Can Unity Ads install apps without user permission? (seems unlikely but....)

Unity Services
1

Hi All,

I know this is impossible but I am bound to ask since I got a very valid user feedback. I take user reviews very seriously.

Here is the exact comment I got along with a 1- star rating :frowning: :

“I have 5 useless apps installed that I did not know were installed because of the ads in this app. I would definitely have considered going premium because the app itself is smooth and effective, but installing without my permission is a step way past the commonplace nuisance of simple ads.”

Upon further enquiry, the apps in question are:

Empire: Four Kingdoms, Magic Rush, Game of War and eBay

I certainly know these apps do have Unity Ads.

More information from the customer:

“The apps that were installed coincided with the ads that were on your app and their installation coincided with my use of your app so your app was the apparent suspect.”

This is the web version of my app from where mobile versions can be downloaded:

http://rubikcubebyjayanth.github.io/RubikCube/

2

No, we’re not evil :wink:

Some possible explanations in this case:

  • Someone else using his phone has installed those apps
  • Could be infected with malware? (however in that case, it doesn’t make much sense if that malware would redirect revenue elsewhere…)

If the user is interested, we could check our side to see if the apps in question originates from Unity Ads, but that requires we get some information from the user.

/Rasmus

3

haha… I know… I have utmost respect for everything what Unity does but didn’t want to leave even a sliver of doubt.

The user in question has agreed to try out my app after a few days and check if it repeats. I will give an update then.

However, it would be great if we could check, may I know what information is required? I am guessing Ad ID ?

4

There WAS a Chrome bug in 2014 which allowed apps to be installed without user knowledge. Other such bugs could exist, but if there are current systems with such an active exploit around we’d read about it pretty quickly. He’s either running an outdated system, or using custom firmware with all sorts of safeguards disabled.

Play apps should not normally be possible to install without user interaction either, so I’d try to find out a way to tell where these suddenly installed apps came from. There’s most likely some sort of logging from Play when installing, so even the absence of such logs would indicate this isn’t from a safe source.

5

Thanks for the information, indeed thought provoking.

But the question is, even if it is custom firmware and all sorts of safeguards are disabled, I don’t think Unity Ads would install apps without permission.

The only plausible theory yet is someone else installed the apps and since Unity Ads do repeat, it is possible to have mistaken. I will update the thread when I receive new information.

Thanks!