Eco and Ego Apps in Japan

Transcription

1 Eco and Ego Apps in Japan A special report based on the Trend Micro research paper written by senior threat researcher Noriaki Hayashi 1 Users face various unwanted app routines in the current mobile landscape. Given this situation, market owners have taken certain measures like providing safety guidelines, conducting prerelease quality assurance checks, and introducing access permission layers at the OS level. Unfortunately, these are still far from being fool-proof solutions. The reality is: Users are responsible for checking if the apps they download are legitimate or not. The Difference Between Ego and Eco Apps Trend Micro defines ego apps as those that: Consume device resources Display pop-up ads Violate users privacy Eco apps, on the other hand, are ecologically conscious or economically effective apps. 1 The full research paper (in Japanese) is available for download at doc_dl/select.asp?type=1&cid=108.

2 Threats Free Android Apps Pose Ad agents or networks help app developers offer apps at lower prices or even for free. This relationship is part of the so-called eco cycle. There are, however, times when users with malicious intentions abuse the legitimate wares ad agents or networks offer to gather private information. This is one of the reasons why the number of ego apps is increasing in Japan. Ad agents or networks provide app software development kits (SDKs) to app developers. Inserting the SDK ad agents or networks provide into their code allows app developers to make money from the in-app ads. Their earnings will depend on how many of the ads that appeared in their apps were viewed and/or clicked. The revenue the developers get allow them to charge very little or no money at all for the use of their apps. Users put their personal information at risk when they download free or cheap apps because some ad networks do not have end-user license agreements (EULAs) prior to installation. Doing so allows them to get private user information without consent. As such, the greater the number of privacy-violating apps, the greater the data-theft risk users face. The following are just some of the ways by which ad agents or networks are misused or abused by malicious users: Creating ad shortcuts on the mobile desktop Pushing notification ads Installing apps without user confirmation

3 Some mobile ads are used to promote apps. Each ad click usually leads to a download page. However, some automatically download apps, which can be malicious in nature, despite lack of user consent. This leads to a vicious advertising method similar to a drive-by attack on a computer. Best Practices to Mitigate Data Leakage Due to App Use App Users Check the app and its developer s reputation prior to download Check what kind of private data the app seeks access to prior to download Do not use an app if you are doubtful of its purpose App Developers Properly present app EULAs, private policies, and permissions Check what kind of private data an SDK extracts and how to properly use it before integrating it into an app Google Play is well-known in Japan. It is interesting to note, however, that among its top 200 free general and game apps, we found some that demonstrated malicious routines, posted privacy risks, and drained devices batteries. 2 2 On August 31, 2012, we sampled a total of 400 free apps from Google Play ( google.com/) to check for suspicious routines, privacy leakage risks, and battery consumption efficiency with the help of the Trend Micro Mobile App Reputation technology ( newsroom.trendmicro.com/index.php?s=43&news_item=948&type=archived&year=2012).

4 Malicious and High-Risk Apps All of the malicious and high-risk apps among the top 200 general and game apps we have seen showed malicious ads and gathered private user information. 3 In addition, 5% of the total number of apps can be considered high-risk apps. They, for instance, gather personal information like a user s geographical location and unique device ID. Game apps excessive battery consumption could be attributed to the high processing capability needed to make features like 3-D graphics work. In such cases, we assume that users know this but enjoy using the apps so much that they do not care. In some instances though, some apps indicate their battery-consumption level as high despite just using 2-D graphics, which do not need high processing capability. These apps developers did not consider resource efficiency in their design and can be regarded potentially dangerous egoistic apps. Battery-Draining Apps Among the apps we analyzed, 16.5% of the total number of game apps had a tendency to excessively consume a device s battery. The same was true for 17 of the total number of general apps, which were found under seven out of the 22 app categories. 3 Note that Trend Micro defines high-risk apps as those that gather more private user information than necessary for them to work. As such, they may pose privacy risks.

5 Safer Smartphone App Use and Delivery To eliminate ego apps and increase the number of eco apps, users regardless of security awareness level need a means to easily check if the apps they wish to download are safe to use and do not drain their devices batteries. It is also important for all people who work on apps (i.e., developers, advertisers, etc.) to stay abreast of the happenings in the threat landscape. This will allow them to use this information to make sure the apps they offer are safe to use and efficient. Only then can we expect a better market that promotes the responsible use and development of mobile apps. Proactively gather information on apps safety and efficiency prior to download Proactively gather information on libraries and other items used when developing apps to make them safe to use and of better quality Enhance the prerelease checking process to ensure the quality of the apps marketplaces offer for sale or free download TREND MICRO Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cloud security leader, creates a world safe for exchanging digital information with its Internet content security and threat management solutions for businesses and consumers. A pioneer in server security with over 20 years experience, we deliver top-ranked client, server and cloudbased security that fits our customers and partners needs, stops new threats faster, and protects data in physical, virtualized and cloud environments. Powered by the industry-leading Trend Micro Smart Protection Network cloud computing security infrastructure, our products and services stop threats where they emerge from the Internet. They are supported by 1,000+ threat intelligence experts around the globe. TREND MICRO INC N. De Anza Blvd. Cupertino, CA U.S. toll free: Phone: Fax: by Trend Micro, Incorporated. All rights reserved. Trend Micro and the Trend Micro t-ball logo are trademarks or registered trademarks of Trend Micro, Incorporated. All other product or company names may be trademarks or registered trademarks of their owners.