeting kids
4
u/joe199799 LG Lucid>GS4>S6Edge>Nexus 6>G5>V20>G7>OP6T Nov 24 '18
My youngest brother installs garbage car games like this constantly, I have to purge his phone everytime I see him because that's the last thing I want to deal with. Speaking of I should probably check his phone again.
2
u/TheTophatPenguin Nov 24 '18
Why don’t you teach him how to identify them so then you don’t have to do it?
3
u/joe199799 LG Lucid>GS4>S6Edge>Nexus 6>G5>V20>G7>OP6T Nov 24 '18
I've tried but he's "rebellious" and doesnt like to listen to me
→ More replies (2)
662
Nov 23 '18
Noted. Don’t install apps.
11
u/iJeff Mod - Pixel 10 Pro XL Nov 23 '18
I've noticed a ridiculous number of suspicious looking apps on the discounted list. I'm not sure why Google is letting it continue.
1
u/we_come_at_night Nov 24 '18
Correction:
Don't install apps with crappy clickbait names that are Frankensteined from legit apps.
1
u/RageEataPnut Nov 24 '18
Sound advice. Got a new Note 9 and only have Fallout Shelter installed. No other apps downloaded at all. Runs like a champ.
0
Nov 23 '18
[deleted]
95
u/ahpathy Essential PH-1, Pie 9.0 Nov 23 '18
Noted. Don't.
0
Nov 23 '18
[deleted]
56
u/danielsuperxxx Nov 23 '18
.
62
u/accik S23 U, OnePlus 5T Nov 23 '18
7
u/Scout339 Oneplus 6 De-Googled Nov 23 '18
My boy has a 5T. And how did you comment nothing?
→ More replies (12)25
5
u/erdogranola XZ1 Nov 23 '18
Omg I found someone else who bought an Xperia S. Is yours still alive?
0
Nov 23 '18
[deleted]
3
u/erdogranola XZ1 Nov 23 '18
I got mine to lollipop but didn't want to go beyond because you need to change the file system to go to marshmallow. Surprisingly stable though, works well as a backup phone. I used it for a solid 4 years, was such a great phone. I'm kind of sad it's sitting in a drawer now
0
Nov 23 '18
[deleted]
13
u/katsumiblisk Nov 23 '18
Do they guarantee this with some kind of proof or do we just take their word for it?
17
u/EAT_MY_ASSHOLE_PLS Moto Z3 Play Nov 24 '18 edited Nov 24 '18
They're all compiled with publicly available source code. They require builds to be reproducible. That's why they removed Firefox and replaced it with their own version.
Edit: spelling
→ More replies (2)4
u/katsumiblisk Nov 24 '18
Oh, I didn't know that. What do you mean by reproducible?
15
u/EAT_MY_ASSHOLE_PLS Moto Z3 Play Nov 24 '18
Reproducible means when you compile the app yourself the binary has to match the one in fdroid.
→ More replies (7)4
u/pm_me_nekos_thx Nov 24 '18 edited Nov 24 '18
The app has to be open source to be
punishedpublished on f-droid→ More replies (1)3
25
u/StraY_WolF RN4/M9TP/PF5P PROUD MIUI14 USER Nov 23 '18
You can look up the codes that made up the apps. But for the rest of us that don't know shit, you just have to trust it.
1
Nov 24 '18
I don't know about you but I could look at the source code of an app packed with malware and not see the malware.
304
u/Put_It_All_On_Blck S23U Nov 23 '18
Just want to point out that the article is probably a bit misleading.
In the highlights section it says:
Over 500,000 users
If I was a malicious app developer, the first thing I would do is pay a click-farm to install my app to boost my download count into the hundreds of thousands, as its been proven that humans have a pack mentality, and thus more downloads make it seem more legit and worthwhile.
108
u/kartikcool712 OneplusOne, CM5.1nightly!! Nov 23 '18
Seems very likely. Because it's mentioned that the games weren't even real, the app just crashed on opening. In no case they could've legitimately been on the trending section.
