Dissecting fleeceware apps: the million-dollar money-making machine in Android and iOS

Jagadeesh Chandraiah (Sophos)
partner message

ANY.RUN - Interactive malware analysis sandbox

http://any.run/

Get fast results in real-time! Intuitive interface. Convenient for any level analysts.

Join for free and start your malware hunting!

partner message

Avira Cloud Sandbox API. Completely private, unlimited-scale, automated malware analysis service

https://oem.avira.com/en/solutions/cloud-sandbox-api

Avira’s Cloud Sandbox API is built to ensure data privacy.

Receive detailed, file-specific threat intelligence reports containing actionable intelligence.

Supports MITRE ATT&CK™ framework.

partner message

Do APT Mercenary Groups Pose Real Threat to Companies?

https://businessresources.bitdefender.com/apt-as-a-service-webinar

Learn about the recent Bitdefender investigation of a new attack attributed to a sophisticated actor offering advanced-persistent-threats-as-a-service.

Access the investigation

partner message

Be a part of the cyber resilience story - explore careers at

https://careers.opentext.com/

Join the cybersecurity and data protection team at Carbonite + Webroot, OpenText companies.

partner message

We don’t just talk about sharing. We do it every day

https://www.cyberthreatalliance.org/our-sharing-model/

Find out more about how threat intelligence sharing and collaboration through the Cyber Threat Alliance can function as a force multiplier to improve defenses across the ecosystem.

partner message

Map Malicious Infrastructures with Pure Signal™ Intelligence

https://partners.team-cymru.com/pure-signal-trial

Elite analyst teams use Team Cymru’s Pure Signal platform to access 50+ data types, including global network flow, PDNS, malware and more.

Start your 2-week trial now!

partner message

What is cyber threat intelligence (CTI) and how is it used?

Join the VB2020 Threat Intelligence Practitioners’ Summit (TIPS)

Join the VB2020 Threat Intelligence Practitioners’ Summit, sponsored by the Cyber Threat Alliance,

to hear from leading industry voices on how CTI sharing can function as a force multiplier to strengthen defenses across the ecosystem.

partner message

Kaspersky Threat Intelligence Portal - find cyberthreats in files, URLs, IPs and domains

https://opentip.kaspersky.com/

Know which alerts or incidents pose real threats, and prioritize them fast and effectively based on impact and risk levels.

partner message

No-Cost Threat Detection for ISPs and Hosting Providers

https://partners.team-cymru.com/nimbus-threat-monitor

Partner with Team Cymru and get near-real-time threat detection, powered by our world-class IP Reputation data.

Join us now!

partner message

Outsource your Unwanted Software/PUA Work for Free

https://appesteem.com/avs

AppEsteem’s feeds sort out the good apps from the Deceptors.

Our criteria are widely accepted. We’ll help with your disputes.

All for Free. Giving you more time to fight real malware.

partner message

Do you want to know how IT security products score in independent tests?

https://www.av-comparatives.org/enterprise/latest-tests/

AV-Comparatives is an ISO certified independent organization offering systematic testing that checks whether security software lives up to its promises.

Results are available for free!

partner message

Defeating Application Fraud - Learn How

https://www.shapesecurity.com/solutions

We protect more accounts from fraud than everyone else in the world combined.

Shape Security is now part of F5 (www.f5.com)

partner message

30+ years of experience in the anti-malware industry

www.virusbulletin.com

Virus Bulletin is so much more than just a great conference.

Check out our website to see what more we have to offer.

partner message

DNSDB®: The DNS Super Power for Security Teams

https://www.farsightsecurity.com/get-started-guide/

Farsight Security DNSDB®: the world's largest real-time and historical database of DNS resolutions.

Get your free DNSDB API key and use it in our newly updated web GUI, DNSDB Scout and your own environments.

Contextualize everything DNS related with one API key - DNSDB.

partner message

Tired of home office and in urgent need of some networking?

https://www.amtso.org/newsletter/

Join the AMTSO community and meet security vendors, testers, journalists, and researchers to discuss cybersecurity trends, tests and standards!

Do you want to pay $69.99/week or even $199.99/year for a horoscope app, palm reading app or even screen editor? Fleeceware is the term used to describe applications that exist both on Android and iOS, claim to be free, offer free trials for a small number of days and then over-charge, with charges ranging from $30 to $300 for simple applications like QR code readers, screen editors and video recorders.

We have been researching these apps since last year and have discovered hundreds of them, many with an install count as high as 50 million and some of them in the top grossing category in Android and iOS app stores.

Android and iOS app revenues, including all in-app purchases, amount to billions of dollars every year. Fleeceware app authors get a cut of 70%-85% of the total cost, so they could potentially make millions in revenue by using a subscription model. This model is very attractive for those with nefarious intentions to make easy money with a simple app.

