February 16, 2016 By Larry Loeb 2 min read

At the beginning of this month, Symantec sounded the alarm about Android.Lockdroid.E ransomware, which it said at the time could affect 67 percent of Android users, along with other existing Android ransomware.

The ransomware posed as a pornography app called “Porn ‘O’ Mania,” but its true aim was to take control of the device. It would first try to access device information with a screen that masks the system activation dialog. This dialog is overlaid by a fake “Package Installation” window.

When the user would click on a seemingly innocuous “Continue” button, they give the program root access. It then went on to inflict usual ransomware damage like locking the phone’s screen and encrypting files, demanding payment to get things right once again.

…And It Didn’t Trick Users

But guess what? It failed.

IT PRO reports that Elena Kovakina, senior security analyst at Google, told attendees at the Kaspersky Security Analyst Summit in Tenerife, Spain, that not one Android user was successfully fooled into downloading the ransomware.

According to Kovakina, this was because Google’s security features would have flagged it through Google’s Verify Apps system. The tool scans all the apps available in the Google Play Store and as many of those side-loaded through other app stores as possible.

Kovakina told the summit, according to IT PRO, that malicious apps featuring Lockdroid were downloaded by fewer than 1,000 devices and that Google’s own analytics revealed that “no users actually installed it.” She did not share exactly how those analytics came to that conclusion.

The Verify Apps System

Kovakina said that Google performs scans on 2 million apps every week, looking for what it calls “potentially harmful apps,” or PHAs. These kinds of apps are broadly defined by Google to include ransomware, Trojans or surveillance apps.

The vast majority of PHAs come via “side-loaded” apps, which originate in other app stores such as torrent sites. According to Google, Google Play apps are 10 times safer than apps from other sources. The infection rate of Android handsets with apps from third-party stores has slid from 2 percent to 1 percent in the past three months. However, handsets containing only Google Play apps are at all but zero, according to Google.

Google claims that its data analysis can also spot when users are not blocking or uninstalling apps after repeated warnings. This may be because the app is using persistence techniques to dodge removals, such as getting administrator powers, or perhaps the user want to keep it and is unaware of the risk.

The Implications of VA

Kovakina told the summit that in one case in Russia, Google had used Verify Apps to remove a “malicious app” without user permission, based on the assumption that people were trying to get rid of it and failing. While she said that this is something Google only uses “sparingly” for “extremely malicious campaigns,” the fact that Google can do this at all should give one pause.

There seems to be no recourse to the power of Verify Apps. Google acted unilaterally in the app removal, according to Kovakina. This ability dramatically demonstrates who has the ultimate power over Android usage — and it is Google, not the user.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today