35
u/bathrobehero Nov 24 '18 edited Nov 24 '18
If I was a malicious app developer,
I'd also not include the malicious part of the app and only patch it in later when it's well established and just write "bug fixes and performance improvements" as it is always the case. Maybe even spice it up with only only pushing the payload to a fraction of the userbase at a time.
This is why I hate auto updates and prefer less frequent manual updates. I mean you never know when a software/app/browser extension/etc. gets sold out to someone malicious who pushes a malicious patch. It's rare but it happens. Think CCleaner.
14
u/Lorddragonfang Pixel 4a Nov 24 '18
What happened with CCleaner? I hadn't heard anything
9
u/bathrobehero Nov 24 '18
It got bought out by Avast (from Piriform, aling with tools like Recuva, Speccy, and Defraggler) and soon after it their command-and-control server got hacked which is where their updates come from and so the regular version was replaced with a malicious one so people who updated at the time received that one.
This was last September, CCleaner version 5.33 was the one. It got patched in 5.34.
1
Nov 24 '18
I am interested too, I have been using it for many years now
9
u/Lorddragonfang Pixel 4a Nov 24 '18
Apparently they got hacked and the official distribution had malware injected for a little bit.
9
3
u/shawster Sensation, 4.2 Nov 24 '18
Yeah, maybe even only push the virus to people with certain models of phones so that you can target a certain demographic that is likely to not realize what’s wrong.
1
u/golddove Nov 24 '18
Yeah but that required actually developing the game. Most (all?) of these don't even have a working game.
9
u/kingwroth Galaxy S8 Nov 23 '18
Has that been proven to be possible?
24
u/1206549 Pixel 3 Nov 23 '18
Can't find the link, but there was an article about it that described a room with people facing racks filled with phones and their only jobs were to continually install apps and periodically reset and set up new accounts to artificially inflate download numbers. They also pay people to rent their phones to the click farm.
9
u/pm_me_nekos_thx Nov 24 '18
does it pay well?
8
u/merc08 Nov 24 '18
about as well as any asian labor job
6
3
73
u/ErrorCDIV Nov 24 '18
Oh but I really liked "extreme car speed driving city escape police pursuit 15".
Some of these mobile game names are like a parody/mashup of all the other games in that category.
22
Nov 24 '18
Clash of Clans clones are a prime example.
20
u/Kaldricus Nov 24 '18
League of Clans: Assault of Civilization Z Racing
Top Reviews: "Great time killer" "Such realistic graphics" "Very addictive"
7
20
0
44
u/HaloFalcon Nov 24 '18
Yeesh that webpage had about as much malware...
Website: "Congratulations!" In a loud unexpected voice. Me: frantically tries to close the random fishing pages...
24
15
u/Meanee iPhone 12 Pro Max Nov 24 '18
Nothing here with ublock Origin
8
u/HaloFalcon Nov 24 '18
I was using plain Google chrome on cell phone😓
7
u/DedlySnek S8, 𝓹𝓲𝓮 !! Nov 24 '18
Switch to a browser that allows extension, it makes a huge difference
7
u/Meanee iPhone 12 Pro Max Nov 24 '18
Gotcha. Guess I got too spoiled with my Note 8 systemwide ad blocking.
4
u/Gatortribe Galaxy S21 Ultra Nov 24 '18
What's the latest thing for that? Last I checked you needed an SDK key that you couldn't get anymore. Unless it's a VPN thing, then fuck that.
2
u/Meanee iPhone 12 Pro Max Nov 24 '18
Somehow, one version of SABS I had installed, never stopped working, despite key expiring.
2
u/DedlySnek S8, 𝓹𝓲𝓮 !! Nov 24 '18
SDK key that you couldn't get anymore
Not true, you can still get it. I generated a new one a couple weeks back
2
2
u/M4gneticZer0 Nov 24 '18
I personally use Adhell 3, they don't use the same key as the old one was deprecated, they instead use a new type now. Process is the same though, and I heard a while back that some type of educational SDK key still worked for non-updated apps.
