February 16, 2016 By Larry Loeb 2 min read

At the beginning of this month, Symantec sounded the alarm about Android.Lockdroid.E ransomware, which it said at the time could affect 67 percent of Android users, along with other existing Android ransomware.

The ransomware posed as a pornography app called “Porn ‘O’ Mania,” but its true aim was to take control of the device. It would first try to access device information with a screen that masks the system activation dialog. This dialog is overlaid by a fake “Package Installation” window.

When the user would click on a seemingly innocuous “Continue” button, they give the program root access. It then went on to inflict usual ransomware damage like locking the phone’s screen and encrypting files, demanding payment to get things right once again.

…And It Didn’t Trick Users

But guess what? It failed.

IT PRO reports that Elena Kovakina, senior security analyst at Google, told attendees at the Kaspersky Security Analyst Summit in Tenerife, Spain, that not one Android user was successfully fooled into downloading the ransomware.

According to Kovakina, this was because Google’s security features would have flagged it through Google’s Verify Apps system. The tool scans all the apps available in the Google Play Store and as many of those side-loaded through other app stores as possible.

Kovakina told the summit, according to IT PRO, that malicious apps featuring Lockdroid were downloaded by fewer than 1,000 devices and that Google’s own analytics revealed that “no users actually installed it.” She did not share exactly how those analytics came to that conclusion.

The Verify Apps System

Kovakina said that Google performs scans on 2 million apps every week, looking for what it calls “potentially harmful apps,” or PHAs. These kinds of apps are broadly defined by Google to include ransomware, Trojans or surveillance apps.

The vast majority of PHAs come via “side-loaded” apps, which originate in other app stores such as torrent sites. According to Google, Google Play apps are 10 times safer than apps from other sources. The infection rate of Android handsets with apps from third-party stores has slid from 2 percent to 1 percent in the past three months. However, handsets containing only Google Play apps are at all but zero, according to Google.

Google claims that its data analysis can also spot when users are not blocking or uninstalling apps after repeated warnings. This may be because the app is using persistence techniques to dodge removals, such as getting administrator powers, or perhaps the user want to keep it and is unaware of the risk.

The Implications of VA

Kovakina told the summit that in one case in Russia, Google had used Verify Apps to remove a “malicious app” without user permission, based on the assumption that people were trying to get rid of it and failing. While she said that this is something Google only uses “sparingly” for “extremely malicious campaigns,” the fact that Google can do this at all should give one pause.

There seems to be no recourse to the power of Verify Apps. Google acted unilaterally in the app removal, according to Kovakina. This ability dramatically demonstrates who has the ultimate power over Android usage — and it is Google, not the user.

More from

CISA’s cyber incident reporting portal: Progress and future plans

3 min read - On August 29, 2024, CISA announced the launch of a new cyber-incident Reporting Portal, part of the new CISA Services Portal.“The Incident Reporting Portal enables entities and individuals reporting cyber incidents to create unique accounts, save reports and return to submit later, and eliminate the repetitive nature of inputting routine information such as contact information,” says Lauren Boas Hayes, Senior Advisor for Technology & Innovation, at CISA.Shortly after the announcement, Security Intelligence reported on how the portal was designed and…

Apple Intelligence raises stakes in privacy and security

3 min read - Apple’s latest innovation, Apple Intelligence, is redefining what’s possible in consumer technology. Integrated into iOS 18.1, iPadOS 18.1 and macOS Sequoia 15.1, this milestone puts advanced artificial intelligence (AI) tools directly in the hands of millions. Beyond being a breakthrough for personal convenience, it represents an enormous economic opportunity. But the bold step into accessible AI comes with critical questions about security, privacy and the risks of real-time decision-making in users’ most private digital spaces. AI in every pocket Having…

Government cybersecurity in 2025: Former Principal Deputy National Cyber Director weighs in

4 min read - As 2024 comes to an end, it’s time to look ahead to the state of public cybersecurity in 2025.The good news is this: Cybersecurity will be an ongoing concern for the government regardless of the party in power, as many current cybersecurity initiatives are bipartisan. But what will government cybersecurity look like in 2025?Will the country be better off than they are today? What are the positive signs that could signal a good year for national cybersecurity? And what threats should…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today