Application Security

1/31/2018
11:53 AM
50%
50%

700,000 Bad Apps Deleted from Google Play in 2017

Google rejected 99% of apps with abusive content before anyone could install them, according to a 2017 security recap.

Google took down 700,000 apps from Google Play in 2017 because they violated the store's policies. This marks a 70% increase from the amount of apps removed in 2016, reports Google Play product manager Andrew Ahn in a blog post on 2017 security measures.

Ahn says 99% of malicious apps were identified and rejected before anyone could install them. Improvements in detection models helped find apps containing malware or inappropriate content, as well as threat actors and abusive developer networks. Google Play took down 100,000 bad developers in 2017 and made it difficult for them to create new accounts.

Examples of bad apps that were removed include copycats, which try to deceive users by disguising as famous apps. More apps were flagged for content, including pornography, extreme violence, hate, and illegal activities. Potentially harmful applications, which had a 50% lower install rate in 2017, are designed to phish users' data, act as Trojans, or conduct SMS fraud.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GonzSTL
100%
0%
GonzSTL,
User Rank: Ninja
2/2/2018 | 1:02:55 PM
Re: Apples to Androids
Unrelated but analogous was IBM's use of an open architecture when it built the IBM PC. Sure, it opened up the PC marketplace for software, add-in boards, etc., but it also killed their PC business as cheap clones flooded the market. So where it is a good idea to encourage large numbers, those large numbers have a way of biting back at the idea.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/2/2018 | 5:07:17 AM
Re: Apples to Androids
@Brian: So it's a numbers game. You get the growth, but at a huge cost to security -- but with the business expectation that the gains will outweigh the losses (particularly because the market is so small).

Which is all well and good until you consider that, I suspect, this and other instances of allowing poor and easily exploitable security practices may contribute to an ultimate tyranny of small decisions.
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
2/1/2018 | 3:48:49 PM
Re: Apples to Androids
@JoeS: Yes, Apple is much better at vetting than Google, so is Microsoft.  As pointed out on another site about same story yesterday: Google wanted massive numbers of apps, largely as a marketing point.  Best way to do that is an open-door policy.  That got them their market share - at a price. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/1/2018 | 12:04:36 PM
Apples to Androids
This is a headline you just don't see when it comes to Apple's App Store. As has been pointed out in the Tweetsphere, this means that Google allowed 700,000 crappy, malicious apps into its poorly guarded app store.
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12716
PUBLISHED: 2018-06-25
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its l...
CVE-2018-12705
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).
CVE-2018-12706
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.
CVE-2018-12714
PUBLISHED: 2018-06-24
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers to cause a denial o...
CVE-2018-12713
PUBLISHED: 2018-06-24
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was ...