Application Security

1/31/2018
11:53 AM
50%
50%

700,000 Bad Apps Deleted from Google Play in 2017

Google rejected 99% of apps with abusive content before anyone could install them, according to a 2017 security recap.

Google took down 700,000 apps from Google Play in 2017 because they violated the store's policies. This marks a 70% increase from the amount of apps removed in 2016, reports Google Play product manager Andrew Ahn in a blog post on 2017 security measures.

Ahn says 99% of malicious apps were identified and rejected before anyone could install them. Improvements in detection models helped find apps containing malware or inappropriate content, as well as threat actors and abusive developer networks. Google Play took down 100,000 bad developers in 2017 and made it difficult for them to create new accounts.

Examples of bad apps that were removed include copycats, which try to deceive users by disguising as famous apps. More apps were flagged for content, including pornography, extreme violence, hate, and illegal activities. Potentially harmful applications, which had a 50% lower install rate in 2017, are designed to phish users' data, act as Trojans, or conduct SMS fraud.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GonzSTL
100%
0%
GonzSTL,
User Rank: Ninja
2/2/2018 | 1:02:55 PM
Re: Apples to Androids
Unrelated but analogous was IBM's use of an open architecture when it built the IBM PC. Sure, it opened up the PC marketplace for software, add-in boards, etc., but it also killed their PC business as cheap clones flooded the market. So where it is a good idea to encourage large numbers, those large numbers have a way of biting back at the idea.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/2/2018 | 5:07:17 AM
Re: Apples to Androids
@Brian: So it's a numbers game. You get the growth, but at a huge cost to security -- but with the business expectation that the gains will outweigh the losses (particularly because the market is so small).

Which is all well and good until you consider that, I suspect, this and other instances of allowing poor and easily exploitable security practices may contribute to an ultimate tyranny of small decisions.
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
2/1/2018 | 3:48:49 PM
Re: Apples to Androids
@JoeS: Yes, Apple is much better at vetting than Google, so is Microsoft.  As pointed out on another site about same story yesterday: Google wanted massive numbers of apps, largely as a marketing point.  Best way to do that is an open-door policy.  That got them their market share - at a price. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/1/2018 | 12:04:36 PM
Apples to Androids
This is a headline you just don't see when it comes to Apple's App Store. As has been pointed out in the Tweetsphere, this means that Google allowed 700,000 crappy, malicious apps into its poorly guarded app store.
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-8298
PUBLISHED: 2018-09-24
Multiple SQL injection vulnerabilities in the login page in RXTEC RXAdmin UPDATE 06 / 2012 allow remote attackers to execute arbitrary SQL commands via the (1) loginpassword, (2) loginusername, (3) zusatzlicher, or (4) groupid parameter to index.htm, or the (5) rxtec cookie to index.htm.
CVE-2018-14825
PUBLISHED: 2018-09-24
A skilled attacker with advanced knowledge of the target system could exploit this vulnerability by creating an application that would successfully bind to the service and gain elevated system privileges. This could enable the attacker to obtain access to keystrokes, passwords, personal identifiable...
CVE-2018-17437
PUBLISHED: 2018-09-24
Memory leak in the H5O_dtype_decode_helper() function in H5Odtype.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
CVE-2018-17438
PUBLISHED: 2018-09-24
A SIGFPE signal is raised in the function H5D__select_io() of H5Dselect.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
CVE-2018-17439
PUBLISHED: 2018-09-24
An issue was discovered in the HDF HDF5 1.10.3 library. There is a stack-based buffer overflow in the function H5S_extent_get_dims() in H5S.c. Specifically, this issue occurs while converting an HDF5 file to a GIF file.