Google Play Store has been identified as the primary source of malware installations on Android devices in a recent academic study – which is considered the largest of its kind conducted to date.
Using telemetry data provided by NortonLifeLock (formerly Symantec), researchers analyzed the origin of app installations on more than 12 million Android devices over a four-month period (from June to September 2019).
Overall, the researchers examined more than 34 million installs APK (Android application) for 7,9 million unique applications.
The researchers said that of the apps they analyzed, between 10% and 24% could be described as malicious or unwanted apps.
However, the researchers specifically focused on the relationships between installers and child apps to uncover the route that malicious apps take to reach users ' devices .
The research team said it examined 12 major categories that lead to app installations, which included:
- Applications that have been installed from the official Play Store
- Applications that are installed from alternative markets (also known as third‑party app stores),
- Downloading applications via web browsers
- Applications installed via commercial PPI programs (pay-per-install)
- Installed applications via backup and restore
- Installed applications from a direct message
- The application was loaded onto the disk and installed via the local file manager
- Installed applications from file sharing applications
- Preinstalled applications on the device (bloatware)
- Applications installed via mobile device management (MDM) servers (applications installed by enterprises on employee devices)
- Applications installed via “package installers”
The results showed that about 67% of the malicious app installs identified by researchers originated from the Google Play Store.
10% came from alternative markets, dispelling a common belief that most Android malware originates from third‑party app stores.
The research, titled “How Did That Get In My Phone? Unwanted App Distribution on Android Devices,” is available for download in PDF and was written by researchers at NortonLifeLock and the IMDEA Software Institute in Madrid, Spain.
Information source: zdnet.com
