Android, Google removes 46 apps on Play Store and blocks the developer

Google has eliminated a famous Chinese developer from Google Play Store, removing dozens of applications. The operation was initiated after a survey conducted by CheckPoint together with BuzzFeed through which practical findings were found, which abused permits obtained from users.

The developer involved is DO Global, partially owned by Baidu (the Chinese Google), which generated – among the various illicit practices – click on the banners in a fraudulent way in order to maximize profits.

Google has announced that it has taken steps to ” seriously protect users and advertisers ” and that it continually invests in ” tools and resources to combat violations and fraud around the world “. The company has declared to ” actively investigate malicious activity and when infractions are discovered, to act unquestionably, for example: by removing the possibility for a developer to make money with his apps with the AdMob circuit or even by preventing the publication of apps on Google Play Store “.

The researchers involved in the survey have discovered at least six DO Global applications to use ” fake ad-clicking “ practices, simulating even in the background or with the closed app the interaction of the user with specific advertising banners. Before the ban, DO Global had about 100 apps on Play Store, including many published with alternative names (such as Pic Tools Group): 46 have been completely eliminated. According to what is written in the note issued by Checkpoint, a company specialized in computer security, PreAMo (this is the name of the campaign) is made up of three fundamental tools.

The tools are three distinct and separate blocks of code that interact independently with as many advertisers: ” They are not interconnected in terms of code since everyone is stored in a separate package and is started with different actions “.

What unites the three codes is the fact that they communicate with the same ” C&C ” server (Command &Control), which is used to send the statistics and receive the configuration. The behavior of the three tools is similar: they register an ” listener ” element on a banner loaded in the advertising circuit and once the latter is loaded, the ” MotionEvent ” function of the Android framework is used to simulate the click.

Given the different implementations of the libraries used by the different advertising circuits PreAMo uses different approaches based on the targeted agency. In total, there were three: AdMob, Presage and Mopub. Further technical clarifications can be found at this address.