SophosLabs has discovered 25 apps that activate high-cost paid subscriptions. Here's what they are and how to defend yourself
It's not a good start of the year for Android users: in the last days some reports have shown how fragile the Google Play Store is and how easy it is for hackers to publish applications containing malicious code, especially adware displaying advertisements. If all of the above wasn't enough, apps that "legally" steal money from users are back in fashion.
The alarm is raised by cybersecurity expert SophosLabs, who announced in a report published online that they have discovered 25 more apps that activate weekly, monthly or yearly subscriptions without asking the user for permission. We say 25 more apps, because last September the company had already uncovered twenty of them. Sophos Labs has dubbed these kinds of apps "fleeceware": in English, the verb "to fleece" means "to strip", "to shear" or even "to skin".
How "fleeceware"
The real issue is not so much the presence of these apps on the Google Play Store, but the fact that they are perfectly legal and comply with the terms and conditions of use of the online store. Fleeceware apps, in fact, do not install any viruses and do not cheat the user, but only exploit what the Google Play Store allows. How do fleeceware apps work?
They appear to be classic apps that you can install on your smartphone and try out for free for an agreed period. At the end of the trial period, a message or notification should appear asking the user if he/she wants to activate a subscription or buy it. In fleeceware apps this step does not exist: after the free trial the subscription is activated directly and the money is deducted from the card connected to the Google Play Store. During the installation phase, the app warns the user about the automatic activation of the subscription once the trial period is over, but unfortunately very few people read the Terms of Use. And so many have found themselves with a rather large amount charged to their bank account or from their credit card.
In September 2019, some users reported that QR Code apps had deducted an amount exceeding 75 euros from their account. A real scam for apps that are usually free.
How many users are affected
According to SophosLabs' report, there are more than 600 million users who have downloaded one of these 25 apps. A substantial number that, however, could be inflated by bogus downloads made by bots. Un modo per far crescere l’applicazione all’interno delle classifiche del Google Play Store e invogliare gli utenti a scaricarla. Ignari che nasconda l’attivazione di un abbonamento a pagamento.
Quali sono le app che rubano i soldi
Nella lista pubblicata da SophosLabs si trovano applicazioni per qualsiasi cosa. Si va da un tastiera che integra emoji simpatiche (oltre 100 milioni di download, costo abbonamento annuale di 60 dollari), si passa per una fotocamera che integra effetti particolari (100 milioni di download, 60 dollari per l’abbonamento mensile), fino ad arrivare a un’app per il videoediting con 5 milioni di download e costo dell’abbonamento annuale di poco inferiore ai 50 dollari.
Nell’immagine sottostante, la lista delle app scoperte da Sophos Labs con il rispettivo costo dell’abbonamento e il numero di download complessivi.
Fonte foto: Sophos
Come difendersi dalle app che rubano i soldi
Essendo applicazioni che non nascondono nessun tipo di malware, gli antivirus per Android non possono fare nulla. L’unico modo per riuscire a difendersi dalle app fleeceware è quello di leggere attentamente le condizioni di utilizzo quando si installa una qualsiasi applicazione dallo smartphone. Se leggete cose del tipo “prova gratuita e abbonamento mensile“, lasciate stare e cercate un’altra applicazione. Altra fattore da tenere in considerazione sono le recensioni degli utenti: se notate qualcosa di strano o qualche commento che parla di “truffa” o cose simili, si tratta di un’app fleeceware.