Fleeceware apps are not just about offering a free trial and then charging users. The authors of these apps are using interesting techniques to promote and make their apps a success. Fleeceware apps use fake reviews and fake installs to increase the visibility of the app. They also invest in a variety of promotional activities to increase their returns such as running ads for the apps in social media platforms like YouTube and Instagram, app search ads, and by creating their own apps just to promote fleeceware.

To avoid scrutiny by security services, fleeceware apps delay the introduction of the subscription model when the app is first published; the fleeceware module only gets introduced at a later stage after the app has gained popularity and fake ratings. This helps the apps evade security checks and helps convince users of the legitimacy of the apps.

In this presentation, we will:

  • Discuss fleeceware apps, demonstrate fleeceware on Android/iOS, and then discuss how such apps evade app store security checks.

  • Delve into the shady world of pay-per-fake review and fake install factories and how anyone can turn their app into an overnight success.

  • Look into fleeceware promotional campaigns using in-app promotions and social media platforms such as Instagram and YouTube.

  • Discuss app subscription revenues, business models and how fleeceware has ended up in top grossing charts.

  • Investigate fleeceware developer profiles and who is creating these apps.

  • Present user stories from app stores on how vulnerable users are losing hundreds of dollars unknowingly.
Jagadeesh Chandraiah
Sophos Jagadeesh Chandraiah is a senior malware researcher at SophosLabs, specializing in mobile malware analysis. Jagadeesh has been working at SophosLabs for over 10 years. Jagadeesh started working on Windows malware analysis and is currently focusing on mobile malware analysis. Jagadeesh has a Master’s degree in computer systems security from the University of South Wales.

Jagadeesh likes to track malware, research and find novel ways to detect and remediate them. Jagadeesh is a frequent contributor to the SophosLabs Uncut blog and has written blog posts about several mobile malware topics. Jagadeesh also regularly presents his research at international security conferences and in the past has presented his research at DeepSec, AVAR, CARO, and Virus Bulletin.

Outside of work, Jagadeesh enjoys playing badminton.
arrow left Back

Dissecting fleeceware apps: the million-dollar money-making machine in Android and iOS

Jagadeesh Chandraiah (Sophos)
Do you want to pay $69.99/week or even $199.99/year for a horoscope app, palm reading app or even screen editor? Fleeceware is the term used to describe applications that exist both on Android and iOS, claim to be free, offer free trials for a small number of days and then over-charge, with charges ranging from $30 to $300 for simple applications like QR code readers, screen editors and video recorders.

We have been researching these apps since last year and have discovered hundreds of them, many with an install count as high as 50 million and some of them in the top grossing category in Android and iOS app stores.

Android and iOS app revenues, including all in-app purchases, amount to billions of dollars every year. Fleeceware app authors get a cut of 70%-85% of the total cost, so they could potentially make millions in revenue by using a subscription model. This model is very attractive for those with nefarious intentions to make easy money with a simple app.

Fleeceware apps are not just about offering a free trial and then charging users. The authors of these apps are using interesting techniques to promote and make their apps a success. Fleeceware apps use fake reviews and fake installs to increase the visibility of the app. They also invest in a variety of promotional activities to increase their returns such as running ads for the apps in social media platforms like YouTube and Instagram, app search ads, and by creating their own apps just to promote fleeceware.

To avoid scrutiny by security services, fleeceware apps delay the introduction of the subscription model when the app is first published; the fleeceware module only gets introduced at a later stage after the app has gained popularity and fake ratings. This helps the apps evade security checks and helps convince users of the legitimacy of the apps.

In this presentation, we will:

  • Discuss fleeceware apps, demonstrate fleeceware on Android/iOS, and then discuss how such apps evade app store security checks.

  • Delve into the shady world of pay-per-fake review and fake install factories and how anyone can turn their app into an overnight success.

  • Look into fleeceware promotional campaigns using in-app promotions and social media platforms such as Instagram and YouTube.

  • Discuss app subscription revenues, business models and how fleeceware has ended up in top grossing charts.

  • Investigate fleeceware developer profiles and who is creating these apps.

  • Present user stories from app stores on how vulnerable users are losing hundreds of dollars unknowingly.
Jagadeesh Chandraiah
Sophos Jagadeesh Chandraiah is a senior malware researcher at SophosLabs, specializing in mobile malware analysis. Jagadeesh has been working at SophosLabs for over 10 years. Jagadeesh started working on Windows malware analysis and is currently focusing on mobile malware analysis. Jagadeesh has a Master’s degree in computer systems security from the University of South Wales.

Jagadeesh likes to track malware, research and find novel ways to detect and remediate them. Jagadeesh is a frequent contributor to the SophosLabs Uncut blog and has written blog posts about several mobile malware topics. Jagadeesh also regularly presents his research at international security conferences and in the past has presented his research at DeepSec, AVAR, CARO, and Virus Bulletin.

Outside of work, Jagadeesh enjoys playing badminton.