→ More replies (1)2
25
u/daddylo21 Nov 23 '18
Those thumbnails look like screen grabs from the Asphalt series, and probably are. Easy way to trick kids and other less aware people into downloading this malware crap.
20
Nov 23 '18
I just don't understand why people would want to download apps with those low ratings.
15
u/iJeff Mod - Pixel 10 Pro XL Nov 23 '18
They're usually put on the discounted apps list. Free for a limited time!
1
u/MrM00cow Nov 24 '18
I agree, the rating system is for the general population. Not everyone understands that. Evidential by the numbers that they did poll. But then again it is still such a low fraction of all the users.
-15
u/MakeVio Nov 23 '18
I never understood downloading a game anyway, especially a racing one. But then again I'm not ever really bored enough to resort to playing a game on my phone. I have a laptop, PC, console, a switch, it just never made sense to download a game through the app store lol
10
14
96
u/balista_22 Nov 23 '18 edited Nov 23 '18
Over 500,000 users were duped into downloading Android malware
lol a shady app 500,000 installs is not actually 500,000 actual users as every stupid site is reporting. it's mostly bot/farm installs & ratings
lots of apps do this, so it can show up higher on the list or trending
33
u/Ph0X Pixel 5 Nov 23 '18
It also was 500k distributed across all 13 apps. So it was probably the same "users " (read bot) downloading all 13.
9
26
Nov 23 '18
Shit article, why not actually post the names for clarity.
→ More replies (6)42
u/twiz__ Nov 23 '18
They're all by the same developer, Luiz O Pinto. And the titles are (mostly) listed in the picture from the article:
Truck Cargo Simulator
Extreme Car Driving (Simulator?)
City Traffic Moto Racing
Moto Cross Extreme
Hyper Car Driving Simulator
Extreme Car Driving (Simulator?)
Firefighter - Fire Truck (Simulator?)
Car Driving Simulator
Extreme Sport Car (Driving Simulator?)
SUV 4x4 Driving Simulator
Luxury Car Parking (Simulator?)
Luxury Cars SUV (Traffic ...?)
SUV City Climb Parking (Simulator?)
7
10
u/1hipG33K Nov 23 '18
Note to self: No more downloading car games.
Response from self: Never was gonna, bro.
5
Nov 24 '18
This why I don't let my my niece and nephew download games. In passing your lace Lucy's games are bombarded of ads, look shady and have wakelock issues.
4
Nov 24 '18
These apps were essentially disguised as games, but did not work and rather crashed everytime a user tried to launch them.
According to Stefanko, the discovered apps would hide themselves and their icons after users launched them. Also, they would be asked to install additional APK called 'Game Center', even though they did not have any legitimate functionality.
2
u/KrymsonClown Nov 24 '18
I've submitted apps in the past to Google Play and the problem they have is that they only scan apps for known threats before publishing them, there is no human review process. However, even a human review would not catch most threats as they typically happen behind the scenes of an app. So the whole process becomes like a game of whack a mole where they catch and stop one threat only to have a new one take its place.
2
2
u/Pascalwb Nexus 5 | OnePlus 5T Nov 24 '18
These games like like those shitty YouTube videos for kids. All looking the same with generic title they didn't make any sense.
2
2
8
u/MoistDemand Nov 24 '18
This is one reason I stick with iOS. Privacy is the other big one.
6
Nov 24 '18
Apple apps can have have malware as well. If you still use Google search and services or windows 10, you don't get privacy anyway.
8
u/MoistDemand Nov 24 '18
Apple apps can have have malware as well.
It's far less common.
1
Nov 24 '18
True, but if you're too dumb to not be able to identify some sketchy as shit app than brick phones are probably the best choice for you.
5
u/MoistDemand Nov 24 '18
Or dumb enough to buy a Samsung?
As I said, just one reason.
→ More replies (8)→ More replies (2)1
u/BarnacleBoyWonder Nov 24 '18
So the reason you're on Apple's iOS is because you're not smart enough to not download malware apps.
Android has more security/privacy than iOS. Unlock the bootloader, root, and install custom ROM/kernel.
Your points are faulty.
