# Are cracked applications really free? An empirical analysis on Android devices

## TL;DR

This study empirically analyzes cracked Android applications, revealing they generally use more resources and request more dangerous permissions than official apps, raising security concerns.

## Contribution

It provides a comparative behavioral analysis of cracked versus official Android apps using real device data and introduces an application intention score for classification.

## Key findings

- Cracked apps request more dangerous permissions.
- Cracked apps consume more system resources.
- Cracked apps are more likely to be malicious.

## Abstract

Android is among the popular platforms running on millions of smart devices, like smartphones and tablets, whose widespread adoption is seen as an opportunity for spreading malware. Adding malicious payloads to cracked applications, often popular ones, downloaded from untrusted third markets is a prevalent way for achieving the aforementioned goal. In this paper, we compare 25 applications from the official and third-party application stores delivering cracked applications. The behavioral analysis of applications is carried out on three real devices equipped with different Android versions by using five indicators: requested permissions, CPU usage, RAM usage and the number of opened ports for TCP and HTTP. Based on these indicators, we compute an application intention score and classify cracked applications as malicious or benign. The experimental results show that cracked applications utilize on average more resources and request access to more (dangerous) permissions than their official counterparts.