Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

1/31/2018
11:53 AM
50%
50%

700,000 Bad Apps Deleted from Google Play in 2017

Google rejected 99% of apps with abusive content before anyone could install them, according to a 2017 security recap.

Google took down 700,000 apps from Google Play in 2017 because they violated the store's policies. This marks a 70% increase from the amount of apps removed in 2016, reports Google Play product manager Andrew Ahn in a blog post on 2017 security measures.

Ahn says 99% of malicious apps were identified and rejected before anyone could install them. Improvements in detection models helped find apps containing malware or inappropriate content, as well as threat actors and abusive developer networks. Google Play took down 100,000 bad developers in 2017 and made it difficult for them to create new accounts.

Examples of bad apps that were removed include copycats, which try to deceive users by disguising as famous apps. More apps were flagged for content, including pornography, extreme violence, hate, and illegal activities. Potentially harmful applications, which had a 50% lower install rate in 2017, are designed to phish users' data, act as Trojans, or conduct SMS fraud.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GonzSTL
100%
0%
GonzSTL,
User Rank: Ninja
2/2/2018 | 1:02:55 PM
Re: Apples to Androids
Unrelated but analogous was IBM's use of an open architecture when it built the IBM PC. Sure, it opened up the PC marketplace for software, add-in boards, etc., but it also killed their PC business as cheap clones flooded the market. So where it is a good idea to encourage large numbers, those large numbers have a way of biting back at the idea.
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/2/2018 | 5:07:17 AM
Re: Apples to Androids
@Brian: So it's a numbers game. You get the growth, but at a huge cost to security -- but with the business expectation that the gains will outweigh the losses (particularly because the market is so small).

Which is all well and good until you consider that, I suspect, this and other instances of allowing poor and easily exploitable security practices may contribute to an ultimate tyranny of small decisions.
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
2/1/2018 | 3:48:49 PM
Re: Apples to Androids
@JoeS: Yes, Apple is much better at vetting than Google, so is Microsoft.  As pointed out on another site about same story yesterday: Google wanted massive numbers of apps, largely as a marketing point.  Best way to do that is an open-door policy.  That got them their market share - at a price. 
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
2/1/2018 | 12:04:36 PM
Apples to Androids
This is a headline you just don't see when it comes to Apple's App Store. As has been pointed out in the Tweetsphere, this means that Google allowed 700,000 crappy, malicious apps into its poorly guarded app store.
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27852
PUBLISHED: 2021-01-20
A stored Cross-Site Scripting (XSS) vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
CVE-2021-3137
PUBLISHED: 2021-01-20
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
CVE-2020-27850
PUBLISHED: 2021-01-20
A stored Cross-Site Scripting (XSS) vulnerability in forms import feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via the import of a GF form. This code is interpreted by users in a privileged role (Administrator, Editor, etc.).
CVE-2020-27851
PUBLISHED: 2021-01-20
Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privile...
CVE-2020-13134
PUBLISHED: 2021-01-20
Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1...