Google kills fake anti-virus app that hit No. 1 on Play charts "Virus Shield", an app that briefly shot to the top of the charts on Google Play, has turned out to be a complete fake and has therefore been pulled by Google. The scam, turned up by Android Police, is as simple as a con-man could wish for: the app includes almost no functionality whatever, yet it was briefly a chart-topper on …
I don't see much distinction between an overtly malicious app and deliberately selling the user a false sense of security. They are knowingly putting their customer in harms way.
Plus, considering Aslan's comment below, "Google Play only runs an automated check to see if an App is malicious", it is quite possible that it was a wannabe malicious app developer who found the auto-checks too difficult to get past, and took an easy route to the money. All the same intent is there.
There are a number of issues here - each of which are quite worrying.
First - the app required no permissions, but as it was called an anti virus app, you can be pretty sure that anyone who installed it - would be quite happy to accept whatever permissions came along in any subsequent update - because - it's an anti virus app - so surely it wouldn't be doing anything wrong. Luckily it was taken down before we reached that situation.
Secondly - almost all the reviews were posted from new accounts that had not reviewed any other app... so huge numbers of newly created accounts were able to both purchase and then review the app. There must be a service somewhere that developers can pay money to - but how this service was able to mass generate Google accounts with valid payment data - is a rather concerning question. We are pretty sure these accounts were not manually created - there were too many, many of them not even posting a review - just rating the app 5 stars.
Someone with more spare time than me should do a statistical analysis of voting practices in Google Play to identify vote rigging. It's painfully obvious when it happens, and it seems to happen a lot.
With all their experience of battling spam, I don't see why Google seem to be turning a blind eye to this problem.
"With all their experience of battling spam, I don't see why Google seem to be turning a blind eye to this problem."
Because there is no "they" at Google to turn a blind eye or not. Having built systems and platforms as automated as they have, there is no human arbiter or route of appeal, no human managed customer services, no editorial discretion. They'll only get round to this if it (a) starts to impact revenues, (b) then some strategic planner at Mountain View spots the problem, and (c) there's a way of doing it by machine.
As with Google Maps, the whole Android system is built around a hugely networked future where machines can do the job properly and network coverage universal, and information flows perfect. Unfortunately we're a long way off that, and the Google Play store needs a competent, properly resourced curating team. Despite that being a mere $2m a year expense in a $50bn a year corporation, Google are totally averse to meatsacks other than as a resource to be farmed and so I don't have high hopes for it being fixed soon. My money is on the problem recurring and being swept under the carpet, until one day it becomes a huge, huge, business model destroying disaster, for example a wildly popular free download that then turns out to have harvested the credit card details of half a billion users, after the event.
A complete failure of that magnitude would destroy Google overnight. Nobody would want Android phones, they'd use alternative search engines, cookie and ad-blockers would become commonplace fro non-expert users, and Google find they don't have any income streams any more.
"the Google Play store needs a competent, properly resourced curating team"
I don't want a curating team blocking apps and using spurious reasons why your app can't be put on the Play store.
Just scan for malicious apps and take down any that are fraudulent but I don't want censorship - if I did I could use an iPhone.
If you really want a system like that then run a "verified by Google" program where devs can pay a bit more and send in their source code to get a verified tag in the Play store with a rapid turnaround.
>>"I don't want a curating team blocking apps and using spurious reasons why your app can't be put on the Play store."
I agree. But Microsoft spent over a decade offering an OS with no curation whatsoever and the expectation that users knew what they were doing. MS grew up in an era where computer users were technical people and they kept assuming that. And then Apple came along and beat them up with iPhones and iPads. Now MS think that's what people want and are pushing their own store.
You can have educated users or you can have passively looked after users. The two are always in conflict.
>>"Those aren't even competing market segments..."
