Android Security: Click Fraud Apps Drove 100% Malware Increase in Google Play for 2018

Security issues are no stranger to apps found on Google’s Play Store. Malware installed from the Android app store grew by 100 percent in 2018. The increase, according to Google, is due to the inclusion of click fraud apps, or adware, to “potentially harmful apps” (PHAs).

Before this change, Google only treated adware as Play Store policy violations. Now that the company has started tracking it, the install rate grew from 0.02 percent in 2017 to 0.04 percent in 2018. The apps accounted for 55 percent of all PHAs installed via the Play Store, dominating all other categories. Trojans followed as the largest category based on install rate at 16 percent. Google’s annual Android security report further indicates that click fraud apps mainly targeted users in the U.S., Brazil, and Mexico.

Users may get click fraud apps or adware in their devices by downloading freeware, such as toolbars and wallpapers, and mobile apps. Adware can result in slower device performance as they allow other programs to run in the background. Cybercriminals can also sneak it into apps, like in a 2015 incident where adware was unintentionally integrated by developers through a software development kit (SDK) used to make an app. Such a technique can allow criminals to include adware in hundreds or thousands of apps.

[Trends in mobile malware and vulnerabilities: 2018's mobile threat landscape]

In fact, as reported in Trend Micro's 2018 mobile security roundup, out of the 1,088 identified Android applications containing SDKs, there were 889 apps in Google Play (which have since been taken down) used for fraud and malware. Fraudsters can spoof apps or even buy popular and legitimate apps from developers in order to transfer them to fraudulent or shell companies. Moreover, adware and PUAs even turned into cryptocurrency-mining apps for monetary gain. Some were seen taking advantage of SDKs to mine for Monero aside from displaying ads. Meanwhile, other threats like known vulnerabilities, mobile banking malware, and jailbreak tools continued to thrive and remained cybercriminal mainstays.

Nevertheless, security also showed improvements in the Android ecosystem as Google reported that the later versions of the OS such as Oreo and Pie had lower rates of PHA installations (0.19 percent and 0.18 respectively), compared with older operating systems such as Lollipop and Marshmallow (0.65 percent and 0.55 percent respectively).

Securing mobile use and app installations

Implementing security by design in mobile application development should be a priority for app developers to improve privacy and security in their products. As for users, they can consider using a multilayered mobile security solution to prevent adware and other potentially unwanted applications (PUAs) installation attempts in their devices. While malware in app stores has become commonplace, it is still safer for users to install apps from official stores like Google Play.

To keep the problem of potentially harmful applications at bay, users should maintain device security at home and at the workplace by employing Bring Your Own Device (BYOD) practices. Users should also limit the personal information they provide to apps and websites, manage privacy settings in their devices, and avoid connecting to unsecure networks.