Kaspersky researchers have found that the number of applications capable of bombarding users with unwanted advertising is increasing on official app marketplaces. Three new applications with adware modules were found on the Google Play Store in a span of just three months, potentially affecting millions of users.
Adware is a form of unwanted software that displays ads to users. It has been one of the most popular not-a-virus threat for years. The monetization methods used in such software can pose a threat to users, and yet bring in more revenues for the developers due to greater viewership, with the latter adapting new techniques in order to make sure such ad modules harder to detect by both users and cybersecurity technologies.
While threats that target mobile users are usually distributed through various infected websites or unofficial app stores, income from such activities is appealing, leading to developers trying to expand the number of potential victims they can target. As a result, these applications are at times able to get onto official app stores, as was the case with the samples found by Kaspersky.
“Nowadays we heavily rely on our phones. We work, share personal information and watch entertainment – all on our mobile devices. Obviously, this attracts adware creators’ attention. The problem here is that the adware does not create usability inconveniences that frustrates users; it also—with improperly developed SDKs—could result in data leakages. As an additional way of monetization, developers of those SDKs may profit from selling user data relevant for targeting purposes to third parties to customize ads they are showing to users, without their permission. Every user has their digital comfort zone and relying on their own devices nowadays is more important than ever,” said Igor Golovin, security expert at Kaspersky.
“Considering the techniques used by developers to stop users detecting adware, I strongly advise using a reliable mobile security solution that will be able to stop such applications from invading users’ live,” Golovin adds.
Recent discoveries have indicated there has been a potential rise in this method being used. Kaspersky researchers found three applications with inserted adware modules available on official marketplaces. One of them, a popular interactive questionnaire with millions of downloads, used a post-installation delay before showing ads that the researchers have also seen in other adware applications.
This long delay from installation of the app to the first advertising appearing made it much harder for the user to find the culprit for all the ads that suddenly appeared on the screen. This technique is frequently used to trick automatic protection mechanisms, such as sandboxes in app stores. The developer of the interactive questionnaire immediately removed the adware module once informed.
Other analyzed apps account for almost a 100 million downloads. While carrying out their main functionality, they are also sending users half-screen ads as soon as the smartphone is unlocked, regardless of whether the app is running or not. At the time of the publication of their research, developers of both apps have been contacted and have not responded to the request to remove adware modules.
The spread of adware is not always carried out on purpose, and even legitimate applications can be vulnerable and end up spreading unwanted advertising without their their knowledge. Most often this is due to the use of advertising software development kits (SDKs) and lack of testing an integrated advertising library. As a result, adware modules sneak into the final code of applications.
To protect yourself from adware Kaspersky recommends the following:
- Promptly removing an application that is acting unusually and displays unwanted advertising
- Always check application permissions before installing the application to see what they can access and do on a device.
- Use a reliable mobile security solution, such as Kaspersky Internet Security for Android, that can help detect a variety of threats, including adware.