It seems that tricksters on Google Play have found another way to make their deceptive apps appear more trustworthy to users. The trick takes advantage of the fact that apart from the app icon and name, there is one more element the user sees when browsing apps – the developer name, displayed just below the app name. So, some app authors have been setting fictitious, high numbers of installs as their developer names, in an effort to look like established developers with vast userbases.
ESET has discovered hundreds of apps using this and similar tricks to deceive users. The apps analysed were either misleading users about their functionality or had no functionality at all, yet most display many advertisements and could eventually also be used to spread malware.
The freedom to set any number of choice as developer name has inspired some remarkably ambitious claims – one game developer, for instance, would like users to believe his games have been installed more than five billion times. (Note: the highest-ranking apps in terms of number of installs fall into the category “1,000,000,000+” at the time of writing; this category includes Google Play itself, Gmail, Facebook, WhatsApp, Skype, etc.)
In one particular case, we saw a developer change his name from a fake installation number to an actual developer name over time, which might indicate the trick is used as a temporary measure aimed at boosting the popularity of newly uploaded apps.
Besides using fake installation numbers to attempt to manipulate users into downloading their apps, some app authors have also been using phrases indicating legitimacy, such as “Legit Apps”, “Verified Applications”, and “Trusted Developers App”. Some also incorporate a check mark symbol, similar to those used as “verified” badges for the accounts of well-known personalities and brands on various social media sites. These are variously included in app icons and names, as well as in developer names. As Google Play does not offer a developer account verification service, any app sporting such a tag should necessarily be considered suspicious.
What to do? How to stay safe?
The tricks described in this article are simple, yet potentially effective, ways to mislead users, particularly those who choose apps based on popularity. Fortunately, the tricks are also simple to spot, if you know what to focus on:
- Make sure to only take the number of installations for each app from the app’s Google Play page, as this is the official number. This will be visible in the “Additional Information” section at the bottom of the page.
- Keep in mind that Google Play does not have a “Verified” badge signifying the legitimacy of apps. It does have the “Editor’s Choice” category, marked by the Editor’s Choice badge in the top right corner of the app’s Google Play page.
- Make sure you read user reviews before downloading any app.
- If an app only has a small number of real installs, and/or was only released within the last few days, leave it for others to be the guinea pigs, no matter how badly you want it.
