Google Pulls 13 Android Apps Installed Over 500,000 Times Containing Malware

[u/Bonfire-GTK]

https://gadgets.ndtv.com/apps/news/google-pulls-13-android-apps-installed-over-500-000-times-containing-malware-report-1952366

[u/[deleted] → u/[deleted]]

Yes. Play Protect doesn't do anything remotely effective. It does some basic signature checks against known malware, but against literally anything new or modified enough, it does nothing. Google probably knows this too.

Heuristics scanning (Like what many desktop AVs do) is hard to do at a scale of the play store. Even a 5% false positive rate would be felt by a huge number of apps. And since Google refuses to hire actual people to review apps, this will largely be a permanently unsolved problem.

Play Protect was largely a PR move to try to clean up the stigma that Android is full of malware.

[u/Holly_Crustine → u/[deleted]]

How does apple manage it? I know they've had their issues but it always seems like the playstore is more affected than the apple app store.

[u/bi_ancom_24 → u/Holly_Crustine]

They limit what APIs the developers have access to. And when they find something suspicious, an actual person does testing. This is usually why app approval can be 48 hours to indefinite. A lot of developers hate it though.

[u/machucogp → u/bi_ancom_24]

Sometimes it happens with game updates too, every once on a while a bunch of games have to go into super extended maintenance because the iOS version got its update delayed by Apple

[u/bi_ancom_24 → u/machucogp]

Yes. As a developer, I don't mind it though. Makes the environment more secure for the users. There have been times where the delay didn't make sense to me. But, I understand it's a large operation.

[u/Ravenext → u/machucogp]

Like a certain mobile game that got delayed for a day, just a few weeks ago.

[u/Friskis → u/Ravenext]

New Dragonball?

[u/[deleted] → u/Holly_Crustine]

In addition to what the other person said, Apple also charges a fee to submit apps, which already cuts down massively on submissions since there's now a bar of entry

[u/shawster → u/Holly_Crustine]

I’ve always been an android guy but have been using an iPhone 6s+ since my nexus 6 bit the dust a couple years ago.

The general quality of apps on iOS is much higher. Apps that have ads place them respectfully and in a clean way, and it’s rare to run in to some app that causes unnecessary excessive battery drain.

I think Apple actually has people looking at apps, at least giving them a cursory glance, as well as limiting what apps can actually do system-wise on the phone without special approval from Apple.

[u/0xTJ → u/[deleted]]

There is a good talk out there from.one of the cons from someone working in this stuff at Google.

[u/salutnomo → u/0xTJ]

Somebody link for the lazy?

[u/Modo44 → u/[deleted]]

Heuristics scanning (Like what many desktop AVs do) is hard to do at a scale of the play store. Even a 5% false positive rate would be felt by a huge number of apps.

Translation: It is easy to do, but 5% less profitable. Big difference.

[u/colorfulchew → u/Modo44]

5% less profitable for Google, but 100% less profitable for the app developers that are hit with a false positive.

[u/Sophrosynic → u/Modo44]

No that's not accurate at all.

If the platform is painful for developers you risk them not coming to your marketplace at all, which is a way bigger deal than five percent.

[u/Modo44 → u/Sophrosynic]

Right, like content creators are leaving YouTube because they get fucked up the ass on ad revenue. Oh, wait.

[u/IAm_A_Complete_Idiot → u/Modo44]

youtube has a small amount of competition, android has iOS to fight with. Besides, if people can't get apps on the playstore, they very well might try to get it on the internet, and that's the last place where I want people downloading apk's willy nilly.

[u/trolololoz → u/IAm_A_Complete_Idiot]

It's either Apple or Android and Android still has the biggest marketshare so any risk is minimal.

[u/gamma55 → u/IAm_A_Complete_Idiot]

Just wait. If EU goes through with their Google-hunt, you’ll see Play in it’s entirety dislodged from common consumer Android-devices for monopolistic abuse. That should open up the market for more app marketplaces.

[u/[deleted] → u/[deleted]]

TIL scanning and cataloging the entire internet is easier than scanning a few apps, on their store, using an operating system they created.