Monitoring Vulnaggressive Apps on Google Play
Vulnaggressive Characteristics in Mobile Apps and Libraries
FireEye mobile security researchers have discovered a rapidly-growing
class of mobile threats represented by popular ad libraries affecting
apps with billions of downloads. These ad libraries are aggressive at
collecting sensitive data and able to perform dangerous operations
such as downloading and running new code on demand. They are also
plagued with various classes of vulnerabilities that enable attackers
to turn their aggressive behaviors against users. We coined the term
“vulnaggressive” to describe this class of vulnerable and aggressive
characteristics. We have published some of our findings in our two
recent blogs about these threats: “ href="/content/fireeye-www/en_US/blog/threat-research/2013/10/ad-vulna-a-vulnaggressive-vulnerable-aggressive-adware-threatening-millions.html">Ad
Vulna: A Vulnaggressive (Vulnerable & Aggressive) Adware
Threatening Millions” and “ href="/content/fireeye-www/en_US/blog/threat-research/2013/10/update-ad-vulna-continues.html">Update:
Ad Vulna Continues”.
As we reported in our earlier blog “ href="/content/fireeye-www/en_US/blog/threat-research/2013/10/update-ad-vulna-continues.html">Update:
Ad Vulna Continues”, we have observed that some vulnaggressive
apps have been removed from Google Play, and some app developers have
upgraded their apps to a more secure version either by removing the
vulnaggressive libraries entirely or by upgrading the relevant
libraries to a more secure version which address the security issues.
However, many app developers are still not aware of these security
issues and have not taken such needed steps. We need to make a
community effort to help app developers and library vendors to be more
aware of these security issues and address them in a timely fashion.
To aid this community effort, we present the data to illustrate the
changes over time as vulnaggressive apps are upgraded to a more secure
version or removed from Google Play after our notification. We
summarize our observations below, although we do not have specific
information about the reasons that caused these changes we are reporting.
We currently only show the chart for one such vulnaggressive library,
AppLovin (previously referred to by us as Ad Vulna for anonymity). We
will add the charts for other vulnaggressive libraries as we complete
our notification/disclosure process and the corresponding libraries
make available new versions that fix the issues.
The Chart of Apps Affected by AppLovin
AppLovin (Vulna)’s vulnerable versions include 3.x, 4.x and 5.0.x.
AppLovin 5.1 fixed most of the reported security issues. We urge app
developers to upgrade AppLovin to the latest version and ask their
users to update their apps as soon as the newer versions are available.
The figure below illustrates the change over time of the status of
vulnerable apps affected by AppLovin on Google Play. In particular, we
collect and depict the statistics of apps that we have observed on
Google Play with at least 100k downloads and with at least one version
containing the vulnerable versions of AppLovin starting September 20.
Over time, a vulnerable app may be removed by Google Play (which we
call “removed apps”, represented in gray), have a new version
available on Google Play that addresses the security issues either by
removing AppLovin entirely or by upgrading the embedded AppLovin to
5.1 or above (which we call “upgradable apps”, represented in green),
or remain vulnerable (which we call “vulnerable apps”, represented in
red), as shown in the legend in the chart.
Please note that we started collecting the data of app removal from
Google Play on October 20, 2013. Thus, any relevant app removal
between September 20 and October 20 will be counted and shown on
October 20. Also, for each app included in the chart, Google Play
shows a range of its number of downloads, e.g., between 1M and 5M. We
use the lower end of the range in our download count so the statistics
we show are conservative estimates.
![]()
alt="applovin1117"
src="https://www.fireeye.com/content/dam/legacy/blog/2013/11/applovin1117.png" width="1039" />
We are glad to see that over time, many vulnerable apps have been
either removed from Google Play or have more secure versions available
on Google Play. However, apps with hundreds of millions of downloads
in total still remain vulnerable. In addition, note that while
removing vulnaggressive apps from Google Play prevents more people
from being affected, the millions of devices that already downloaded
them remain vulnerable since they are not automatically removed from
the devices. Furthermore, because many users do not update their
downloaded apps often and older versions of Android do not auto-update
apps, even after the new, more secure version of a vulnerable app is
available on Google Play, millions of users of these apps will remain
vulnerable until they update to the new versions of these apps on
their devices. FireEye recently announced href="http://www.fireeye.com/products-and-solutions/mobile-security.html">FireEye
Mobile Threat Prevention. It is uniquely capable of protecting
its customers from such threats.
Source:
Monitoring Vulnaggressive Apps on Google Play
