At the beginning of this month, Symantec sounded the alarm about Android.Lockdroid.E ransomware, which it said at the time could affect 67 percent of Android users, along with other existing Android ransomware.

The ransomware posed as a pornography app called “Porn ‘O’ Mania,” but its true aim was to take control of the device. It would first try to access device information with a screen that masks the system activation dialog. This dialog is overlaid by a fake “Package Installation” window.

When the user would click on a seemingly innocuous “Continue” button, they give the program root access. It then went on to inflict usual ransomware damage like locking the phone’s screen and encrypting files, demanding payment to get things right once again.

…And It Didn’t Trick Users

But guess what? It failed.

IT PRO reports that Elena Kovakina, senior security analyst at Google, told attendees at the Kaspersky Security Analyst Summit in Tenerife, Spain, that not one Android user was successfully fooled into downloading the ransomware.

According to Kovakina, this was because Google’s security features would have flagged it through Google’s Verify Apps system. The tool scans all the apps available in the Google Play Store and as many of those side-loaded through other app stores as possible.

Kovakina told the summit, according to IT PRO, that malicious apps featuring Lockdroid were downloaded by fewer than 1,000 devices and that Google’s own analytics revealed that “no users actually installed it.” She did not share exactly how those analytics came to that conclusion.

The Verify Apps System

Kovakina said that Google performs scans on 2 million apps every week, looking for what it calls “potentially harmful apps,” or PHAs. These kinds of apps are broadly defined by Google to include ransomware, Trojans or surveillance apps.

The vast majority of PHAs come via “side-loaded” apps, which originate in other app stores such as torrent sites. According to Google, Google Play apps are 10 times safer than apps from other sources. The infection rate of Android handsets with apps from third-party stores has slid from 2 percent to 1 percent in the past three months. However, handsets containing only Google Play apps are at all but zero, according to Google.

Google claims that its data analysis can also spot when users are not blocking or uninstalling apps after repeated warnings. This may be because the app is using persistence techniques to dodge removals, such as getting administrator powers, or perhaps the user want to keep it and is unaware of the risk.

The Implications of VA

Kovakina told the summit that in one case in Russia, Google had used Verify Apps to remove a “malicious app” without user permission, based on the assumption that people were trying to get rid of it and failing. While she said that this is something Google only uses “sparingly” for “extremely malicious campaigns,” the fact that Google can do this at all should give one pause.

There seems to be no recourse to the power of Verify Apps. Google acted unilaterally in the app removal, according to Kovakina. This ability dramatically demonstrates who has the ultimate power over Android usage — and it is Google, not the user.