Do you know? 85% of apps can be decompiled and modified to be injected with malicious code triggering undesired behavior of an app with ulterior motives.
APPs have become the default interface for users to interact digitally with people, services, and platforms. Globally, an estimated 3 million apps are available on Google Play Store.
The common man’s perception is an app is a distinct and infringeable digital asset of an organization. People consider it genuine, especially when it is on a platform like Google Play Store or Apple App Store.
However, the fact is that an app can be pirated and can result in App fraud. Techniques like decompiling an app and modifying the package with malicious code lines make an app vulnerable. Essentially three main threats emanate from a pirated app.
3 Main Threats from a Pirated App
- Compromised Privacy: Irrespective of any such app available over a Play Store or otherwise, if a user inadvertently installs a pirated app considering it to be a genuine version, there is a higher probability of that app being able to access personal data, including contacts, SMS, pictures and other sensitive data that must store on a Smartphone.
- Ad-Fraud: Compromised apps are used as a medium for fraudsters to control a Smartphone, a publishing medium to fake traffic, users, or events. With malicious code lines put along with the app or digital ads, the fraudsters commit ad fraud by getting impressions, app and even trigger clicks, etc., to fake KPIs agreed with an advertiser whose campaigns are being run. At the same time, ill-practiced publishers steal the organic traffic of mobile apps/browsers to credit any activity a user does to earn the attribution without doing any hard work. In this case, such a publisher reports ‘stolen’ traffic as theirs and credits the attribution to get paid for something they never did. This also demotivates the digital marketing team as organic traffic earned after painstaking efforts is tagged as inorganic.
- Brand Safety: Another important ramification of a pirated app version is the damage it causes to the image and reputation of the brand. Since the app is compromised, it cannot guarantee its behavior will align with the tenets of a brand, its philosophy, and its guidelines. This means a spectrum of issues. In its simplest forms, the brand, through this rogue app, could be seen as promoting theft of data, infringing on privacy, displaying obscene content, and several similar issues. Since this app is not in the control of the actual brand, it would not act as a responsible digital asset representing it.
App Piracy Cannot Be Ignored
Unfortunately, app piracy has not been getting its due mindshare from the ecosystem, including governments. There is a need to have strict regulatory guidelines about app piracy for the various damages it could result in, ranging from hampering an individual’s privacy to hurting national interests. While having a national consensus around app piracy is essential, brands cannot and should not wait for the government to intervene. Marketers, every organization, institution, and entity having an app, must keep a vigil on the pirated versions of their apps available either over the Play Store or through non-play store platforms.
Android RAT tools like FatRat and other powerful tools like Metasploit help to pass through the security layers of Android by circumventing the security policies and can even bypass an Antivirus and Firewalls, allowing attackers access to a Meterpreter session. These publicly available tools add to the vulnerability of an app where even app permissions are compromised. So, while a genuine version of an app will be genuinely seeking 10 permissions from the device, a pirated version might be taking entirely different or some more critical permissions, which are not required by the app. Still, fraudsters modify them for their ulterior intentions.
How Can mFilterIt Help?
mFilterIt helps its clients monitor any pirated version created over several alternate app stores and identifies the modification – addition or deletion of permissions fiddled with such duplicated versions. Below are some of the examples to highlight.
In all the above examples, mFilterIt scanned the pirated versions of these popular apps on various APK Stores and identified the modified permissions. This helped the clients take necessary actions and understand the motive behind creating such pirated versions, which ranged from infringing piracy of legitimate users and using these apps for ad fraud.
Monitoring pirated app versions is essential for every organization. However, its importance becomes paramount for sensitive domains like government, security, BFSI, healthcare, etc. Consumers need assurance and trust that the app they are installing on their devices is the verified version of the organization or any other entity they are engaging with. There should be a public repository of identified pirated app versions, and consumers must be made periodically aware of fake apps.
Get in touch to learn more about the threat of app piracy.