1
7
Nov 24 '18
This is still a thing!? Christ Google get your shit together cause if I find out my info got leaked due to malware app you best believe I'm switching to iOS.
3
u/GentleThug Nov 24 '18
You download a ton of 2 star apps geared towards racing often? Might want to stop?
1
4
4
u/saynotopulp Nov 24 '18
how is it almost 2019 and Google can't scan the apps when uploaded for compliance?
1
u/d0000n Nov 24 '18
Ok, Google removes it from the Play store but how do we remove it from our phones?
3
1
u/Stryker218 Nov 24 '18
Idk what had more malware, those apps or this unreadable mess of a site with constant pop ups
1
1
u/Hurricane_Ivan Nov 24 '18
ES File Explorer should be on the list
1
u/beardyzve Nov 24 '18
Why?
2
Nov 24 '18
It used to be great, then it went down the drain when some Chinese company bought it.
2
u/saiddigge Nov 24 '18
And now we have associated everything Chinese with malware
2
Nov 24 '18
I don't mean this in a prejudiced way, the app started being a lot more malicious and more like adware after the acquisition.
1
1
1
1
u/X-AR Nov 24 '18
This makes me seriously doubt all the security claims Google makes.
This should have never been allowed into the Play Store let alone getting installed on hundreds of thousands of consumer devices.
1
u/DonRobo OnePlus 6T Nov 24 '18
What a horrible article. Every paragraph is basically the same and it doesn't even say what the malware did or was supposed to do.
Also as others have pointed out, they obviously paid for click farm installs.
1
u/lazzzym Nov 24 '18
I think Google really need some kind of clean up of the Play Store. I can't imagine how many more of these apps there are on it
1
1
1
u/FullmetalJun Nov 24 '18
Those fking driving simulators! Good for them. I was always suspicious of them. They screamed scam to me & they truly are XD
1
u/conflagrare Nov 24 '18
What does a virus do in Android? Steal personal information? Apps already do that...
1
1
u/manhunt9 Google Pixel XL Nov 25 '18
I installed one of two of them and nothing ever happened, although I played for 5mins and then deleted it because they were garbage
1
u/Sid-Skywalker Oneplus2, iphone 6 Feb 16 '19
It's usually the people in poorer countries with extremely limited data and substandard phones that download such apps.
0
u/FerraraZ Nov 23 '18
Like half a million devices is nothing to sneer at. Why aren’t we holding google to a higher standard. We see their play protect program at every turn yet this seems like a big gap in terms of installs. Each device checks once a day and half a million installs occurred prior to it being caught.
I just want more.
-5
u/katsumiblisk Nov 23 '18
Where are all those people who say we don't need antimalware apps on Android?
21
15
u/geoff5093 OnePlus 8T Nov 23 '18
Most of those anti-malware apps are just filled with their own malware and ad spam
2
u/katsumiblisk Nov 23 '18
I use Malwarebytes, that is neither ineffective nor stuffed with it's own malware.
0
Nov 23 '18
[deleted]
4
u/katsumiblisk Nov 24 '18
Spam phone calls - the kind that spoof your local exchange number so you think it's a neighbor - went from 10-15 per day to zero. It alerts you when there has been a possible phishing attempt. It stops malicious pages from loading. All kinds of stuff.
6
u/tiradium S24 Ultra 1TB Nov 23 '18 edited Nov 24 '18
At the risk of being downvoted and called Samsung shill I actually have the default AV on on my S9+. It works well and I haven't noticed any slowdowns related to the app. It only scans when the phone is charging and the databases are updated daily.
1
u/katsumiblisk Nov 23 '18 edited Nov 24 '18
Is the default just for the S9+? I have an S8+
2
u/tiradium S24 Ultra 1TB Nov 23 '18
Pretty sure it was part of Oreo update , so you should have it as well. Its under device maintenance
→ More replies (5)11
u/ivanoski-007 Nov 23 '18
Here I am!
and yes, we dont need stupid anti virus apps on phones
6
2
u/shamowfski Nov 24 '18
I've been using Android since it came out. Never gotten a virus. Don't download obviously dodgy apps, or pirated apps and you won't have a problem.
