In a bid to combat financial scams, Google has initiated a new program aimed at preventing users from sideloading certain apps in Singapore. The company’s efforts are focused on blocking sideloaded apps that misuse Android permissions to access one-time passwords received through SMS and notifications.
According to Google, there are four sets of permissions that malicious actors exploit to perpetrate financial fraud. These apps are typically sideloaded, meaning they are manually installed onto devices rather than downloaded from the Play Store.
“Fraudsters frequently abuse these permissions to intercept one-time passwords via SMS or notifications, as well as to spy on-screen content. Our analysis of major fraud malware families exploiting these sensitive runtime permissions revealed that over 95 percent of installations originated from Internet-sideloading sources,” stated Google in a blog post.
When a user in Singapore attempts to install such an app, Google will automatically block the attempt and display a message pop-up warning: “This app can request access to sensitive data. This can increase the risk of identity theft or financial fraud.” This initiative is part of Google’s Play Protect program and has been developed in collaboration with the Cyber Security Agency of Singapore (CSA).
Last October, Google introduced a real-time scanning protection feature, initially launched in India, to prevent users from sideloading malicious apps. In November, a test with over 30 different malicious apps, revealing that while Google’s protection feature blocked most of them, some predatory loan apps were successfully installed. Scott Westover, a Google spokesperson, explained, “With this recent enhancement, we’re adding real-time scanning at the code-level to Google Play Protect to combat novel malicious apps, regardless of whether the app was downloaded from Google Play or elsewhere.”
Since then, Google has expanded the real-time scanning feature to new regions, including Thailand, Singapore, and Brazil.
In its latest announcement, Google has cautioned developers that their apps must not violate Mobile Unwanted Software principles and should adhere to guidelines. The company expressed its willingness to extend the pilot program to other countries.
“We are continuously enhancing our protections to ensure the safety of Android users worldwide. Together with CSA, we will closely monitor the results of the pilot program to assess its impact and make adjustments as necessary. We are open to expanding the pilot to other countries in the future if we observe similar interest and user protection needs,” stated Eugene Liderman, Director of Android Security Strategy at Google.
Fraudulent loan apps have been a significant concern for Google in regions like India and Africa. In India, Google has faced scrutiny as predatory loan apps and their representatives have harassed individuals for repayment, leading to some tragic outcomes. Last year, Google introduced a new policy to prevent loan apps from accessing users’ photos and contact details.
(Source: The Hacker News | Times of India | TechCrunch)
