ABSTRACT

CCS CONCEPTS

KEYWORDS

INTRODUCTION
1
Android is one of the most popular mobile device platforms in the world, with the number of Android apps available on Google play exceeding 2.9 million as of May 2017 [3]. The large popularity of Android also has attracted attackers as the target of malicious ac- tivities such as the uploading of malware or illegal piracy [5]. One of the reasons there are many malicious/cloned apps on Android is the openness of the Android ecosystem, which has enabled var- ious third-party marketplaces to operate independently from the official Android marketplace – Google Play. We also note that in some areas, such as China and Cuba, access to Google Play has some restrictions [9]. In such areas, Android users need to rely on the third-party markets as their default gateway to acquire apps. As we will show later, third-party markets are operated by vari- ous organizations, including web service providers or hardware vendors. The diversity of the third-party marketplaces operating globally has made it difficult to assess their security. Although there have been a large number of studies that have analyzed apps collected from third-party marketplaces, their overview has been limited to a few popular marketplaces. As we shall show later, there exists several marketplaces that have not received attention in the research community. On the basis of this background, we aim to answer the following research question: RQ: Are these third-party marketplaces securely managed? To answer the question, we first collected over 4.7 million of An- droid apps from 27 third-party marketplaces. We also collected 15 K of paid apps from the official market, Google Play. We then ana- lyzed them to assess their security measures, i.e., uploaded/scanned malware samples and duplicated apps among marketplaces. We de- fined a security index that aims to quantify the security measures of a market and then visualized the relationship between the security index and the popularity of the marketplace. Through this analysis, we derived the following findings. Apps published in some market- places, which have not been studied in the research communities, have not been exposed to the "dragnet" of online virus checkers. There are some intrinsic patterns of releasing/cloning apps among multiple marketplaces, and, finally, there are several marketplaces that, despite their high popularity, are insecure.
2
DATA
In the process of compiling a list of third-party marketplaces oper- ated in various countries, we found that English searching is not always the best solution. We, therefore, recruited several people who are conversant in languages, including Chinese, Italian, Ger- man, Spanish, Turkish, Russian, Arabic, Vietnamese, Thai, Persian, etc. We asked the participants to report on the third-party market- places widely used in their countries/areas. In total, we collected a report involving marketplaces using 15 different languages. From the list of reported third-party marketplaces, we selected the 13 marketplaces that appeared to be important. Table 1: List of marketplaces: 13 marketplaces at the top of the table are the ones we crawled and the 14 marketplaces/dataset at the bottom are from Androzoo dataset.
(7) http://www.entumovil.cu/downloads/apps, (8) http://www.getjar.com/, (9) http://www.mobogenie.com/, (10) http://www.mobomarket.net/, (11) https://www.uptodown.com/android/, (12) https://m.store.yandex.com/, and (13) http://zhushou.360.cn/. The 13 markets we chose are listed in Table 1. The market names used on this table are chosen for convenience and can differ from their actual names. We collected data from June to September of 2016. The format of how apps are released varies by market (website or client application). As the application protocol interface (API) also differs by market, we conducted reverse engineering for each market using selected tools [4, 7, 8] and developed crawlers. Additionally, we parsed metadata such as app documentation or download counts if they were available. To obtain these data, we primarily crawled apps listed in each market's rankings. It is unclear whether we were able to crawl the entirety of each market, and we will describe this problem in greater detail in Section 6. We collected about 800 thousand apps in total, including duplicate apps that were released to multiple markets. In addition to the 13 marketplaces we described above, we also made use of the Androzoo dataset [11], which is a dataset used by researchers of Android apps from 14 different markets/sources that includes Google Play, the Genome malware dataset [21], and torrent files. We used the Androzoo list of July 10th, 2016, which included about 4.3 million apps. Although this dataset does not include meta- data for markets, it does includes the detection count of VirusTotal. Further details on the markets contained in this dataset can be found in the original paper [11]. In total, the size of the dataset we collected was about 45 TB. A breakdown of the dataset is summarized in Table 1. We computed the MD5 hash value for each Android application package (APK) and found a unique APK number of 4,761,283 and a unique package name of 2,827,578.
