What billions of device ids reveal about Android app abuse
summary
Analysis of 2.2 billion identification events shows concrete abuse signals: 0.37% emulators, 0.12% rooted devices, 0.16% on-device app cloning, near-zero location spoofing in 2025, and 0.05% man-in-the-middle detections. Detection methods and mitigations include sensor checks (gyroscope/accelerometer), Play Integrity API and file‑path checks for clones, scanning for Frida/SU artifacts on rooted phones, and certificate pinning to spot or block MitM and replayed identification requests.
AI-written summary · about
chapters (9)
- 0:00Android abuse signals
- 1:03Device integrity signals
- 3:09Emulator misuse patterns
- 5:59Rooted device risks
- 8:50App cloning for fraud
- 10:58Location spoofing
- 13:49MITM attack detection
- 17:39Signals for app security
- 19:23Q&A
related talks
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
33mWhen Attackers Go Mobile-First with AI
40mSecurity: The Hidden Cost of Android Stalkerware
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
38mAdvanced Techniques for Protecting Android Apps
20mDemystifying the Android Telehealth Ecosystem
32mDebunking Android Security Myths with Data