MUwS, PHA, vulnerabilities: A walk through on what not to do
summary
Google Play Protect processes ~1.2M APKs with over 1 billion device scans per day using ~30,000 CPUs, extracting static (manifests, strings, images) and dynamic signals (network calls, file access, permission use, native SO loading) to score apps. Common automatic flags come from 80% third‑party SDK code in APKs, vague or post‑fact billing/disclosure (silent premium SMS charges), crypto‑mining or proxy monetization, and even dead code that contains rooting or SELinux‑disabling routines — presence, not just execution, triggers warnings or blocks.
AI-written summary · about
chapters (7)
- 0:00Introduction to talk
- 1:38Google Play Protect pipeline
- 13:07PHA and MOS categories
- 27:22Common pitfalls for developers
- 35:18Monetization risks
- 38:29Dead code and vulnerabilities
- 39:31Concluding remarks
related talks
26mWhy does Google think my app is harmful?
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
30mA day in the life of a mobile reverse engineer
32mDebunking Android Security Myths with Data
39mAndroid App Security Fundamentals
30mDoes your Android app expose you to excess risk?
21mUnlocking Mobile App Security- Key Insights for Navigating a Rapidly Evolving Threat Landscape
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security