Google is fighting the ongoing malware invasion on Google Play, requiring all new developer accounts that register as an organization to provide a valid D-U-N-S number before submitting apps.
See also: Android spyware disguised as VPN found on Google Play
The new measure aims to strengthen the security and reliability of the platform and is part of the effort to limit the submission of malicious software from new accounts.
Usually, malicious apps on Google Play are submitted for review without dangerous code or harmful payloads, which are later obtained through an update during the post‑installation phase.
Offending apps are reported and removed from the Play Store, and their developers are blocked. However, it is relatively easy for’ them to create a new account and submit the same dangerous apps under a different name and theme.
To address this gap, as of August 31, 2023, Google will require all developers creating new Play Console accounts to provide a valid D-U-N-S number.
The D-U-N-S (Data Universal Numbering System) are unique nine-digit identifiers assigned by the business data and analytics company Dun & Bradstreet to unique businesses.
Organizations that request a D-U-N-S number from Dun & Bradstreet must submit various documents that help verify the provided information, and the process can take up to thirty days.
DUNS is a globally recognized proprietary standard used by the United States, the European Commission, the United Nations , and Apple and is considered trustworthy.
By requiring a D-U-N-S number from software developers, Google will make it much harder for malicious app publishers to re-register in the app store, as they will have to create a new company to return to the platform.
See also: Google Play: Popular file manager apps were spyware
In addition to the above, Google will change the “Contact details” section of app listings on the Play Store, renaming it to “App support” and adding more information about the developer.
Previously, this section housed the developer's name, email, and location; however, it will now also include the company name, full office address, website URL , and phone number .
This change will enhance transparency, giving users the ability to better understand the company responsible for each application.
Google says it will regularly verify information provided by app developers for inclusion in this section.
If they detect any inconsistency, they will suspend the account's ability to publish apps on the Play Store, ultimately removing any existing apps after a certain period of time.
Information source: bleepingcomputer.com