ANALYSIS OF MOBILE APP SECURITY
3
Dragnet Analysis
3.1
Our "dragnet analysis" provides a unique metric to app secureness by measuring the degree in which an app is exposed to the eyes of scrutinization; intuitively, it is based on the assumption that the more apps are seen and investigated by researchers, the safer they should be. In this work, we attempted to measure such a property by whether or not an app has already been scanned by online app scanning services in the past. Nowadays, the use of such services is quite prevalent as they are used not only in many research activities but also by general users via web interfaces. Furthermore, the results are often made public and are available through search engines, and uploaded files are shared across some organizations. We believe these points justify our choice. Understanding the Security Management of Global Third-Party Android Marketplaces
The online scanner service we used is VirusTotal [10], which is an online anti-virus service that comprises more than 60 different commercial anti-virus checkers. We queried the hash value of each APK we crawled to VirusTotal in order to obtain a scan report for each. For each market, we calculated the percentage of apps that had been not scanned by VirusTotal at that time. Because the data from Androzoo have already been scanned, we ignored them in this analysis. The results of this analysis are shown in Table 2. We found that several marketplaces such as Cafebazaar , which is a marketplace operated in Iran, had fewer fractions of apps that had been scanned with the online virus checkers. This observation indicates that many of apps in such marketplaces potentially have unfixed vulnerabilities.
Breakdown of Benign / Malicious Apps
3.2
Figure 1 shows the fractions of apps detected as malware for each market. For this analysis, we analyzed the apps, which had not been scanned with the VirusTotal before. We note that apps that were too large to be scanned are omitted. To determine if an app can be labeled as "malware", we use a conservative threshold; i.e., we consider any app detected 10 times or more is considered to be malware. We also note that we consider any app detected 10 times or more and with at least one adware label to be adware Because the data from Androzoo only include detection count (not with label), we cannot distinguish between adware and malware for this market, and we consider all of the Androzoo's apps shown here to be malware. Although we could obtain scan reports for such apps ourselves, we had to skip it due to the limitation of our resource and time. As Genome , shown in the top part of the figure, is the dataset of malware, it is not surprising that the fraction of malware is 100%. This test shows us that the virus checkers we used worked correctly for this dataset. Overall, Chinese marketplaces, such as Appchina , Anzhi, and Baidu, have high fractions of malicious apps. In contrast, Google Play had the high fraction of benign apps. It is interesting that Cafebazaar , whose not-scanned rate was the highest, had the highest benign rate. This result indicates that a market may have a low malicious rate even if researchers have not previously examined it. Or, this could indicate that virus checkers used for VirusTotal missed the detection of malicious apps in the marketplace; we leave the study for our future work. We also see that Fdroid, an open source community, also had a high benign rate. This observation seems to be natural given the nature of the marketplace.
CIRCULATION OF MOBILE APPS ON THE
4
GLOBAL MARKETPLACES
Some apps are distributed to multiple markets; we call these multi- released apps. In some cases, an app is released to multiple market- places by its developer, seeking for more customers. Or, an outsider can also release a repackaged app to other marketplaces to benefit from pirated version of the app or even to disseminate malware, which looks like a popular benign app. In this work, we are inter- ested in the latter case. Since it is not straightforward to distinguish between the two cases shown above, we do not attempt to directly distinguish them. However, we will study the characteristics of multi-released apps from the viewpoints of security measures; i.e., inclusions of malware and the use of license verification library for protecting apps from the illegal piracy. To detect multi-released apps, we can use two approaches, the package name match and the MD5 hash value match. While the package name match can incorporate the variation of versions, it could suffer from the app renaming because there is no centralized system that governs the naming of apps among the third-party mar- ketplaces. MD5 hash value match strictly guarantees that apps with same hash value are identical. However, they cannot incorporate the variation of versions. Since it is not feasible to collect all the versions for the millions of apps, we use these two approaches to compensate for each weak point. Given these backgrounds in mind, we aim to understand how app multi-releasing occurs in the wild.
