Apps App Reverse Engineered and relisted, what can I do??

[Stephen O Neill]

I am a relatively new android developer (6 months with 5 very basic android apps released to date)
Before this I had no experience whatsoever and have thought myself everything I have needed to know as I went along.
I was aware that android apps can be fairly straight forward to reverse engineer so I made sure to use proguard to atleast offer some level of defence.

One of my applications was originally listed on the 11th of september and after the first month the downloads started to decline as it would no longer have been receiving any prominence in Google play. However afew days later I started to see a spike in my google analytics suddenly the app was getting an extra couple hundred downloads a day, but with no increased income, I looked through my stats and could see most of the downloads were for a version code which I had never released and although most of my downloads were showing as originating from certain countries I had practically no impressions showing for these countries in my admob, etc...

At this stage the downloads were still increasing, I was convinced that someone must have cloned my app and relisted it without removing the reference to my google analytics so I began looking through the app store for similar apps which were initially released when the increase in downloads began. It took less than 5 minutes to find it, and after a quick download and test I knew without doubt this was my application!!

The person had copied my icon but changed some colors(truth be told theirs looks better)
Changed the splash page ( once again an improvement on my own)
And any screenshots which showcased my app were removed with generic ones which mislead people as to the apps actual use, and probably in case an inquisitive developer might scan through the play store to check out there competitors, and inadvertently identify their own work!
The listing itself is also littered with key words unrelated to this actual app I presume to help with play store optimization.
The ads ids were changed but were still with admob like my own, but everything and I do mean everything else was left exactly the same.


This is what astounds me, this person did not make any attempt beyond what I have mentioned above to hide that this was simple theft.
My about us page which gives credit to myself as the developer and my company name is still in this persons app.
And also after 3 days of use I have an app rater pop up which kicks in and this is still referencing my app with its original name and the link still brings the user to my google play account, and even the google analytics reference comes back to my account so I can see each download under this persons version.

I have sent a request to googles removals team, the same day I noticed (about 5 or 6 days ago), a day later I got a reply asking for exact details about how this app is stolen and whatever else, and thats it!! Thats the last ive heard of it. The app is still active and increasing in downloads daily over 2300 yesterday while mine plods along at 130-150

After the initial anger wore off I was kind of flattered that firstly my app was doing so well when listed by someone with obvious experience and that this person chose my app from countless others, although it may have just been left with weaknesses that made it easier to reverse engineer. I am trying to look at the positives and I will be amending my app with better screenshots, app icon etc now that I know my app has more potential than I originally thought but I dont know if I should do this until the other developers app has been removed.

I have not been able to stop thinking about it since, each day this persons downloads grow and undoubtedly his revenue also while my legitimate app earns me a euro or two a day if I'm lucky. This has led me to afew questions which after googling I dont seem to be able to find many answers to.

1. In addition to proguard is there anything else I should be implementing in my apps to protect my code?
2. Are there certain app stores I should avoid listing on, where people are more likely to poach apks in this way?

3. But most importantly of all, what recourse do I have? I see it as a pretty cut and dry case it clearly lists on this app that I am the original author so their should be no dispute there, will this persons developer account be shut down? Is there anything I can do from the admob side to try and claim the money which he has earned with my work or would they even entertain such a request?



I know this is quite a long post so I thank you if you have made it this far, and I know I am asking a lot of questions, but literally any information at all would be greatly appreciated, possibly if someone has been through the same thing and knows where I might go from here.

Thanks again for reading, and for any help you might be able to give,

Stephen.

 

[Deleted User]

Wow that's a really nasty thing to happen, I feel your pain. I would hope that Google can step in and help you out here, I'd get back to them and keep hassling them to do something about it. The evidence is clear, this is theft, plain and simple.
The unfortunate thing is that if someone is really determined to reverse engineer your code, they can. Even with code obfuscation, decompilers are available, and it's relatively easy to do.
Like I say, it is Google's responsibility to step in here and do something about this. I would have expected them at least to take the copied app off the store and investigate.

 

[Deleted User]

Actually looking at what the thief did, it appears that they didn't even change any of your code, just repackaged the APK, replacing some of your resources like icons and splash screen with their own.
I wonder how widespread a crime this is on the Google Play store? Maybe there is so much of it going on, they haven't got the resources to deal with it?

 

[Stephen O Neill]

Actually looking at what the thief did, it appears that they didn't even change any of your code, just repackaged the APK, replacing some of your resources like icons and splash screen with their own.
I wonder how widespread a crime this is on the Google Play store? Maybe there is so much of it going on, they haven't got the resources to deal with it?