Of course they are - there are a lot of people who used to have a PC purely for a bit of email and web-browsing. The iPad (and now other devices) have significantly eaten into that. Similarly the iPhone killed off any possible future for Windows Mobile by showing just how antiquated it was, and forced MS to reinvent things from the ground up with Windows Phone. Tablet and laptop sales have directly impacted desktop PCs, rising as the latter falls. And a significant part of "tablet and laptop", is tablet.
The Windows Store is a direct response to the stores on Android and iOS devices.
Re: Because there is no "they" at Google to turn a blind eye or not. Having built systems and platforms as automated as they have, there is no human arbiter or route of appeal, no human managed customer services, no editorial discretion.
This is true. Where I work, we use gmail for certain users email. AFAIK, we have the relevant SLAs in place and this is under a business contract. As such, you'd expect that we'd have little trouble getting hold of actual people to solve a problem. Not so, according to the guys that deal with them. In fact, quite the opposite.
"The fact it required no permissions should have been enough to alert a potential buyer it was a scam."
No permissions or excessive permissions, either way it would only alert the tech savvy. Most users simply click on "Yes", "Yes", "Yes" because they don't understand the question or the consequences, but they do understand the short term consequences of clicking on "No, I do not accept the terms and conditions".
As Microsoft found with UAC, dialogue boxes are only useful if they offer the right range of choices at the right time to suitably informed users; In most cases they are worse then useless.
"The fact it required no permissions should have been enough to alert a potential buyer it was a scam."
Many potential buyers have no clue about permissions. This (for example) would not have alerted my mum!
"Also doesn't the play store give you 15 minutes to use the app and cancel it if you don't want it after that time?"
Yes, but again, how would you know - in 15 minutes - that it was a fake app? If you've bought the app in the first place, why would you get a refund if it does (or looks like it's doing) the exact thing you purchased it for?
Relying on end users to be vigilant/knowledgable is not *the* answer (though sure it would help).
"Relying on end users to be vigilant/knowledgable is not *the* answer "
Eh. Why not? That is how it works in the rest of the world. If I go to the doctor and they sell me some pills to fix me up and they don't work, I don't get my money back. No consequences come of the doctor.
If Google really wants to fix this, have a holding system for money from new apps. If you've never made an app before you have to wait 30, 60 days or whatever to get paid. An app like this is always going to get caught within that timeframe. Then Google can issue refunds.
A non technical person probably wouldn't know about which permissions an antivirus would use, assuming they knew about permissions at all.
Similarly, a non technical person would probably have no way of ascertaining that a virus scanner is doing nothing other than display some pretty graphics on it's UI..
"Similarly, a non technical person would probably have no way of ascertaining that a virus scanner is doing nothing other than display some pretty graphics on it's UI.."
This average non technical person probably doesn't even need a virus scanner. They've only been scared into it by the media.
Not to mention, in the USA every carrier adds a virus scanner app anyway. And most phone makers do too. (Knox for Samsung).
>>"This average non technical person probably doesn't even need a virus scanner. They've only been scared into it by the media."
Well the media and a decade of Windows XP. I imagine it's quite heartening to some after MS make all that money off Android, to see Android make a little off Windows. ;)
Please,,, average buyer? You do realise the average IQ is 100... you do realise that a person of 100 IQ will most likley try and lick a window to drink water.......
All these permissions are for is to take blame away from the company (i.e Google) to the customer to say,, you clicked accept,, deal with it
> almost all the reviews were posted from new accounts that had not reviewed any other app
...
> there were too many, many of them not even posting a review - just rating the app 5 stars.
Well, maybe this product was so good it got people signing up with the Google store just to buy it and leave a sterling review.
Or maybe not. :-/
There was an Android app for managing battery life or something that had gotten a great review here in the Reg not that long ago. I and a number of other users tried it out and found it was basically ransomware. They had 500 fake 5 star reviews on the app store. So yes, there is definitely a service you can sign up for fake reviews. I would assume that exists for everything on the internet.