4.1
Statistics of Multi-released Markets
Figure 2 shows the cumulative percentages of numbers of multi- released markets for each app. From the package name result, we see that around 10 – 20% of apps are released to at least two markets. Yuta Ishii, Takuya Watanabe, Fumihiro Kanei, Yuta Takata, Eitaro Shioji, Mitsuaki Akiyama, Takeshi Yagi, Bo Sun, and Tatsuya Mori We can also see that there apps distributed to a large number of marketplaces; the top one app has been multi-released to 21 mar- kets (com.estrongs.android.pop). com.google.zxing.client.android, com.shazam.android, and xcxin.filexpert have been released to 19 markets. All these apps are legitimate and popular apps in Google Play. We see that an MD5 match is a more strict condition than a package name match; therefore the number of multi-released marketplaces tend to be small. We also present the result for the multi-released malware, which we will describe later. While major- ity of malware samples are published at a single market, there are a few malware samples that are distributed to multiple markets.
Co-occurrence among Markets
4.2
Figure 3 is a heat map that shows how many apps published in a market are also published in other markets. Here, we use the package name match. The color of each cell represents a score computed with the following eq:
where D ( X ) is a set of apps in a market X, M A and M B are the marketplaces A and B , respectively. A market in vertical axis and horizontal axis are represented as A and B , respectively. If the computed score is high, it means that most of the apps in market A are contained in market B. There are many markets having common apps with Google Play. Unless they have special reasons not to, it is natural for developers to release their apps to the official market. On the other hand, the Iranian market Cafebazaar and Chinese markets, such as Mi.com , and Anzhi, do not have many apps in common with Google Play. As we mentioned in Section 5, we see some individuality in the Iranian marke. We speculate that the result for the Chinese markets reflects the fact that Google Play is unavailable in China. We also see that several Chinese markets, such as Mi.com , Anzhi, Hiapk, Appchina, and Zhushou360 , have high numbers of shared apps among them, indicating that many apps are multi-released in those markets.
4.3
Multi-released Malware
Figure 4 shows a heat map of multi-released malware generated in the same manner as Figure 3. This time, we used MD5 for matching because we aimed to ensure that we analyze only malware apps, but not apps that are benign and repackaged into malware. In this analysis, we make no distinction between adware and malware. We first see that there were released malware apps even in the Understanding the Security Management of Global Third-Party Android Marketplaces dataset.
Table 4: Characteristics of multi-released paid apps. The numbers are average values. As of May 2017, 1 USD ≈ 115 JPY.
official market, at least at the time of crawling. In many cases, they are eliminated from the market within several weeks. There are several markets that contain malware in common with Google Play. We also see that several Chinese markets have intrinsic correla- tions, e.g., apk_bang, angeeks, and appchina. As these marketplaces have common malware samples with high probabilities, it is likely malware authors targeted these marketplaces at once.
4.4
Multi-released Paid Apps
In addition to the free apps we collected for this research, we had previously collected 14,906 paid apps from Google Play [17]. We checked the matching between this paid apps dataset and the free apps dataset. Table 3 shows the results. For package name match, we observe roughly 30% of paid apps we collected matched to those in free apps dataset. As we mentioned earlier this number include the cases where popular paid apps are repackaged/renamed in the app with the same package name and released to the third- party marketplaces. For MD5 matching, however, it is not possible to repackage/rename the apps without changing the hash values. Therefore, it is likely that some paid apps published in Google Play are illegally exported to other third-party marketplaces and published as free apps. Of course, there are also cases in which apps are available for free for a limited time or in which developers intentionally release to third-party markets for free. Next, we look into the markets in which paid apps are multi- released for free at a high frequency; the top 4 markets matching this criteria were Appvn, Appchina, Aptoide, and Anzhi. Although we could not determine why these markets have so many paid multi- released apps, we conjecture that these marketplaces imported these paid apps so that it can attract customers. We note that in many cases, the downloaded paid apps from these multi-releasing marketplaces do not work due to the license verification restriction. Characteristics of multi-released paid apps: Table 4 shows the statistics of the multi-released paid apps. There seems to be little relationship between multi-released apps and price. However, we see a trend that the download count of multi-released apps is about three times higher than that of not multi-released apps, suggesting that the top-ranked apps tend to be multi-released.