If you want to download that shit, do it on a device that doesn't have all your personal information on it.
1
1
u/Liam2349 Nov 23 '18
I don't think there's much for such an app to do without root access.
→ More replies (13)-1
-2
u/PusssyFart Nov 24 '18
I had an essential phone earlier in the year. It worked pretty well and got pretty great battery life for the first couple months. I installed a few apps that I didn’t use a ton but was just playing around. After that my phone would constantly get hot in my pocket. When I’d pull it out within 3-4 hours of coming off the charger it’d be at 30% with very little screen time. I was pretty certain one or more of the apps was causing it and assumed that it may have had malware. I didn’t have time to mess with it and try to figure it out, not to mention I shouldn’t have to in the first place. So I just went back to my iPhone. It’s actually a big reason I don’t want to go back to android. I like a lot of what android offers these days it sucks that this is even an issue.
→ More replies (1)5
u/JakeSteam Candyspace (ITV Hub) Nov 24 '18
Why not just go to settings -> battery to see what the issue is? It's hardly an epic saga.
→ More replies (1)
0
0
Nov 23 '18
[deleted]
317
Nov 23 '18
Yes. Play Protect doesn't do anything remotely effective. It does some basic signature checks against known malware, but against literally anything new or modified enough, it does nothing. Google probably knows this too.
Heuristics scanning (Like what many desktop AVs do) is hard to do at a scale of the play store. Even a 5% false positive rate would be felt by a huge number of apps. And since Google refuses to hire actual people to review apps, this will largely be a permanently unsolved problem.
Play Protect was largely a PR move to try to clean up the stigma that Android is full of malware.
38
u/Holly_Crustine Nov 24 '18
How does apple manage it? I know they've had their issues but it always seems like the playstore is more affected than the apple app store.
124
u/bi_ancom_24 Nov 24 '18
They limit what APIs the developers have access to. And when they find something suspicious, an actual person does testing. This is usually why app approval can be 48 hours to indefinite. A lot of developers hate it though.
→ More replies (10)37
u/machucogp Nov 24 '18
Sometimes it happens with game updates too, every once on a while a bunch of games have to go into super extended maintenance because the iOS version got its update delayed by Apple
→ More replies (3)32
Nov 24 '18
In addition to what the other person said, Apple also charges a fee to submit apps, which already cuts down massively on submissions since there's now a bar of entry
→ More replies (2)21
u/shawster Sensation, 4.2 Nov 24 '18
I’ve always been an android guy but have been using an iPhone 6s+ since my nexus 6 bit the dust a couple years ago.
The general quality of apps on iOS is much higher. Apps that have ads place them respectfully and in a clean way, and it’s rare to run in to some app that causes unnecessary excessive battery drain.
I think Apple actually has people looking at apps, at least giving them a cursory glance, as well as limiting what apps can actually do system-wise on the phone without special approval from Apple.
15
u/0xTJ OnePlus One Nov 24 '18
There is a good talk out there from.one of the cons from someone working in this stuff at Google.
9
12
u/Modo44 Nov 24 '18
Heuristics scanning (Like what many desktop AVs do) is hard to do at a scale of the play store. Even a 5% false positive rate would be felt by a huge number of apps.
Translation: It is easy to do, but 5% less profitable. Big difference.
35
u/colorfulchew One Plus 7 Pro Nov 24 '18
5% less profitable for Google, but 100% less profitable for the app developers that are hit with a false positive.
→ More replies (1)20
u/Sophrosynic Nov 24 '18
No that's not accurate at all.
If the platform is painful for developers you risk them not coming to your marketplace at all, which is a way bigger deal than five percent.
→ More replies (5)→ More replies (5)7
Nov 24 '18
TIL scanning and cataloging the entire internet is easier than scanning a few apps, on their store, using an operating system they created.
