Bad software development kits used without thorough testing could be part of the reason, but obfuscation techniques also avert detection.

According to researchers from Kaspersky, the number of applications capable of bombarding users with unwanted advertising is increasing on official marketplaces. Notably, three new applications with adware modules were found on the Google Play store in a span of just three months, potentially affecting millions of users.

Adware, a form of unwanted software that displays ads to users, has been one of the most popular non-virus threats for years. The monetization methods used in such software can bring in more revenue for developers due to greater viewership, yet pose a threat to users. Developers have also been adapting new techniques in order to make such ad modules harder to detect by both users and cybersecurity technologies.

While threats that target mobile users are usually distributed through various infected websites or unofficial app stores, income from such activities is appealing, leading to developers trying to expand the number of potential victims they can target. As a result, these applications are at times able to get onto official app stores, as was the case with the samples found by Kaspersky.

Recent discoveries have indicated there has been a potential rise in this method being used. Kaspersky researchers found three applications with embedded adware modules available on official marketplaces. One of them, a popular interactive questionnaire with millions of downloads, used a post-installation delay before showing ads that the researchers have also seen in other adware applications.

This long delay from installation of the application to the first advertisement appearing made it much harder for the user to find the culprit for all the ads that suddenly appeared on the screen. This technique is frequently used to trick automatic protection mechanisms, such as sandboxes in app stores. Upon being informed, the developer of the interactive questionnaire application promptly removed the adware module.

Two other analyzed applications account for almost a 100 million downloads. While carrying out their main functionality, they are also sending users half-screen ads as soon as the smartphone is unlocked, regardless of whether the app is running or not. At the time of this publication, developers of both of these apps have been contacted and have not responded to the requests to remove adware modules.

Adware by bad SDKs?

The spread of adware is not always carried out on purpose, and even legitimate applications can be vulnerable and end up spreading unwanted advertising without their knowledge.

Most often this is due to of the use of advertising software development kits (SDKs) and lack of testing of an integrated advertising library. As a result, adware modules sneak into the final code of applications.

Said security expert Igor Golovin, Kaspersky: “Nowadays we heavily rely on our phones. Obviously, this attracts adware creators’ attention. The problem here is that adware does not create usability inconveniences that frustrate users; it also—with improperly developed SDKs—could result in data leakages. As an additional way of monetization, developers of those SDKs may profit from selling user data relevant for targeting purposes, to third parties to customize ads they are showing to users, without permission.”

Every user has their digital comfort zone and relying on their own device nowadays is more important than ever. “Considering the new techniques used by developers to stop users detecting adware, I strongly advise using a reliable mobile security solution that will be able to stop such applications from invading users’ lives.”