LVL adoption : We checked the adoption of License Verification Library (LVL) [1] for multi-released paid apps. LVL is the licensing system that validates whether a user has purchased an app legit- imately. An app correctly implementing LVL queries the license server about the purchase status of the user; if the user bought the app legitimately, the app continues to work normally, otherwise, the app can stop working or perform other behaviors. As apps with LVL need to declare the permission CHECK_LICENSE, we can automatically detect apps that aim to use it 1 . Although checking the permission necessarily means that the app actually has code of LVL and uses it, we assume that the derived statistics well represent the ground truth. Table 5 shows the results. Inter- estingly, the fraction of LVL adoption in the multi-released paid apps is higher than that of others, suggesting that more protected apps are multi-released. We also see that the 59% of multi-released apps do not adopt LVL. These apps can be launched without any limitations unless they implement their own license verification schemes. An attacker can remove LVL code from an app using the repack- aging techniques. Using the package name matching, we checked whether LVL had been removed for the multi-released apps with LVL. We found that 153 of 1,739 multi-released paid apps with LVL had their LVL permissions removed. Although this fraction is not significantly high, it signals a threat to app developers that an app's LVL can be removed and the app can be released to other marketplaces. We finally note that there are cases in which crackers remove/modify LVL code without removing the permission.
4.5
Certificate of Multi-released Apps
Finally, we studied the certificates of multi-released apps. The cer- tificates were extracted using the openssl tools. If the certificate in one app is the same as in another, there is a high probability that the two apps were developed by the same developer. Although we cannot conclude if an app has been released to multiple markets by its original developer, we can say that apps sharing a common certificated have not been repackaged by outsiders. On the other hand, if an app with the same package name has been signed with keys in different certificates, there is a high probability that they have been repackaged. We found that 478,653 out of 512,577 multi-released apps for which we could extract certificates using package name matching consistent certificates across each copy. However, the remaining 33,924 package names had at least two certificates that differed from each other. Although some developers may change a certifi- cate across markets, we conjecture that such a case is not common. We note that the package name matching may have brought the Yuta Ishii, Takuya Watanabe, Fumihiro Kanei, Yuta Takata, Eitaro Shioji, Mitsuaki Akiyama, Takeshi Yagi, Bo Sun, and Tatsuya Mori
overlook of the repackaged multi-release apps with changed pack- age names. We found several legitimate apps that were multi-released to many markets (over 17), but were signed with a single key; namely, com.evernote, com.estrongs.android.taskmanager, wp.wattpad, and com.dropbox.android. These legitimate apps are popular in many of global marketplaces. We also found that multi-released apps signed with different certificates had higher malware detection rate, suggesting that such multi-release apps are repackaged into malware.
SECURITY INDEX OF MARKETPLACES
5
Several factors determine the security index of a market. For in- stance, even if a market has many malware apps, if efforts are taken by the market to prevent users from downloading them, we can regard such markets to be safe to some extent. To calculate the security index of a market, we examined the factors described in Table 6. The rate of benign apps takes a continuous value ([0, 1]), while the other factors are binary ({0, 1}). Note that each factor is evaluated not by app but by market. We defined a security index calculated as the sum of each factor multiplied by its weight; i.e., SI = ∑ i w i f i , where w i and f i are the weight and value of the i -th factor, respectively. We explored possi- ble parameter space and empirically derived the weight value as w 1 = 5.0, w 2 = w 3 = w 4 = w 5 = w 6 = 0.5, which was determined so that (1) it refelects the fact that the rate of benign apps should contribute to the security index a lot and (2) it clearly visualizes the differences among the marketplaces. An index takes a value within a range between 0.0 and 7.5. To visualize the relationship between a market's security index and its influence, we used the Alexa[2], which provides the ranking of websites. We plot the results in Fig- ure 5. We note that Genome and Torrent are removed because they are not markets. We also removed Apk_bang because the market was unavailable the time of the study. We notice several markets have low security index despite their high Alexa ranks, e.g., Baidu, Yandex, and Mi.com. As these mar- ketplaces have high impact in terms of the size of users, they may need to improve their security index. As the low indices are mostly caused by high malware rates, they may want to introduce a mech- anism to quickly eliminate apps detected as malware. Google Play's index is high, but it is not the best because it does not provide safety badge. Cafebazaar has an index close to that of Google Play. As we described in Section 2, the market is the most prominent market in Iran and has an own billing system. Because the access to Google Play is restricted in Iran, many users rely on the market. Therefore, it is good that the market exhibits a good security index.
DISCUSSION
6
In this section, we discuss several limitations of our work, i.e., app collection, the methodology of analyzing apps, and collection of metadata.
