Developer blames advertising SDKs for ad click injection

Nov 27, 2018 21:12 GMT  ·  By

Kochava's security research team exposed the fact that eight apps available in the Google Play store known to have roughly 2 billion installs and around 700 million monthly active users have supposedly engaged in large-scale ad fraud according to BuzzFeed News.

Chinese companies Cheetah Mobile and Kika Tech develop the apps found to display ad fraud behavior, the first being behind Clean Master, CM File Manager, CM Launcher 3D, Security Master, Battery Doctor, CM Locker, and Cheetah Keyboard, while the former owns the Kika Keyboard app.

As found out by Kochava, Cheetah Mobile' and Kika Tech's apps are exploiting the app install attribution ad system using a click injection method which makes sure that the ad networks always see their apps as being the ones behind the last ad click and collecting the ad revenue.

Also, Cheetah Mobile's apps will go the extra mile by launching the apps they want to get attribution for in the background, in an effort to increase the chances of receiving recognition for the app install.

To add insult to injury, Kochava's researchers also discovered that "This is true even in cases when no ad was served and they played no role in the installation."

Developers blame the advertising SDKs for the click injection behavior

"We work with many mainstream ad platforms via SDK integration. We request ads via SDK from these ad platforms and display their ads. We have no control over the behavior of these SDKs," Cheetah Mobile told BuzzFeed News in an email statement.

Kika Tech's CEO Bill Hu told BuzzFeed News that, "At this time, Kika is extensively researching the critical issues you raised internally. If in fact, code has been placed inside our product we will do everything to quickly and fully rectify the situation and take action against those involved. For now, we do not have further comments as we begin our internal research."

Even though CM Locker and Battery Doctor have already been removed from the Google Play store, Google left all the other apps involved in the scandal untouched and is conducting an ongoing investigation to verify Kochava's claims.

Despite that, given the number of installs and active users the Cheetah Mobile and Kika Tech apps bring to the Android platforms, most experts think Google will give them a free pass taking for granted their excuse of blaming the advertising SDKs used to build the apps for their adware fraud behavior.

Photo Gallery (3 Images)

Android ad fraud
Cheetah and Kika apps' total download numbersThe ad fraud process
Open gallery