How Did That Get In My Phone? Unwanted App Distribution on Android Devices

Kotzias, Platon; Caballero, Juan; Bilge, Leyla

doi:10.1109/sp40001.2021.00041

Cited by 35 publications

(25 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Recall that we select PHAs (per SHA2) that we observe at least twice on the same device to carry out the measurements (see Section 2), hence our dataset is purposely designed to measure the temporal behavior. Our results are consistent with the most recent Android PHA device prevalence study [16]: 15 of the 20 PHA families in Table 3 were also among the top 20 PHA families found by [16]. As we can see in the PHA families exhibit bell shaped temporal patterns.…”

Section: Temporal Characteristics Of Pha Familiessupporting

confidence: 92%

“…In this paper, we use mobile PHA reputation data collected from real-world Android devices by NortonLifeLock's mobile security product, which covers over 200 countries and regions in the world. Similar to the device geolocation distribution discussed in Kotzias et al [16], 25% of the devices used in our study were from the United States, 28% of the devices were from European countries, and 31% of the devices were from the APJ area (although this distribution was skewed towards Japan and India).…”

Section: Datasetssupporting

confidence: 84%

“…We consider an app as a PHA if VirusTotal returns a minimum of four detections in this paper. This is in line with the best practices recently proposed in the malware research community [16,41]. We refer the audience to Kotzias et al [16] and Zhu et al [41] for in-depth analysis of the impact of different detection threshold values of VirusTotal reports.…”

Section: Datasetssupporting

confidence: 80%

“…This is in line with the best practices recently proposed in the malware research community [16,41]. We refer the audience to Kotzias et al [16] and Zhu et al [41] for in-depth analysis of the impact of different detection threshold values of VirusTotal reports. In total, we identify 7M unique malicious SHA2s, and 3.5K PHA families.…”

Section: Datasetssupporting

confidence: 80%

“…However, such services may inadvertently migrate existing PHAs to the new device too, and compromise the security and privacy of the new phones, even though these PHAs may have been removed by the markets and therefore the user might not be able to manually install them anymore. Kotzias et al [16] showed that backup restoration is an unintended unwanted app distribution vector responsible for 4.8% of unwanted installs. Following this direction, we further investigate how long PHAs can persist after migrating via backup/clone services.…”

Section: Pha Persistence After Migration Via Backup/clone Servicesmentioning

confidence: 99%

See 4 more Smart Citations

A Large-scale Temporal Measurement of Android Malicious Apps: Persistence, Migration, and Lessons Learned

Shen¹,

Vervier²,

Stringhini³

2021

Preprint

View full text Add to dashboard Cite

We study the temporal dynamics of potentially harmful apps (PHAs) on Android by leveraging 8.8M daily on-device detections collected among 11.7M customers of a popular mobile security product between 2019 and 2020. We show that the current security model of Android, which limits security products to run as regular apps and prevents them from automatically removing malicious apps opens a significant window of opportunity for attackers. Such apps warn users about the newly discovered threats, but users do not promptly act on this information, allowing PHAs to persist on their device for an average of 24 days after they are detected. We also find that while app markets remove PHAs after these become known, there is a significant delay between when PHAs are identified and when they are removed: PHAs persist on Google Play for 77 days on average and 34 days on third party marketplaces. Finally, we find evidence of PHAs migrating to other marketplaces after being removed on the original one. This paper provides an unprecedented view of the Android PHA landscape, showing that current defenses against PHAs on Android are not as effective as commonly thought, and identifying multiple research directions that the security community should pursue, from orchestrating more effective PHA takedowns to devising better alerts for mobile security products.

show abstract

Section: Temporal Characteristics Of Pha Familiessupporting

confidence: 92%

Section: Datasetssupporting

confidence: 84%

Section: Datasetssupporting

confidence: 80%

Section: Datasetssupporting

confidence: 80%

Section: Pha Persistence After Migration Via Backup/clone Servicesmentioning

confidence: 99%

See 3 more Smart Citations

A Large-scale Temporal Measurement of Android Malicious Apps: Persistence, Migration, and Lessons Learned

Shen¹,

Vervier²,

Stringhini³

2021

Preprint

View full text Add to dashboard Cite

show abstract

D-Cloud-Collector: Admissible Forensic Evidence from Mobile Cloud Storage

Vella

Colombo

2022

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

Difficulties with accessing device content or even the device itself can seriously hamper smartphone forensics. Mobile cloud storage, which extends on-device capacity, provides an avenue for a forensic collection process that does not require physical access to the device. Rather, it is possible to remotely retrieve credentials from a device of interest through undercover operations, followed by live cloud forensics. While technologically appealing, this approach raises concerns with evidence preservation, ranging from the use of malware-like operations, to linking the collected evidence with the physically absent smartphone, and possible mass surveillance accusations. In this paper, we propose a solution to ease these concerns by employing hardware security modules to provide for controlled live cloud forensics and tamper-evident access logs. A Google Drive-based proof of concept, using the SEcube hardware security module, demonstrates that D-Cloud-Collector is feasible whenever the performance penalty incurred is affordable.

show abstract

uitXkernel: Android Kernel Forensic for Security Analysis Purposes

Cam

Khoa

et al. 2022

Intelligent Computing &Amp; Optimization

View full text Add to dashboard Cite

How Did That Get In My Phone? Unwanted App Distribution on Android Devices

Cited by 35 publications

References 34 publications

A Large-scale Temporal Measurement of Android Malicious Apps: Persistence, Migration, and Lessons Learned

A Large-scale Temporal Measurement of Android Malicious Apps: Persistence, Migration, and Lessons Learned

D-Cloud-Collector: Admissible Forensic Evidence from Mobile Cloud Storage

uitXkernel: Android Kernel Forensic for Security Analysis Purposes

Contact Info

Product

Resources

About