# How Did That Get In My Phone? Unwanted App Distribution on Android Devices

**Authors:** Platon Kotzias, Juan Caballero, Leyla Bilge  
**arXiv:** [2010.10088](https://arxiv.org/abs/2010.10088)  
**Date:** 2020-10-20  
**Summary page:** https://www.summarizepaper.com/en/paper/2010.10088v1/

## Key points

- The study explores the prevalence and distribution of unwanted apps on Android devices.
- Lesser-known distribution channels for unwanted apps include Web downloads, pay-per-install services, backup restoration, bloatware, and IM tools.
- Between 10% to 24% of user devices encounter at least one unwanted app.
- The Play market is the primary app distribution channel responsible for 87% of all installs and 67% of unwanted app installations.
- Bloatware accounts for 6% of total installs and is a significant vector for distributing unwanted apps.
- Backup restoration unintentionally allows unwanted apps to persist even after users replace their phones.
- PPI-driven unwanted app distribution on Android is lower compared to Windows platforms.
- Web downloads are infrequent but present a riskier proposition compared to alternative markets.

## Summary

, , , , 

The study "How Did That Get In My Phone? Unwanted App Distribution on Android Devices" by Platon Kotzias, Juan Caballero, and Leyla Bilge delves into the prevalence and distribution of unwanted apps on Android devices. With billions of active devices, Android's popularity and open nature make it a prime target for malware and potentially unwanted programs (PUP). The research uncovers lesser-known distribution channels such as Web downloads, pay-per-install (PPI) services, backup restoration, bloatware, and IM tools. Using reputation logs from a major security vendor encompassing 7.9 million apps across 12 million devices between June and September 2019, the study reveals that between 10% to 24% of user devices encounter at least one unwanted app. The analysis distinguishes between malware and PUP instances, shedding light on their prevalence within the Android ecosystem. The research highlights the Play market as the primary app distribution channel responsible for 87% of all installs and 67% of unwanted app installations. Despite its dominance, the Play market boasts robust defenses against unwanted apps. Conversely, alternative markets distribute a smaller share of all apps but account for over 10% of unwanted apps. Bloatware emerges as a significant vector for distributing unwanted apps with 6% of total installs falling into this category. Moreover, backup restoration is identified as an unintentional distribution channel allowing unwanted apps to persist even after users replace their phones. The study estimates that PPI-driven unwanted app distribution on Android is lower compared to Windows platforms. Additionally, while web downloads are infrequent, they present a riskier proposition compared to alternative markets. Overall,this comprehensive investigation provides valuable insights into the diverse vectors through which unwanted apps infiltrate Android devices. By quantifying and comparing distributions across various channels, the study contributes to enhancing understanding and fortifying defenses against malicious software on one of the world's most widely used operating systems.