/the owner of that app had even trolled and harassed people in the comments on the Reg
You need to understand that Google Play only runs an automated check to see if an App is malicious. If the automated scan determines it's not it's posted with no human interaction. Responsibility for the apps is on the developer and the user who downloads/buys the app. A human only ever looks at things if there's a certain level of complaints. The Google play store has very few restrictions on Apps compared to other app store and this allows users more choices and interesting apps. This is generally good. To really get what you need to have a bit of intelligence, and be willing to learn a bit about your phone. If you need safety in general, and don't care to learn about your phone you'd be much better off with an iPhone.
Lookout Mobile Security is my favorite Android AV. It even got my phone back once after it was stolen.
The Google play store has very few restrictions (...). This is generally good. To really get what you need [you must] have a bit of intelligence, and be willing to learn a bit about your phone. If you need safety in general, and don't care to learn about your phone you'd be much better off with an iPhone.
Agreed. Unfortunately Apple has positioned their products towards wankers premium consumers, unwittingly nudging those that prioritize value for money (but aren't necessarily tech literate) in the direction of the Android platform.
These days there is a lot of talk about anti-NSA "locked down" smart mobes, but maybe the more promising business case lies in an Android handset line tied to a carefully curated app store, a bit like what Apple does perhaps, only with explicit guidelines rather than a dozen jerks playing heads-or-tails?
A verified subset of the play store (as suggested above somewhere) would be a very good thing. Android could easily have a setting to allow non-verified apps from the Play store (the same as installing non-play store apps).
That said, if you want a cheap, largely locked down, non-apple smart phone, then I would suggest a look at a WP Nokia. It'll do maps, email, facebook, most of what people want, but won't let you download dodgy apps from anywhere you like.
"…unwittingly nudging those that prioritize value for money (but aren't necessarily tech literate) in the direction of the Android platform."
No. The exact opposite. What a disappointing troll post.
Android gear: Cheap devices. Cheap (free) ripoff OS. The biggest malware magnet since Windows, with the number of malware rising exponentially. Your costs don't end after you've paid for the device.
Apple gear: Consistently the best ROI (return on investment) and lowest TCO (total cost of ownership) compared to comparable gear from competitors and/or plagiarists. That's factual, therefore useful information.
I'll take Apple's well (but not perfectly) vetted 'walled garden' any day. I like getting work done, not fighting with the OS or malware. Why that's difficult for certain people to understand is beyond my imagination.
"And only the REALLY gullible think there are is no Android malware."
Surely this app itself was a form of malware (luckily in this case only taking money under false pretences)? The fact it got to be a best seller doesn't say anything good about the vetting of the apps there, or the gullibility of many app buyers!
"And only the REALLY gullible think there are is no Android malware."
I know there is some android malware, but I also know I'm not stupid enough to install it, or think one of the "authentic" virus scanners is going to do anything more than giving me a false sense of security (which is what this is doing anyway).
The fact these people bought into a virus scanner that has bugger all access to anything important on your phone means they are the type of people who would install a virus willingly then blame the platform for the security "flaw". You're only as protected as the weakest point of entry... sadly for a lot mobile users (and PC) the user is the weakest point. That's true of any platform, not just android.
If the google wasn't so EVIL these days, they would solve some of these problems. Broken funding models have a rather simple and obvious approach. Just disclose some additional information that would help us in "following the money" to assess whether or not an app is legit. This is not the only way it could be done, but just one form to make the suggestion more concrete.
There could be a "Funding" tab that would describe the funding model used by the developer of the app. Most of the common options would be boilerplates that a developer could select. The most obvious options (for free apps) would probably be "Ad supported" and "Limited-function version to promote paid version". That part would be under each developer's control, and should even include free text options if the developer wants to say more.
At the bottom of the Funding tab would be Google's part, which would not be accessible to the developer. Maybe the google can't say anything, in which case it would say "We have no evidence to support the claims made in the developer's financial model above." It might say "This developer is earning advertising revenue in the top quartile of app developers" or "This developer also produces <full product name>, so please see that page to learn more about the funding."
