Digital Turbine’s Ignite allows carriers to install post-sale bloatware without permission

androidauthority.com

Carriers aren’t having much luck generating additional revenue from apps and advertisements these days, but they seem determined to shove themselves, and their bloatware, back into app space. Reports are coming in of carrier branded smartphones automatically downloading new apps, bypassing Google’s user app permissions in the process.

Digital Turbine is the primary company involved, which develops app management, search and shopping services for carriers. The company already provides mobile solutions to Vodafone, Verizon, