SophosLabs finds 15 Adware apps on Google Play

Thursday, 17 October 2019 02:07 - - {{hitsCtrl.values.hits}}

Says Adware apps attempt to evade easy removal by, literally, hiding their app icons from users

Sophos, a global leader in network and endpoint security, recently discovered 15 apps on Google’s Play Market that engage in such practices; they generate frequent, large, intrusive ads and literally hide their app icons in the launcher in order to make it difficult for you to find and remove them. Several of them go a step further by disguising themselves in the phone’s App settings page.

According to the Play Market pages for these apps, more than 1.3 million devices worldwide have installed at least one of them. If history is any indication, there are likely many more waiting to be found.

For example, the app ‘Flash On Calls & Messages – aka Free Calls & Messages’ engages in some clever trickery to prevent users from uninstalling the app.

“When first launched, the app displays a message that says ‘This app is incompatible with your device!’ You might think that the app has crashed, because, after this ‘crash,’ the app opens the Play Store and navigates to the page for Google Maps, to mislead you into thinking that the ubiquitous Maps app is the cause of the problem. It is not. This is a ruse.” “The app then hides its ‘own’ icon so it doesn’t show up in the launcher’s app tray. Others in the list hide their icon, too: Some do this on the first launch, while others simply wait for a while after you install the app,” said Andrew Brandt, principal researcher, SophosLabs. SophosLabs has also observed these apps pulling a different dirty trick: using one name and icon for the application (which is visible in the phone’s Apps settings page), and a ‘different’ name and icon for the Main Activity (the running app window). Nine out of the batch of 15 apps used deceptive application icons and names, most of which appeared to have been chosen because they might plausibly resemble an innocuous system app. (The app icon is still visible in the phone’s ‘gear’ Settings menu, under Apps.) By hiding their launcher icon, and using an application icon and name that resembles a system app, these apps make a convincing case to a casual observer that there’s nothing unusual installed on the phone.

If you suspect that an app you recently installed is hiding its icon in the app tray, tap Settings (the gear menu) and then Apps & Notifications. The most recently opened apps appear in a list at the top of this page. If any of those apps use the generic Android icon (which looks like a little greenish-blue Android silhouette) and have generic-sounding names (‘Back Up,’ ‘Update,’ ‘Time Zone Service’) tap the generic icon and then tap ‘Force Stop’ followed by ‘Uninstall.’ A real system app will have a button named ‘Disable’ instead of ‘Uninstall’ and you don’t need to bother disabling it.

To stay safe when downloading apps from the Google Play Store, users are advised to read reviews and sort them by most recent and filter out the positive four and five star reviews with no written text. If several reviews mention specific undesirable behaviour, it’s likely best to avoid that particular app.