More Than Half a Billion Android Users Have Installed 'Fleeceware' Apps (zdnet.com) 37
Security researchers from Sophos say they've discovered a new set of "fleeceware" apps that appear to have been downloaded and installed by more than 600 million Android users. From a report: The term fleeceware is a recent addition to the cyber-security jargon. It was coined by UK cyber-security firm Sophos last September following an investigation that discovered a new type of financial fraud on the official Google Play Store. It refers to apps that abuse the ability for Android apps to run trial periods before a payment is charged to the user's account. By default, all users who sign up for an Android app trial period, have to cancel the trial period manually to avoid being charged. However, most users just uninstall an app when they don't like it. The vast majority of app developers interpret this action -- a user uninstalling their app -- as a trial period cancelation and don't follow through with a charge. But last year, Sophos discovered that some Android app developers didn't cancel an app's trial period once the app is uninstalled and they don't receive a specific request from the user. Sophos said it initially discovered 24 Android apps that were charging obscene fees (between $100 and $240 per year) for the most basic and simplistic apps, such as QR/barcode readers and calculators.
Is Android the only platform this happens on? (Score:3)
You have to wonder if there aren't Apple developers with similar leanings.
The worst case is an uninstallable app that gets thrown onto a phone by the manufacturer, so you can't even delete it...
Re: (Score:3)
There are apps that do this in iOS, where they want $9 a week if you want no ads... and the ads last 2-3 minutes, and allow 5-10 seconds of gameplay. Facebook has also been having hundreds of places push banal iOS games (where the publisher name is a 64 character random hex string) as well.
Historically, because the barrier to being an Apple app publisher has been higher than Android, coupled with Apple swinging the banhammer without mercy and being a zealous gatekeeper has kept the app store fairly clean.
Re: (Score:2)
I think that with iOS the real predatory apps have been the ones aimed at getting small children to rack up hundreds or even thousands of dollars of in-app purchases after mommy or daddy thought they were getting a cheap babysitter for a few hours. There's still the grown-up versio
Comment removed (Score:4, Informative)
Re: Is Android the only platform this happens on? (Score:2)
I think that only started happening in iOS 12
Re: (Score:2)
Re: (Score:2)
Apple has Gated Community storefront where Application Developers have to go through often crazy hoops to get their program approved for the Apple Store, then they need to pay Apple a Cut on their profit. Makes it a harder way to trick users. Sure they are loop holes, but Google Open Store is also open to Bad actors.
Re: (Score:2)
I don't see how this makes it any harder. As long as they pay Apple their cut, they are free to charge whatever they like.
Re: Is Android the only platform this happens on? (Score:2)
Yes. They do it through the subscription service. I read not long ago that a weather app was charging $8 dollars per week and all it was doing was displaying the same free weather info that the apple weather app displayed. The apps talk about a free trial period, but they do not clearly indicate that the subscription has already been started. Users often forget to unsubscribe. Apple makes it rather difficult to unsubscribe to Services. I think this article is more or less a rehash of the one I read about Ap
Re: (Score:2)
Re: (Score:2)
Happens with snail mail too (Score:3)
Fake news! (Score:1)
"New Type"??? (Score:2)
I was a victim of this (on Android) at least 2 years ago. And I complained loudly and long.
I found that the suppliers of an app I had "canceled" and "uninstalled" long before had been charging me each month. It was a relatively small amount so I didn't even know at first. But it really pissed me off that I was getting charged for something I wasn't using.
The software company was recalcitrant, and I had to deal with "it is our policy..." BS for several calls and about
Re: (Score:3)
And this is why I have decided to never link any means of payment to my google account and stick to the free apps, even if some of them are a bit lobotomized.
There are enough apps out there anyway, so it's not a big issue.
Re: (Score:2)
Once bitten, twice shy as they say.
Re: (Score:2)
That's just how apps are. Most app developers on the stores seem to be fly by night, so they are hoping for suckers to give them a subscription, so they can just trash everything and let be the user's responsibility to try to find how to cancel.
Part of the blame was having an in app purchase mechanism in the first place. When that came out in both iOS and Android, quality of apps just plummeted from decent games that cost a few dollars to games which were deliberately made of impossible difficulty to requ
Re: Weird that they would charge yearly (Score:2)
Game of War had to be the biggest example that. The mechanics of the game had crazy inflation. Resource costs always went up exponentially as they roll out new levels. I talk to people who have been playing and subsequently paying $100-$200 every month. Thats pretty fucking expensive for a game with shit graphics and stupid gameplay.
Re: (Score:2)
Game of War had to be the biggest example that. The mechanics of the game had crazy inflation. Resource costs always went up exponentially as they roll out new levels. I talk to people who have been playing and subsequently paying $100-$200 every month. Thats pretty fucking expensive for a game with shit graphics and stupid gameplay.
And a marketing strategy based solely on Kate Upton's tits.
undervalued TCC: total cost of cluefulness (Score:2)
The TCO of policing the apps on my Android phone eventually reached the point where I turned off my data modem and solved the problem permanently. This was on top of the TCO of policing my network security, which is basically infinite on a locked phone if you really
Re: (Score:2)
You only use your phone for voice and possibly text? (depending on carrier, I am pretty sure Google Fi sends text over the data connection)
That is like the boomerist solution to data security I have ever heard.
Re: undervalued TCC: total cost of cluefulness (Score:3)
Try NoRoot Firewall (Score:2)
You can select which apps to allow/deny data to, or can allow them to only connect to WiFi and not mobile
https://play.google.com/store/... [google.com]
Google? (Score:2)
Since when do you (as a developer) get notified by Google when an Android app gets uninstalled? Since Google knows you are uninstalling this app from your last device, Google is the one that charges the subscription, and Googles own store is where you cancel the subscription, how about Google takes some accountability in making sure you get notified that you can cancel your trial
Re: (Score:2)
That's why I never sign up for anything with a "free" trial. They're all scams, and should be illegal.
Re: (Score:2)
I'll sign up at some sites to use their tool once (such as an e-card), then, as soon as the I'm notified that the recipient has the product, log back in and cancel. So far, it's worked. Yes, I know, there's always a first time.
Re: (Score:2)
I've looked in the Play Store, even after logging in to Google. Haven't seen anything like a subscriptions list. Of course, having no payment method registered with the store might have something to do with it.
Good luck, motherfuckers.... (Score:2)
Natural Selection? (Score:2)
Is this the technical equivalent of natural selection? I read this as "More Than Half a Billion Android Users Have Installed The New Shiny App Icon on Their Phone Without Knowing What It Really Is".
Seriously, people are ignorant when it comes to personal security. This shit needs to be taught, along with personal financial, health and nutritional requirements in schools, and there should be free public education on these subjects for those out of school.
QR Readers (Score:2)
I have never understood how Google could be so unaware of how QR codes are marketed as a fundamental intrinsic park of a mobile phone, they work out of the box with the standard camera iOS app, and yet are one of the harder functionalities to get on an Android.