2

Assuming I always download all my apps from official google's app store, how can I still be a victim of a malicious app that was repackaged? or in other terms is app repackaging attack possible via app store?

  • What about a repackaged app that is similarly named to the original, and you are tricked into downloading it? – multithr3at3d Feb 12 '18 at 3:40
  • @multithr3at3d I am assuming Google employs certain detection mechanisms which will not let such an app publish. – n0unc3 Feb 12 '18 at 6:07
  • @n0unc3 Every system has some loopholes. Attackers find some way around the defense mechanism to get their malicious app into the play store. Consider the scenario mentioned in the answer. – Navi Feb 12 '18 at 17:23
1

Google is constantly improving security of Play Store. Yet, the malicious actors' motivation is very high, and repackaging is one of the popular techniques among them.

As a user, you should check that the publisher is same as you expect, and what "other apps" this publisher has. In any case, be careful about the permissions you grant to any app.

If you come across a repackaged apk, please report it to Play Store, as courtesy to other users.

|improve this answer|||||
1

Answering the question: Yes,

Consider a case that you saw some ads regarding an Android game in some website you visited, which is popular among your friends. When you click the link the actual play store might come up and start downloading the game. But that application might be a repackaged one. Here the attackers download that application from the play store, reverse engineer it, and add malicious payloads, which is later uploaded to app market with a slightly different name, such that users might not notice it.

Google has been trying really hard to secure the Android users by filtering out all the malicious apps in the play store. But as we all know there are a lot of malicious apps that have sneak past Google play stores defenses.

Play store has built-in defense mechanisms to screen every app for malware, ransomware, and other bad intents. It was reported that the BankBot malware family was also detected in the play store apps.

In most of the cases, millions of downloads happen before Google finds and removes the application from the store. Attackers don't need to code in such a way that they have to exploit a vulnerability in the security system, they just trick the system using simple methods like, a delayed start, encrypt the malicious content, trick the user into download the malicious content from external sources etc.

Google had removed 700,000 malicious Android apps found in Google Play store last year. Also, they had banned several developers for creating such apps.

Hope you have got the answer you were looking for.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.