https://www.reddit.com/r/androiddev/comments/q4nltn/ads_are_now_able_to_bypass_google_play_to_install/ Press J to jump to the feed. Press question mark to learn the rest of the keyboard shortcuts Search within r/androiddev Subreddit Iconr/androiddev [ ] Log InSign Up User account menu [zOx8fQ]Found the internet! 148 Ads are now able to bypass Google Play to install apps WITHOUT user consent. Digital Turbine DSP seems to be the one enabling it. [renderTimi] Close 148 Posted by8 hours ago Ads are now able to bypass Google Play to install apps WITHOUT user consent. Digital Turbine DSP seems to be the one enabling it. [renderTimi] We recently received a couple of upvoted reviews from upset users reporting an app had been installed on their device without their consent after watching an ad and tried to close it: r/androiddev - Ads are now able to bypass Google Play to install apps WITHOUT user consent. Digital Turbine DSP seems to be the one enabling it. We managed to get in contact with one of the affected users who kindly sent us some screenshots of the ad in question: r/androiddev - Ads are now able to bypass Google Play to install apps WITHOUT user consent. Digital Turbine DSP seems to be the one enabling it. r/androiddev - Ads are now able to bypass Google Play to install apps WITHOUT user consent. Digital Turbine DSP seems to be the one enabling it. A quick check of that app's Google Play reviews (https:// play.google.com/store/apps/details?id=com.home.weather.radar&gl=ES& showAllReviews=true) shows lots of users complaining, amongst other ugly stuff, about the app being installed without their consent confirming the reports from our users were genuine. r/androiddev - Ads are now able to bypass Google Play to install apps WITHOUT user consent. Digital Turbine DSP seems to be the one enabling it. After talking to a couple of our ad provider Account Managers, we were told this is a technology from DSP Digital Turbine (who recently acquired Fyber) who has managed a way to avoid Google Play interaction to install an app. This may be the patent related to it: https://www.freepatentsonline.com/y2019/0265958.html. This seems like a serious security vulnerability and the perfect mechanism for unscrupulous advertisers to install malware. 25 comments share save hide report 100% Upvoted Log in or sign up to leave a comment Log InSign Up Sort by: best View discussions in 1 other community [renderTimi] level 1 * 5h * edited 5h So, to clarify things a little, this is the same system that installs preloaded applications on phones. The DT software is added directly in to the phone firmware. Some manufacturers do this to share ad revenue, others do it because they are requested to by, say, a carrier who requires it on all of their phones. (Boot the Verizon version of a phone, and you'll see extra apps installed versus the "same" phone on T-Mobile) System level apps can access the package manager to install apps without asking the user for permission. Mostly, that's only used for the Play Store and OEM software management. Google Play, for example, will silently update itself, even if you aren't logged in. Similarly, those extra apps you never asked for are silently downloaded and installed while you're going through device setup. This feature detects when the DT system is present, and uses it to circumvent the Play Store. However, for it to work, the software package must be specifically uploaded to DT's system. To my knowledge, it can't just install any old package. Of course, we're trusting an advertisment company to not have vulnerabilities in their software, so that isn't really all that reassuring. Digital Turbine just makes the software and services and sells it. It works because some carrier or OEM is willing to add it at the firmware level of the device in exchange for profit. 21 Reply Share ReportSave level 2 * 3h Jesus, another reason to never buy a branded phone. This is some next level shit 9 Reply Share ReportSave Continue this thread level 2 * 4h This is informative thanks for this 3 Reply Share ReportSave level 2 * 3h How can you find out if your device has this software on it? 1 Reply Share ReportSave Continue this thread level 2 * 2h Do non-branded phones (like my Pixel) have this DT software? 1 Reply Share ReportSave Continue this thread level 2 Op * 2h So, summarizing, Digital Turbine is earning revenue from advertisers such as this weather app (which some would consider malware) through their DSP or Fyber ad netwrok directly and sharing a percentage of it with some carriers or OEMs that put DT software in their phone's firmwares. Carriers and OEMs will argue they don't have control over which apps are installed through DT system and DT will argue this is a service the OEMs have agreed to. All this with 0 user knowledge or control. Nice. 1 Reply Share ReportSave Continue this thread level 1 * 7h Wow, seems like a clear violation of policy, I'd remove that SDK asap. 27 Reply Share ReportSave level 2 Op * 7h * edited 6h It's a DSP, not an ad network with an SDK you integrate in your app (like Google AdMob or Facebook Audience Network), they may advertise through many ad networks (not just Fyber). You would need to remove all ad networks SDKs or make sure they don't work with them. 7 Reply Share ReportSave Continue this thread level 1 * 4h this appears to be the software in question: https:// www.digitalturbine.com/operators/#tns1-mw i thankfully don't have a phone that uses this stuff, but that also means i can't really analyze it to see if there's anything you can do to protect your app from being used for this. 8 Reply Share ReportSave level 2 * 20m I guess there's something you can do, since ads are webviews and it's possible with some Java reflection to intervene and act between the user click and the action triggered by that click. 1 Reply Share ReportSave level 1 * 7h Quick aside, Digital Turbine is publicly traded and recently acquired Fyber, not the other way around. 6 Reply Share ReportSave level 2 Op * 7h You're right, thanks, corrected 5 Reply Share ReportSave level 1 * 6h We recently noticed this happening in the app I work on, but when we went to investigate we couldn't get an impression to replicate. We use Fyber, mediated through Mopub. Will definitely be reaching out to them. Thanks op. 7 Reply Share ReportSave level 1 * 1h Wait, they've patented abusing a loophole?! 1 Reply Share ReportSave More posts from the androiddev community Continue browsing in r/androiddev Subreddit Icon r/androiddev News for Android developers with the who, what, where, when and how of the Android community. News / Articles / Talks / Tools / Open source! 185k Members 366 Online --------------------------------------------------------------------- Created Jul 12, 2009 Join Powerups [powerup] Powerup to unlock perks for r/androiddev Become a Hero Community Heroes Powerups0/25 Become the first hero! helpReddit coinsReddit premiumReddit gifts aboutcareerspressadvertiseblogTermsContent policyPrivacy policyMod policy Reddit Inc (c) 2021 . All rights reserved Back to Top