Green Star Spam

[lexluthor]

For the last 3 days now I've been getting spammed in my notification bar on my Droid X.

It's showing up as a green star. The messages have been showing up between 5pm and 6pm. I just got 2 messages at 5:09. They are both clearly spam. The first says "someone Has a Crush on You". Second is "Are You a True JB Fan".

If it click, it first takes me to a leadbolt site, then forwards immediately to an addjump site. I have adaway running, so it's blocking me from getting to the final site with the ad, so I don't know what's there. I guess next time I could disable adaway before I click.

Obviously, it's from an app I updated recently, but I have a ton of apps. I had super stickman golf that updated the other day and there are a few market comments saying they added airpush, but I've since uninstalled it, so I guess either that wasn't it, or it left something behind.

I also already ran the airpush detector and did the permanent airpush optout on the web, then to be sure, I ran the app and the app said I was already opted out. Still getting the spam after that.

How do I find out the culprit and get this nasty thing off my phone?

All help is appreciated.

 

[AngryHatter]

Won't something like My Data Manager track that for you?
And why not block the source of the messages?

 

[lexluthor]

Won't something like My Data Manager track that for you?
And why not block the source of the messages?

What do you mean? I have no idea what the source of the messages is!

As far as My Data Manager, what does that do? Whatever app is doing these ads is probably using very little data to go out and grab the ads it needs.

 

[Go Blue]

It is probably an AirPush advertisement -- shows up as a green star in the status bar, and as a text message that disappears after you open it.

AirPush rides in on numerous free apps -- the developer doesn't tell you about it because that's how they get paid.

Download the app "AirPush Detector" -- it will find and identify any/all apps that include AirPush. You delete those apps, the green star goes away for good.

AirPush = VERY annoying.

 

[RandomEngy]

He said in the original post that he already ran airpush detector and opted out of airpush messages. It must be something new that's bypassing the detection.

I've been getting some messages with a star with a red dot in the middle, saying that I have new messages, or that someone has a crush on me, all that same garbage. Airpush detector turned up nothing. I just did the airpush opt out today so we'll see if that works, but I'd really like a way to track what app generated the notification.

 

[lexluthor]

RandomEngy, thanks for clarifying my original post. I thought I had made that clear.

I guess you are in the same boat as I am.

As I mentioned, airpush opt out didn't work for me. Please come back and let us know if it works for you.

Anyone have any ideas?

 

[Petrah]

I'm just curious... doesn't this AirPush Opt Out feature work the same as any other unsolicited spam opt out? Meaning, as soon as you opt out, they now know you are a real person and they have your email, cell number, or whatever. I mean, they have to know who is opting out and from what phone because you are giving them your personal information that they did not have before.

I've always told my web hosting clients to never ever opt out of anything they get in emails that they didn't ask for... wouldn't you not show the same type of caution for this type of opt-out spam?

 

[lexluthor]

I'm just curious... doesn't this AirPush Opt Out feature work the same as any other unsolicited spam opt out? Meaning, as soon as you opt out, they now know you are a real person and they have your email, cell number, or whatever. I mean, they have to know who is opting out and from what phone because you are giving them your personal information that they did not have before.

I've always told my web hosting clients to never ever opt out of anything they get in emails that they didn't ask for... wouldn't you not show the same type of caution for this type of opt-out spam?

Tough one. At least Airpush is a semi-legitimate business that's out in the open. In this case, Airpush would be getting your IMEI. It's either don't use apps that have Airpush in, deal with the ads or opt out. Probably with the first option is I'm not sure how easy it is to know which app is delivering Airpush ads.

Unfortunately, in my case, I might have something other than Airpush that got in or Airpush detector isn't detecting the app and the optout isn't working for some reason.

I know I'm going to be annoyed again today at 5pm or so when I get the notification spam again.

Any other ideas here?

 

[wayrad]

Any other ideas here?

See post #8, http://androidforums.com/android-ap...iller-malware-my-thunderbolt.html#post3370749

 

[RandomEngy]

I was hoping someone had a tip about digging in some log files somewhere to find the culprit app.

It seems like if the android app store can't block these awful apps they should at least build in functionality to let the user tell what app is the source of the notification messages. If you agree, please vote up this issue I just opened:

Issue 21303 - android - Ability to identify which app created a notification message - Android - An Open Handset Alliance Project - Google Project Hosting

 

[Petrah]

Tough one. At least Airpush is a semi-legitimate business that's out in the open. In this case, Airpush would be getting your IMEI. It's either don't use apps that have Airpush in, deal with the ads or opt out. Probably with the first option is I'm not sure how easy it is to know which app is delivering Airpush ads.

Unfortunately, in my case, I might have something other than Airpush that got in or Airpush detector isn't detecting the app and the optout isn't working for some reason.

I know I'm going to be annoyed again today at 5pm or so when I get the notification spam again.

Any other ideas here?

Maybe find alternative apps to the ones that are ad supported. Or, you could go all out and root your phone. Then you could install AdFree Android, which blocks ads based on a custom host file. This is what I do so not only do I have a custom host file on my pc's to block unwanted ads, I also have one on my cell that's based off the same host file I've been using on my pc for the last several years.

You simply cannot beat a custom host file for blocking ads. But you have to be rooted first.

