SECURITY PROBLEM IN GOOGLE PLAY

Google Play has more than one million apps and over 50 billion app downloads, but no one reviews what gets put into Google Play -- anyone can get a $25 account and upload whatever they want. “Very little is known about what's there at an aggregate level,” says Nieh, who is also a member of the University's Institute for Data Sciences and Engineering's Cybersecurity Center. Google Play has huge popularity and it is important to take a close look at Google Play content.

PLAYDRONE:

Nieh and Viennot's paper is the first to make a large-scale measurement of the huge Google Play marketplace. To do this, they developed PlayDrone, a tool to successfully download Google Play apps and recover their sources and uses various hacking techniques. PlayDrone scales by simply adding more servers and is fast enough to crawl Google Play on a daily basis,

-->   Downloading more than 1.1 million Android apps

-->    Decompiling over 880,000 free applications.

ANALYSIS:

Nieh and Viennot discovered all kinds of new information about the content in Google Play, including a critical security problem: developers often store their secret keys in their apps software, similar to usernames/passwords info, and these can be then used by anyone to maliciously steal user data or resources from service providers such as Amazon and Facebook. These vulnerabilities can affect users even if they are not actively running the Android apps. Nieh notes that even "Top Developers," designated by the Google Play team as the best developers on Google Play, included these vulnerabilities in their apps.

MEASURES ADOPTED:

All developers  have been working closely with Google, Amazon, Facebook, and other service providers to identify and notify customers at risk, and make the Google Play store a safer place. Google is now using techniques to proactively scan apps to prevent these problems from happening again in the future.

FINDINGS:

¨     A quarter of all Google Play free apps are clones

¨     Very slow app purchases in Google Play  

¨     The worst rated apps had more than a million downloads more than good apps