0

I've recently noticed that once in every few days, several apps on my phone suddenly show as "recently updated", even though they didn't get any update from the Play Store. The way I can see that they were updated, is not through the Play Store, but rather through Nova launcher's "new/updated" apps category, and also through Total Commander's "Installed Apps" sorted by date.

Since it's a Pixel phone, I wonder if that could be due to some Google-related infra/library being updated in the background (just like the Play Store app sometimes auto-updates itself without any notice), or should I start worrying about malicious code slowly crawling through my phone and injecting itself into other apps?

A few points worth mentioning:

  • Phone isn't rooted, and doesn't allow to install third-party apps.
  • Developer options are accessible, but USB debugging is disabled, and I didn't change almost any setting there.
  • The Play Store app settings doesn't allow any kind of auto-update unless I initiate and approve each update.
  • The apps that change/update in each batch seem totally random: they could be of any type, and doesn't seem related to how frequently I use them (some of them I haven't launched in months, maybe a year or more).
  • Usually, no more than a few apps in each batch - and no more than one batch every 1-3 days or so.
  • These apps continue to get regular updates through the official Play Store and everything seem fine.
  • There are still many apps on my phone which weren't updated/changed at all, for some of them the last change/update was more than a year ago.

Any ideas on what or how to check this? Anyone else may have noticed similar behavior?

2
  • My answer might help to find apps sorted by last update time and their installer name: android.stackexchange.com/a/120158/96277 // Do you also happen to have new apps automatically installed or just the installed app gets updated? The first one is the case with some OEMs sneaking into your device in the name of "recommendations", but I don't know if Google does that too or not, hence, asking that. – Firelord Jan 5 at 0:35
  • Adding to my own question, as a side note. Since I've just heard about this vulnerability - although it's old, maybe there's more like it that are still out in the wild? xda-developers.com/janus-vulnerability-android-apps – Yoav Feuerstein Feb 16 at 11:09
0

You can check that using ADB

  • List the first install time:
for package in $(dumpsys package | grep -Po "Package \[\K[^\]]+"); do
    echo $package $(dumpsys package $package | grep firstInstallTime)
done;
  • last update time: replace firstInstallTime with lastUpdateTime

If theses Apps changed they will not receive the updates from the Play Store as the signing certificate will also change. To ensure that it's the same app from the store:

  • dump the APK from your device
  • Download the same App from the Play Store in another phone or from APKPure
  • use aapt2 to compare these Apps:
$ aapt2 diff apk1 apk2

or you can also compare certificate of both Apps.

2
  • 1
    I think if the apks are modified (for malicious or other reasons), Android would not install the modified apk as an update over the installed instance. It would simply fail. I think pm specifically throws an error for this. Don't remember which one but this is a security feature. – Firelord Jan 5 at 0:25
  • Agree. I thought to the case if an app is replaced by another one and the second still receive updates. – St0rm Jan 5 at 4:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.