Mobile app inhaling fees: "Three crimes" constitutes a chain of profits

Intercepting SP billing information, stealing user privacy, and packaging the party is a mobile game application smoking chaos "three sins" to build profits chain Android (Android) system and its application market is open source and open, some mobile game operations Merchants "paralyzed" users through technological means and repeatedly inhaled fees to obtain bad income.

According to the “2012 China Game Industry Survey Report”, last year China's mobile game users reached 89 million, a year-on-year increase of 73.7%; mobile game market sales revenue reached 3.24 billion yuan, a year-on-year increase of 90.6%.

According to another data, as of the end of 2012, there were 180 million domestic Android mobile phones. According to the 91 wireless data report, from the fourth quarter of 2011 to the first quarter of 2012, mobile game application downloads accounted for 30% of the total downloads.

With the dramatic increase in the number of applications, the mobile game application has a lot of chaos. A survey of the reporters of the "First Financial Daily" found that some game operators on the Android platform constructed bad profiteering chains by intercepting chargeback information, stealing user privacy, and implanting malicious advertisements. Many mobile game users are frequently fooled.

Intercept fee information

According to a survey conducted by some reporters on mobile phone games, the user often mistakenly believes that there is no payment success because he does not receive the chargeback message from the operator after paying in the game application. Some game operators, it is precisely the use of the user's psychology, blocking the operator's deductions SMS, allegedly infringes the user's right to know, causing users to pay multiple times.

According to a survey conducted by the reporter, the domestic mobile game platform Xiaoao Games, produced the "ultimate mania 3D drift", "3D Ultimate Mania 2 (HD version)", "Farm Warfare 2 (New Year version)" are all suspected of intercepting carrier deductions SMS code behavior.

After the reporter downloaded and installed the above mentioned Android games to the Android mobile phone on the official website of Xiao-Ao Games, when receiving a keyword containing “China Mobile” in the text of the message, the message would be “discarded” and could not be charged. In addition, in the aforementioned game, Xiao Ao was also suspected of intercepting keywords with "game points."

Under normal circumstances, after purchasing game props in the above game, the user will receive the following message contents: "[×: × (eg: 10:30)] China Mobile has reminded you that you have successfully purchased the game: × × × (game name) , Item name: ××× (such as: 20 gold coins), consumption of game points × × points. Game points recharge situation, please pay attention to 10086 reminder SMS, more exciting games in g.10086.cn China mobile phone games.”

In other words, "China Mobile" and "Gaming Points" are the key words intercepted by the above-mentioned message content. An industry insider who declined to be named told reporters that the above-mentioned practices of Xiao-Ao's games will also lead to the user's deduction of deductions for other SP services (telecom mobile value-added services) on Android phones with Xiao-Ao games. .

The reporter has repeatedly learned about the motives and facts of the above events from the Olympic Games. As of this writing, no response has been received.

According to industry insiders, because the current mobile payment industry environment is not perfect, some Android in-app payment game operators use SP to withdraw fees is understandable, but with the help of the openness of the Android system, change the underlying data to intercept deductions SMS Deprivation of users’ right to know has a greater impact on the industrial environment.

Stealing user privacy

Under the premise of not giving notice to users, the behavior of controlling the privacy of mobile phone users through cloud technology is also frequently occurring in the Android game application market.

According to a survey conducted by the reporter, various international mobile game titles such as “Angry Birds” and “Fruit Ninja” were played in China’s only authorized gaming company, and its official website featured 59 Android games. In addition to the "Gallboy" can not be downloaded, there are 44 models of the remaining 58 games to steal user privacy behavior, including the more well-known "fruit Ninja", "Bird Blast", "chicken forward."

The reporter conducted a real investigation into the two games of “Red Police: World Alliance” and “Red Police (Official Chinese Finished Edition)” run by the music game agency. In the above game without notification to the user, the part of collecting user privacy includes: uploading a local mobile phone number, uploading a Google gmail account, uploading a machine ID, a screen resolution, a local installed application list, all machine contact names and telephones And e-mail address, receive cloud instructions to download other applications, upload music game center login name, upload current location information, etc.

Among them, uploading all contact names, telephone and email addresses of the machine, and receiving cloud instructions for downloading other applications are more severe. The reporter has saved relevant evidence.

The reporter learned from a number of people in the industry that it is not uncommon for users to obtain private information without the user’s agreement. The main purpose is to obtain basic information to meet application needs in order to start services, but generally not all contacts. Lists and e-mail addresses are used for retrieval. They will not accept cloud instructions to download other applications. The latter approach may be to facilitate user data mining in order to carry out accurate marketing, and secretly inject other applications to the user's mobile phone to jointly promote, and it may be even worse to sell user privacy data for other purposes.

According to informed sources, the average monthly income of Le Dao Games in 2012 is about 10 million yuan, which is in a weak profitable state. The main revenue comes from advertising.

For the above situation, Musician declined to respond to the newspaper's interview request.

"Pack the party" rampage

In the current Android app store, the phenomenon of "packaging the party" is also more common.

"Packaging Party" refers to the popularization of malicious advertisements and Trojan horses in popular software. It also uses the psychology of consumers to pursue popular applications. It also adds to the inability of ordinary people to distinguish between genuine pirates and the inadequacies of the application of market security supervision capabilities. This leads to malicious advertisements and virus Trojans. Successfully entered the user's mobile phone.

In the application of investment in innovative workshops, the reporter searched for the current well-known mobile game “The Temple Run”. There are three official versions, namely “The Temple Run 1”, “The Temple Run 2” and “The Temple”. Escape: Courage." However, the results of the search appeared "The Temple Run 3" and the number of downloads was nearly 1,000. Insiders told reporters that such pirated applications are likely to carry malicious advertisements.

In January of this year, the “MDK Botnet” incident was reported by the media. A mobile phone security source told reporters that through the MDK backdoor program, botnet controllers can steal and upload user SMS content, private photos, and contacts at any time. In addition, downloading large amounts of software in the background will consume a lot of mobile traffic.

A person working in the security business told this reporter that more and more PC Trojan hacker began to break into the security of mobile phones, more accurate than PC, mobile phone privacy and positioning of the user's behavior, and therefore more Business benefits.

In June 2012, the Ministry of Industry and Information Technology had issued the “Notice on Strengthening the Management of Mobile Intelligent Terminals into the Network” (Draft for Soliciting Opinions), requiring mobile terminal manufacturers to explain pre-installed application software and providers when applying for network access licenses. Enterprises must not pre-configure software that contains malicious code and collects and modifies user's personal information without user's consent in the mobile terminal, nor can it presume to mobilize the terminal's communication function without user's consent, causing traffic consumption, cost loss and information leakage. software. However, the consultation draft was not formally implemented.

According to industry insiders, there are currently no good user protection measures. Users should strengthen their prevention and mobile phone application store operators should also strengthen their own security standards. Application stores and security companies can cooperate with each other to form a certification form. This kind of tentative mode.