Having offered that suggestion, I have to admit that it may not have done much good in this specific case because the financial model was pretty clear, and it was just the big lie. However, I think the reality was that the other anti-virus companies should have shot this one down quite quickly. Obviously, they should have downloaded the new competitor, and as soon as they tested it, they would have discovered it did nothing. Hmm... Now that I think about it, that's probably how this scam collapsed.
Another way it might have collapsed is if the google is checking for sock puppets, as suggested by another commenter (who I can't see now). Again, obvious, but I think the google is too EVIL to be bothered.
I have a few apps,like Sky GO that won't work if rooted so my nexus 7 is still locked despite being incredibly easy to root.
My old San Francisco however, was rooted the day I bought it but I never click ads displayed on my tablet and just ignore them.
In Android Firefox I use the Adblock extension anyway
I don't know if root cloak works with Sky GO, but you might want to investigate that. It sure does work with Belgacom's TV Partout.
I root all mine/family phones as soon as the battery is charged, to be able to install adaway, titanium backup, and cerberus/lookout. Also to be able to revert google's incredibly dumb decisions in Kitkat re external storage.
I got my silver badge because of my stunning repartee, amazing wit, and blackmailing one of the Journos here on Ell Reg*. Not because of any perceived technical competence.
How are you planning on getting yours?
*One or more of the preceding statements may be at variance with established facts.
"root your phone and installed AdAway"
If everyone did this then apps would no longer be free as the professional devs would not have any revenue stream. Sure we could just have part-time coders who wish to do a bit of philanthropy or open-source their wares but for a full time dev producing apps, they need either an ad supported model, or a pay for model.
If you don't want ads pay a few pence for an ad-free version. If you want it for free then just use the ad-enabled version.
"3) I assume every advert that appears on my phone that doesn't name the company to be fraudulent."
I take it a step further. I assume every ad is fraudulent. I've never clicked on an ad on purpose. I'm 26 years old. The whole ad industry should be afraid. Younger generations will be more like me.
/You're the 1 millionth visitor to view my post! Click here for your prize!
Looking at the comments above, it's clear that the curated App Store has it's detractors, but all the crapware we used to get on Windows has moved wholesale to Android, whereas iOS has barely any.
Whenever I've had Android phones it's always amazed me at all the garbage in the Play Store - anti-virus, task killers, speed-up utilities etc. Sure, it's freedom. But that only suits savvy users who know enough about their platform to know whether a given type of app makes sense.
The crapware was my biggest issue when I got my first Android.
Love Android, but the app choices are an absolute nightmare. The thing that saved me was not having enough memory to download anything not essential.
Then I unlocked it and then I rooted it and killed off the rest of the crapware.
Vulnerable? I don't play games, download apps and visit but a handful of the same websites.
There's a lot of apps explicitly for power users in the Google Play store. Most of what you're calling garbage there, is actually meant for the power user. Many of these apps aren't as important with a modern version of Android, but they still have their uses I like Advanced Task Manager https://play.google.com/store/apps/details?id=com.arron.taskManager I can see how much battery an app or process is using, move an app to the SD card, kill the app (apps occasionally hang on Android), kill any or all background apps to save battery. All with a much better interface than stock 2.3 Android. Another good one was Battery Monitor Widget Pro https://play.google.com/store/apps/details?id=ccc71.bmw.pro It gives you stats and graphs about your battery, shows you how long it will last for a given task, movies, games, music, and tells you how long it will take to charge the battery. It also warns you when the phone is getting to hot or the battery is to hot to charge. My Nexus One would regularly hit 120 F and quit charging the batter or even 140 F when gaming on an 80+ F day when I was living without air-conditioning. The solution was to take the case off, or maybe even the back battery cover while charging and gaming.
My favorite App you might look down on is "Fix Broken Power Button" which allows you to turn off your phone with a button on the screen if your power button is broken, which has happened to me.
My favorite App you might look down on is "Fix Broken Power Button" which allows you to turn off your phone with a button on the screen if your power button is broken, which has happened to me.
Perhaps a silly question but, how do you then turn the phone back on?
