4

My company offers a very specifically tailored Android application to supplement our other software. Since users must have an account in our other software in order to use the Android application, is not useful to anyone who does not already subscribe to use our other software. Because of this, we are in a position to know exactly how many Android app users we should have.

We host the application file (.apk file) on our own website and direct our first-time users to download the application from there. After that, we have an automated update system built into the app that notifies the users that there is an update available and it and will update their app for them if they choose to accept the update.

We have very basic analytics in place on our website to monitor manual vs. automatic (update) downloads of our APK. We can see what file was downloaded at what time and by what IP address. After several months of manual and automated download analytics numbers that match up with our user count, we suddenly logged several hundred more manual downloads than we have users last month.

The download pattern I observed when investigating is that the same IP address is downloading the APK in bursts of 2-9 times all within the span of about a minute, and then within another minute or two another IP address does the same thing. This happened on and off for several days and I suspect there is some kind of bot/automated software that found our APK and is now downloading several copies of it for reasons I can't currently comprehend.

I am hoping to find out if there exists some server configuration, 3rd-party technology, or even some kind of website programming technique we may be able to put into place to protect our site from this behavior? I don't have reason to believe this "bot" is causing us any monetary or intellectual harm at this point in time, but if this continues it will certainly render our download analytics useless.

2
  • 1
    I thought that Android only allowed apps to be installed from the Google Play Store and didn't allow apps to download additional functionality themselves. If that is the case, hosting it on your own site shouldn't be an option. How is this working? Aug 30, 2021 at 15:07
  • 4
    @StephenOstermiller Unlike iOS, Android allows apps to be "side loaded", installed directly from a .apk file without going through the official app store. Aug 30, 2021 at 17:08

2 Answers 2

3

You could add a CAPTCHA to the download page (and if need be modify the in-app update to pass a license key that can be used to bypass the captcha and control automated downloads).

Also to mitigate - but not eliminate - bad actors you may be able to find and blacklist the IP addresses. Fail2Ban might be appropriate for identifying them - depending in their usage patterns. Certainly this appears to be the case.

I'm wondering if indeed the same IP is downloading the app multiple times or if it is attempting to use chunking to break it down into parts to get those simultaneously and thus faster. You might be able to tune your server to identify this behavior and modify its actions if that us the case. (See https://en.m.wikipedia.org/wiki/Chunked_transfer_encoding for more in this methodology)

2

I don't have reason to believe this "bot" is causing us any monetary or intellectual harm at this point in time, but if this continues it will certainly render our download analytics useless.

This is just for analytics reasons?

Make your app request the .apk file using a custom HTTP header. In your analytics, filter out all the requests you get that don't include that HTTP header.

The bots should have no incentive to know about or care to implement the header.

1
  • 2
    Yes, for now we just wanted to try to maintain accurate reporting. However, if the "bot" downloads keep increasing and become too frequent, I am concerned it could potentially negatively affect our server's ability to do its job. I think the custom header would work for the automated downloads but I'm not sure if/how that solution could be implemented for manual downloads since we're also trying to count how many times users actually visit our download page and manually download the files. Aug 30, 2021 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.