It seems like if the android app store can't block these awful apps they should at least build in functionality to let the user tell what app is the source of the notification messages. If you agree, please vote up this issue I just opened:

That's not going to work. Installing free apps on your phone that are supported by ads is a conscious decision that you yourself make. As far as they're concerned, you are also free to install another free non ad supported app that does the same thing, or pay for the ad free version. There's also the option of rooting your phone and installing AdFree Android to block the ads. You have freedom of choice here.

 

[mills2533]

It a way of distributing ads through an app. Check out the video here:

LeadBolt Apps - Push Notifications

 

[lexluthor]

It a way of distributing ads through an app. Check out the video here:

LeadBolt Apps - Push Notifications

Ok. Maybe some progress here. I guess LeadBolt is something different than airpush?

So I searched the market for "leadbolt" and found this app.
https://market.android.com/details?id=com.denper.addonsdetector

It's really bad as it takes forever for me to scroll through the list.

But, I did see one app listed that had Leadbolt. That app is Traffic Jam Free (by JiuzhangTech Ltd), which was last updated on 10/24, right about the time I started seeing this spam.

This is could very well be the culprit!

I didn't get any notification ad spams today though, but I'm deleting this app for sure.

Anyone else have this app?

EDIT:

BINGO!!! We have a winner!

Many market comments about this.
https://market.android.com/details?id=com.jiuzhangtech.rushhour

I guess now someone needs to write a leadbot detector!

 

[Stuntman]

I'm uninstalling it now. I'll keep the old version on my tablet as I haven't updated it yet.

 

[Ricochet]

Yup, I had Traffic Jam Free, too. 1-Star'd & reported the app, before uninstalling it.

And the Airpush Detector didn't.

 

[Ricochet]

What is this green star spam... I have never heard of it...

Search the forums for "Airpush" there are a number of threads detailing this heinous practice.

 

[lexluthor]

Search the forums for "Airpush" there are a number of threads detailing this heinous practice.

Yes, but in this case, it doesn't appear to be airpush. It looks like it's a company called Leadbolt.

I guess this is going to start being more common.

 

[wayrad]

I guess this is going to start being more common.

At least, unless developers find out that using it will result in a flood of one-star ratings...

 

[RandomEngy]

That's not going to work. Installing free apps on your phone that are supported by ads is a conscious decision that you yourself make. As far as they're concerned, you are also free to install another free non ad supported app that does the same thing, or pay for the ad free version. There's also the option of rooting your phone and installing AdFree Android to block the ads. You have freedom of choice here.

I didn't ask them to block every app with annoying ads. I asked them to make it possible for users to identify what app was the source of notification messages. Users can't make good decisions about what apps to install without the ability to find out which ones are bombarding them with crap. The "Detector" apps are great but they can be worked around with new frameworks, be changed to avoid detection or simply baked into the app. Linking notification message -> app would be pretty much bulletproof.

Anyway Addons Detector also identified Traffic Jam as running Leadbolt. Off it goes with a 1 star review. Thanks for the detective work, lexluthor. You're not as bad as Superman would have me believe.

 

[AngryHatter]

Fake-Call Me Text SMS CallLog
OW DEV TEAM

Another Leadbolt app & group.

 

[Umito]

As one of the devs of Addons Detector: we are releasing a new update to our app so that you can easily filter only for push notification addons. This will help finding the offending app faster. If our app doesn't catch your spam app, let us know if you found the culprit. We can then update our app to detect these too!

 

[lexluthor]

As one of the devs of Addons Detector: we are releasing a new update to our app so that you can easily filter only for push notification addons. This will help finding the offending app faster. If our app doesn't catch your spam app, let us know if you found the culprit. We can then update our app to detect these too!

Wonderful!

 

[Citizen Coyote]

I started getting this green star spam myself, and used Addons Detector to find the culprit. Turns out an app called Starlight Live Wallpaper Free was recently updated with increased functionality, but added LeadBolt to its ad services. Goodbye app. Notification spam is the worst.

 

[lexluthor]

I started getting this green star spam myself, and used Addons Detector to find the culprit. Turns out an app called Starlight Live Wallpaper Free was recently updated with increased functionality, but added LeadBolt to its ad services. Goodbye app. Notification spam is the worst.

Please make sure you leave negative feedback in the market. At the least, it might help others figure out that this is the offending app.

 

[Mr. Lucky]

Maybe find alternative apps to the ones that are ad supported. Or, you could go all out and root your phone. Then you could install AdFree Android, which blocks ads based on a custom host file. This is what I do so not only do I have a custom host file on my pc's to block unwanted ads, I also have one on my cell that's based off the same host file I've been using on my pc for the last several years.

You simply cannot beat a custom host file for blocking ads. But you have to be rooted first.

I agree about the rooting part, and AdFree is a very fine app. However, hosts blocking works by intercepting outgoing requests and rerouting them to the internal loopback address. "Push" notifications are, by definition, not outgoing requests... no hosts blocking will have no effect.

I guess now someone needs to write a leadbot detector!

The newest version of AirPush Detector finds Leadbolt apps. From the developer's changelog:

Currently detected frameworks include:
- Airpush
- LeadBolt
- Appenda
- IAC
​