The app took care of that too it knew about the other hardware buttons on the phone. You had your choice of using the up volume key, the down volume key, or clicking the trackball among others depending on the model, to turn on the phone. I used a click of the trackball. Now, this wouldn't work to turn the phone on from being all the way off. For that it was necessary to plug in the phone to the charger remove, then replace the battery, and then phone would boot. The easiest way was to carry an external USB battery with you. After that initial boot you could put the phone to sleep with the on screen button equivalent to tapping the power button, or launch the app and shutdown or restart the phone as needed. No need to plugin and jumpstart the phone until the next time it was fully turned off.
This was for my Nexus One, which I bough on launch day and paid for Next Day Air without a second thought, when Google didn't deliver I bitched them out on the phone, got a refund for the shipping, and got my hotel in the next state to receive it. At the time I was going to be spending 60 hours in transit over a 3 week period. It was after all the first "superphone" 1GHZ processor 512MB ram and 800 x 480 AMOLED screen. It was an amazing phone. When the power button broke over a year and a half later I didn't have nearly the kind of money I had when I bought it and nearly despaired, then I stumbled on the way to power on the phone and looked for a way to turn it off and found that app. I loved that phone. I had three extra batteries for it, and an external battery charger. I did a calculation at one point and figured out that 92% of my life waking or sleeping involved that phone.
Before the Nexus One I used RAZR 2v8m for voice and light web-browsing and a Nintendo DS with the Opera web-browser loaded on an "M3 DS Simply" flash cart. Others were amused I used it for business but it was a very serviceable web-browser if the page didn't have excessive amounts of pictures or complexity. For example it could load TomsHardware.com fine, and image galleries up to 20 images or so, but would choke on an image gallery with 25.
The RAZR 2v8m is right next to the Nexus One for my favorite phone. Mainly for the crazy amount of capability it had for being a consumer phone. Launched October 15, 2007 it had dual 240 x 320 screens with a touch screen on the outside of the phone. It had EDGE, a web browser, GPS, 2GB internal flash, on device movie and audio player as well as streaming capabilities. Yes I was listening to radioparadise.com and watching Youtube on T-Mobile's $5.99 unlimited internet plan (When others paid $30-40 or more for capped data. There were months I used 15GB). It was fun to have a phone that made other people say how are you doing that. I even once had that happen with the manager of a T-mobile store.
...that are just as deceitful or outright pointless but don't get the press coverage? Still available.
In fact I'd bet Google know some are shit but still take their share of the dosh.
Literally the only reason this one got withdrawn is because it was highly rated and was publicised as being crapware.
after you bought it, it displayed a (very nice) ruby. Similar scam, different price point ;-)
Apple did pull it fairly quickly.
At the end of the day, buyer beware is a bit true. Especially with antiviruses - a functional (or malicious) antivirus needs to access pretty much anything on your machine and there have been incidents before with fake scanners (MacDefender on Macs, I bet tons on MS). In fact, I'd welcome an enhanced vetting process specifically for those types of apps.
Shush, you. Only Android has crapware. Oh, and viruses that can magically break out of the app sandbox on non-rooted devices. Somehow. I think. Maybe. Or not.
Apple is perfect. The iPhone is heavenly. Praise St Jobs. Amen.
Sent from my iPhone.
Apple only pulled "I Am Rich" when two of its eight customers complained that they'd installed it in error. [ L.A. Times report here : http://latimesblogs.latimes.com/technology/2008/08/iphone-i-am-ric.html ]
The app's description was very clear: It said that it did nothing, and the sole purpose was to show your friends* that you're the sort of person who's so rich they can throw a thousand bucks away like that. As such, it didn't violate the App Store rules. (Had it dared to show a woman's nipples, or two men holding hands in a loving relationship, we'd have been spared such a scam, but no, the author chose a picture of a ruby, so that was okay).
* yeah, if you're the sort of person who throws a thousand bucks away to show off, those people who hang around you are definitely your friends.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
