Google introduced its Verify Apps cloud-based service in 2012 that will check every application before installation on an Android device for added security against malware and other nasties. It has been regularly updated with new features. Now Verify Apps can remove an application without confirmation from the user if the service finds that it's purely harmful.
Android applications that could potentially harm the user or device are classified as Potentially Harmful Applications (PHAs) by Google. They could contain the following:
- Backdoors: Apps that let hackers control your device, giving them unauthorized access to your data.
- Billing fraud: Apps that charge you in an intentionally misleading way, like premium SMS scams or call scams.
- Spyware: Apps that collect personal information from your device without consent
- Hostile Downloads: Apps that download harmful programs, often through bundling with another program
- Trojan Apps: Apps that appear benign (e.g., a game that claims only to be a game) but actually perform undesirable actions.
Verify Apps proactively checks every app prior to installation on an Android device to find out whether they're a PHA. It will regularly recheck a device to ensure the apps on it are safe and will prompt users to remove suspected PHAs.
The service has gone through many iterations and it can now automatically remove apps without notifying users. According to a blog post by Google:
Sometimes, Verify Apps will remove an application without requiring you to confirm the removal. This is an action we’ll take very rarely, but if a PHA is purely harmful, has no possible benefit to users, or is impossible for you to remove on your own, we’ll zap it automatically. Ongoing protection from Verify Apps has ensured that in 2015, over 99 percent of all Android devices were free of known PHAs.
Verify Apps is just one of the automated systems Google uses to fight against PHAs. It checks more than 6 billion installed applications and scans around 400 million devices per day.