Misbehavior in Mobile Application Markets

TL;DR

This paper investigates various types of misbehavior in mobile application markets, including attacks by developers, users, and network operators, and proposes potential future threats and solutions to maintain market integrity.

Contribution

It introduces novel attack methods targeting mobile markets and discusses strategies to counteract spyware and cheating behaviors.

Findings

Identified new attack vectors for revenue theft and ranking manipulation.

Demonstrated feasibility of getting revenue for others' applications.

Proposed countermeasures against malicious applications and cheating.

Abstract

Mobile application markets facilitate the distribution of applications and thus help developers advertise their work and customers find useful applications. In addition, the operators of mobile application markets can control the quality and the content of the applications. These markets are growing rapidly with more than 300'000 application in the App Store of Apple and more than 100'000 in the Android Market of Google. This is not only a great opportunity for phone manufacturers to earn money but also for indie developers (single or small teams of developers with small financial support) who can thus have a great distribution channel. Steve Demeter, the Trim game developer for iPhone, became millionaire with a single puzzle game . Obviously, as new markets generate a lot of money, the temptation of misbehavior to steal part of the benefits is big. The first famous case was the one of Molinker who self-rated his applications with 5 stars to pump up his ranking in order to increase its revenue stream. In this report, we will consider the problem of misbehavior in mobile application markets. We will investigate multiple attacks by misbehaving developers, users or network operators that aim at breaking rules for their own benefit, managing to outwit the operators' control on which applications can be installed. We notably suggest novel attacks that may affect mobile markets in the future: in particular, we show that it is possible to get revenue for applications created by someone else, trick a user to download and buy an application and new ways to pump up an application's ranking. We will also discuss possible solutions against spyware applications and cheating developer