Thep Urai - Fotolia

News

Google got faster pulling bad Android apps from Play Store

Google claims it is faster than ever at removing or rejecting bad Android apps from the Play Store before anyone has a chance to install the troublesome app.

Michael Heller
By
Published: 31 Jan 2018

Google wants to reinforce that the Play Store is the safest place for Android users to get apps with a new set of stats on how its efforts to block bad Android apps have improved.

Andrew Ahn, product manager for Google Play, said the company has "halved the probability" of users installing bad Android apps and also made the Play Store "a more challenging place for those who seek to abuse the app ecosystem for their own gain."

"In 2017, we took down more than 700,000 apps that violated the Google Play policies, 70% more than the apps taken down in 2016. Not only did we remove more bad apps, we were able to identify and action against them earlier," Ahn wrote in a blog post. "In fact, 99% of apps with abusive contents were identified and rejected before anyone could install them. This was possible through significant improvements in our ability to detect abuse -- such as impersonation, inappropriate content, or malware -- through new machine learning models and techniques."

Liviu Arsene, senior e-threat analyst at Romania-based antimalware firm Bitdefender, said it is "commendable that Google is going through great lengths to optimize the malicious app bouncing process," considering the more than 3.5 million apps in the Play Store.

"However, malware developers don't necessarily have to submit 'bad Android apps' when they can simply create something that's barely functional with the sole purpose of getting past the vetting process. Some apps may offer deceptive descriptions and functionalities just to get installed on devices, from which they can request all sorts of permissions for tracking users or for bombarding them with ads," Arsene told SearchSecurity. "There have been instances where apps walk a very fine line between complying with Google's advertising policy and spamming users with nag screens, browser redirects, and unsolicited pop-ups just for the sole purpose of generating revenue for the developer. While, granted, they don't install malware or pilfer personal data, some of them can still be borderline legitimate."

Google Play security
Google used machine learning to remove more bad Android apps than ever from the Play Store.

Will the Play Store catch all the bad apps?

A Google spokesperson told SearchSecurity that there will always be a chance for bad Android apps to slip through because "they evade detection in a sneaky way, or seem to be very borderline cases," and in those cases Google relies on analyzing how apps are being distributed, monitoring user community flagging and reviewing data from post-install Google Play Protect scans in order to take action on a potentially harmful app.

"Apps submitted to Google Play are automatically scanned for potentially malicious code, as well as spammy developer accounts before they are published on the Google Play Store. To complement that effort, we recently introduced a proactive app review process to catch policy offenders earlier in the process, while still ensuring that developers can get their apps to market as soon as possible -- in a matter of hours, not days or weeks," the spokesperson said. "During that process, apps are specifically reviewed for compliance against our Google Play Developer Content Policy and Developer Distribution Agreement, which prevents things like apps that are impersonating legitimate companies or deceptive behavior."

Arsene applauded the work done by Google to block bad Android apps "because Android is one of the most popular operating systems."

"Some built in app scanning features even let users know if they've downloaded something malicious from a third-party marketplace, which acts as an additional line of defense," Arsene said. "However, it's recommended that everyone owning an Android device, regardless if they install apps from official marketplaces or not, install a mobile security solution as it will have the ability to protect them from much more than just malicious apps, but also against web-based attacks and other online threats."

Dig Deeper on Application and platform security