Apps learned to automatically install on devices through ads

There is a growing number of user complaints on the web about intrusive ads, with the help of which other applications have learned to automatically install on devices.

According to participants in the discussion on Reddit, a number of advertising banners install software on devices without the awareness of users and bypassing Google Play control. Banners allegedly advertise applications from the store, but when users try to close them, the process of downloading and installing software begins, which does not require any user participation.

Further research showed that such activity is provided by the products of the Texas company Digital Turbine – the DSP platform Appreciate and the DT Ignite system application, which bypasses interaction with the Play Store and the dialog for manual installation of the APK.

It would seem that this software should have exploited some kind of vulnerability, but this is not the case. As it turned out, on some devices, DT Ignite is a pre-installed application, either by the telecom operator or by the manufacturer itself. That is, it is, in fact, a backdoor.

DT Ignite has been in the public eye since at least 2014. Seven years ago, it was used by telecom operators and mobile device manufacturers to secretly install unnecessary applications on users’ phones. The app was preinstalled on devices that were sold by T-Mobile и Verizon, along with other unnecessary apps.

въпреки това, until today, DT Ignite has not been used for advertising, let alone directly installing other applications through it. The new service is being provided through the Appreciate DSP platform acquired by Digital Turbine this year. It also owns a patent specifically for this functionality, registered in 2019.

If earlier DT Ignite was used to automatically install applications on phones from telecom operators, which in itself is too much, now it is the same malware that spreads through mobile advertising, since it can be installed on the user’s device automatically. Among the services listed on the Digital Turbine website, there is even a “one-click installation of ad units” through the Appreciate DSP platform.

According to the company itself, ads should not install applications when the user tries to close it.

Let me remind you that we also talked about the fact that Dangerous FluBot malware offers users a security update to fight against itself.