Google Play apps with 1.5 million downloads drained batteries and slowed devices
Researchers have discovered two Google Play apps with more than 1.5 million downloads engaging in a new form of click fraud that drained batteries, slowed performance, and increased mobile data usage on infected phones.
The apps—a notepad app called “Idea Note: OCR Text Scanner, GTD, Color Notes” and a fitness app with the title “Beauty Fitness: daily workout, best HIIT coach”—carried out the stealthy form of fraud for almost a year until it was discovered by researchers at security firm Symantec. Google removed them from Play after receiving a private report.
The newly discovered tactic positioned advertisements in places that weren’t visible to end users—specifically in messages displayed in the nether regions of infected phones’ notification drawer. When a user clicked on the notification, Android’s Toast class opened the ad, but in a way that wasn’t visible to the user. The technique worked by opening a Canvas and using the translate() and dispatchDraw() methods to position the ads beyond the viewable screen area of the infected device. The result: the app could report a revenue-generating ad click even though users saw nothing.
Another way the apps concealed the ad-clicking was through the use of so-called packers. By changing the entire structure and flow of an APK, such packers can obfuscate the true behavior of an Android app. That makes it hard for Google scanners to detect malicious apps during any vetting processes.
“As threat actors generate ghost clicks and ad revenue, impacted devices will suffer from drained batteries, slowed performance, and a potential increase in mobile data usage due to frequent visits to advertisement websites,” Symantec researchers May Ying Tee and Martin Zhang wrote in a post scheduled to go live on Thursday morning. “These apps went unnoticed on the Google Play Store for nearly a year, affecting roughly 1.5 million users before we uncovered their sneaky behavior. The apps’ use of Android packers and the unusual method of hiding advertisements adds a level of complexity for security researchers.”
Representatives with Idea Master, the developer that published the two apps, didn’t respond to an email seeking comment for this post.
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.