This developer actually has 18 other apps in his app store on google play, it would lead me to believe that some if not all of this persons other apps may also have been stolen, an issue which I raised in my email to them. Im half afraid when they do inevitably contact him that he may start bombarding my apps with negative feedback, he seems to have alot of his feedback on his apps originating from the same people, fictitious accounts I would imagine

 

[scary alien]

Here's something I posted in another thread back in mid-September that might help and/or be a good starting place:

http://androidforums.com/threads/my-paid-app-is-being-distributed-for-free.944039/#post-7080249

Yeah, bunch of scumbag sites that copy and re-post apps .

Have a peek at this excellent thread over on stackoverflow.com:

http://stackoverflow.com/questions/9865162/how-to-secure-my-app-against-piracy​

The second answer in that thread references this:

http://developer.android.com/guide/market/licensing/index.html​

which says, in part:

Google Play offers a licensing service that lets you enforce licensing policies for applications that you publish on Google Play. With Google Play Licensing, your application can query Google Play at run time to obtain the licensing status for the current user, then allow or disallow further use as appropriate.

Little bit of extra work I'm guessing (I haven't used this for my apps), but probably worth it in the long run.

Best of luck and let us know if you implement this and what your experiences were with it.

Cheers!

 

[Stephen O Neill]

Here's something I posted in another thread back in mid-September that might help and/or be a good starting place:

http://androidforums.com/threads/my-paid-app-is-being-distributed-for-free.944039/#post-7080249

Thanks for the links, after a quick read it sounds like this would help with paid apps more so than free apps (unfortunately mine are all free at the minute) but it will definitely be of great help to me in the future when I go down that road thanks.

 

[scary alien]

Another thought / option would be to put code in your app that would do some self, internal checking...i.e., you know what your app's package name is [edit: which cannot be cloned], so you could include some coded, simple-encrypted (SHA1, etc.) strings that self-test / cross-check your package name.

If/when the name doesn't match, produce a pop-up saying "This .apk is not the original work of the Play Store account that published this app. It has been cloned and may contain malware. Please contact me (xyz@gmail.com) or download the real version of this app at this link below: xxxx" (obfuscating the contents and references to all of the above strings to make it harder for the pirate--or at least make him do some real work in cloning your app).

Lots of ways of doing/implementing this...

 

[autonomous1]

I would consider writing a strongly worded letter threatening legal action. Then develop a new version with additional features and incorporate the changes made by the copyright violator with modification, because it seems to sell better with these modifications. It also seems to be an interesting case study in marketing apps.

Can you provide links to both apps in play store?

In app purchases with verification on an external server are the best way to secure your app because it requires someone to reverse engineer the app. External server verification also deals with fake store purchases. But nothing is foolproof.

I may be able to share a legal letter to send to the culprit. They need to provide a bona fide mailing address to sell on Google play.

 

[Stephen O Neill]

Another thought / option would be to put code in your app that would do some self, internal checking...i.e., you know what your app's package name is, so you could include some coded, simple-encrypted (SHA1, etc.) strings that self-test / cross-check your package name.

If/when the name doesn't match, produce a pop-up saying "This .apk is not the original work of the Play Store account that published this app. It has been cloned and may contain malware. Please contact me (xyz@gmail.com) or download the real version of this app at this link below: xxxx" (obfuscating the contents and references to all of the above strings to make it harder for the pirate--or at least make him do some real work in cloning your app).

Lots of ways of doing/implementing this...

That sounds like a really great idea thanks, Im just after finishing up another app, so I want to go back over all of them and put something like this in my code, like you said even if it doesnt stop them it might deter atleast the lazier amongst them and make it harder on the rest.

 

[Stephen O Neill]

I would consider writing a strongly worded letter threatening legal action. Then develop a new version with additional features and incorporate the changes made by the copyright violator with modification, because it seems to sell better with these modifications. It also seems to be an interesting case study in marketing apps.

In app purchases with verification on an external server are the best way to secure your app because it requires someone to reverse engineer the app. External server verification also deals with fake store purchases. But nothing is foolproof.

Do you think I should send something like that directly to the developer? I was afraid that if I contacted him directly he might start attacking my apps with bad reviews or something like that out of vengence.

Yes at the very least it is an interesting case study into the differences between marketing techniques, this whole experience is teaching me alot about both the security side ( or lack thereof) and my clearly sub-par marketing skills.

 

[autonomous1]

Ultimately you need to backup your copyright with legal action. But if you are concerned about repercussions then maybe start with a kindly worded letter commending them on their marketing skills and saying something about them choosing your app to market, but remind them it is a copyright work.

 

[Stephen O Neill]

Ultimately you need to backup your copyright with legal action. But if you are concerned about repercussions then maybe start with a kindly worded letter commending them on their marketing skills and saying something about them choosing your app to market, but remind them it is a copyright work.

Yes, I think this might be the best approach, dont want to poke the bear so to speak.