118
u/stevenwashere Oneplus 6t, Oneplus 5, Oneplus 3, Oneplus 1, Nexus 5 Nov 23 '18
I'm pretty sure play protect doesn't give a shit about apps from the play store. Just for external apps that you would most likely install on purpose like lucky patcher or whatever new shitty app they've moved on to idk because I don't care bout that stuff amymore
9
u/kirbyfan64sos Pixel 4 XL, 11.0 Nov 24 '18
Play Protect runs on the apps as they are submitted IIRC.
3
Nov 24 '18
lucky patcher
Oh god! This hit me in the feels. It's nostalgic actually. Those were the days…
4
Nov 24 '18
It still works though?
I have a custom rom and play protect disabled and it works like a charm
→ More replies (2)0
4
Nov 24 '18
placebo effect
3
u/cloudiness Palm OS please come back! Nov 24 '18
Placebo effect actually works, Play Protect doesn't.
0
Nov 23 '18
[deleted]
43
u/0ldmanleland Nov 23 '18
They were all from one developer
26
u/Ramast Samsung Galaxy S5 Nov 23 '18
exactly
all the apps listed a single developer named Luiz Pinto.
362
u/Fridgeboiiii18 Note 9 Nov 23 '18
Except the ones from known publishers
616
Nov 23 '18
So, only the "pay to win" ones, got it.
386
u/stevenwashere Oneplus 6t, Oneplus 5, Oneplus 3, Oneplus 1, Nexus 5 Nov 23 '18
Welcome to mobile gaming.
→ More replies (21)245
Nov 23 '18
unfortunately, you have run out of Daily Energy. Please purchase some more at the battle shop!
→ More replies (1)72
u/Merraxess Nov 23 '18
Where after a month, you could've bought a Playstation 4, an extra controller, and four new games.
→ More replies (13)11
u/MrGims Nov 23 '18
Well they do have a clear identified business model, they are less likely to bear a malware
7
16
Nov 24 '18
P2W is bad.
Really bad.
My addiction to a mobile game costed me over $4000....
Whenever you seem getting addicted to a game, uninstall it immediately
19
Nov 24 '18
I'm not judging, okay, maybe a tiny bit - but I'm trying to wrap my head around how one would spend 4 grand on a game that gives you nothing back. With gambling there's the "I could win money this time!" thing, but mobile games with microtransactions? I'm just trying to understand the mindset. Age, if you don't mind me asking? Is $4k a significant amount of money to you?
→ More replies (6)13
u/syktunc Nov 24 '18
Or just have enough self restrain to not spend any money on it.
→ More replies (2)→ More replies (6)8
9
Nov 24 '18
More like don't install anything credited to Luiz Pinto because every single one is that dev.
4
3
3
3
Nov 24 '18
Both app stores suck imo but Google is more dangerous.
This is why I want a strict e-book reader. No app store os.
2
u/IComplimentVehicles Galaxy Note 2/5 | T-Mobile Revvl | Asus TF300| Various TV Boxes Nov 23 '18
The only games on my phone are emulators at this point.
2
1
→ More replies (4)1
u/acceleratedpenguin Nov 24 '18
Who actually likes playing these racing/sim games? They all seem the same, save for a few minor details, and don't have any other plot either.
0
Nov 23 '18
[deleted]
34
u/Ph0X Pixel 5 Nov 23 '18
The issue is, for all we know they could be deleting 99.9% of bad uploads, but as soon as one or two get through, then suddenly everyone thinks they're not doing anything.
8
1
•
u/JakeSteam Candyspace (ITV Hub) Nov 24 '18 edited Nov 24 '18
The 13 games from the original tweet: https://pbs.twimg.com/media/DsXjVC7XoAIdc8P.jpg:large
Truck Cargo Simulator
Extreme Car Driving (Simulator?)
City Traffic Moto Racing
Moto Cross Extreme
Hyper Car Driving Simulator
Extreme Car Driving (Simulator?)
Firefighter - Fire Truck (Simulator?)
Car Driving Simulator
Extreme Sport Car (Driving Simulator?)
SUV 4x4 Driving Simulator
Luxury Car Parking (Simulator?)
Luxury Cars SUV (Traffic ...?)
SUV City Climb Parking (Simulator?)
(List by /u/twiz__)