App Collection
6.1
Although it is not feasible to cover all marketplaces, we did attempt cover a wide range of countries. We did not collect all apps in every market. Instead, we sampled top-ranked apps in each market. Another approach we could take is to apply other sampling schemes such as random sampling. We were also limited by not being able to track the updating or deletion of apps because we did not crawl the markets continuously, like the related work [13]. We leave these issues for our future study.
6.2
The Methodology of Analyzing Apps
First, to cope with a high volume of data, we did not conduct detailed code level analysis. For example, we would compare the codes of multi-released apps with the corresponding codes of originals. Second, we simply matched multi-released apps by package name. As most markets do not allow the submission of apps with existing package names, when an outsider attempts to multi-release an app to such markets, they must change the package name. For repackaged apps in particular, attackers often randomize or append characters to the original string. Therefore, our approach may miss such multi-released apps. To address this issue in the future, we will need to use methods such as APPraiser [12] to detect repackaged apps. In Section 5, we discuss the measurement of the security index. However, measuring such index is not an easy task. For instance, the requirements for developers when they submit an app differs Understanding the Security Management of Global Third-Party Android Marketplaces among marketplaces. The strictness of reviewing apps by market- places are also different among marketplaces. As it is often difficult to quantify such parameters objectively, in this work, we chose some parameters that are intuitively easy to understand from the viewpoints of end-users.
6.3
Collection of Metadata
Androzoo, which we used to obtain Google Play data, does not have market metadata. If we had had access to metadata, we could have observed the transition of multi-released apps by submission date or compared developer information among markets. We leave this issue for our future work.
RELATED WORKS
7
App repackaging is a great concern in Android security. Repack- aging means disassembling the APK – the Android executable file – inserting malicious codes or advertising modules, and then re- building the app [6]. Previously, several methods to detect repack- aged apps have been proposed [14, 18–20]. In the following, we present studies that analyzed third-party markets themselves. In 2011, Vidas et al. [15] collected 41,057 apps from 194 markets and analyzed repackaged apps. They then pro- posed an app verification protocol called AppIntegrity to counter repackaging. AppIntegrity verifies an app to its developer's server using the domain name contained its package name. In 2013, Lindor- fer et al. [13] developed the Andradar framework after a pre-survey involving crawling eight markets. Andradar scans and tracks mal- ware in 16 markets in real time. It is of interest that, in developing the framework, they observed the processes of multi-releasing and deletion of apps. Unlike our work, Andradar focuses only on mal- ware and does not use a large-scaled dataset crawled from each mar- ket. Viennot et al. [16] developed a system called PlayDrone, which efficiently crawls the official Google Play Store. Using roughly 1 million apps collected with PlayDrone, they performed various analyses of Android apps. In this study, in addition to Google Play, we also collected from third-party markets. We also discuss security measures in these markets.
SUMMARY
8
In this paper, we aimed to answer the simple research question: are Android third-party marketplaces secure? To answer this question, we collected more than 4.7 million Android apps from 27 of third- party marketplaces, including markets that had not previously been studied by the research community, and analyzed them in order to study their security measures. Based on our results, we attempted to quantify the security indices of marketplaces. Our key findings are summarized as follows: Apps published in some marketplaces, which have not been studied in the research communities, have not been exposed to the "dragnet" of online virus checkers. There are some intrinsic patterns of releasing/cloning apps among multiple marketplaces, and, finally, there are several marketplaces that, de- spite their high popularity, are insecure. From these findings, we propose the following suggestions to the stakeholders of Android ecosystem: ● End-users : Examine various indicators on the market to measure the safety of apps. • App developers : Check apps that you have developed to see if they have been multi-released without your knowledge. Im- plement countermeasures against manipulation. For paid apps, implement LVL in addition to taking the steps above. Appropriate LVL implementation can prevent an app from launching even if it has been multi-released. • Marketplaces : Improve the security indice we provided in this work so that end users can measure the safety of the market in a visible way. Sharing the information about the detected mali- cious apps or illegally pirated apps among marketplaces would be beneficial.
ACKNOWLEDGMENT
A part of this work was supported by JSPS Grant-in-Aid for Scien- tific Research B,Grant Number JP16H02832.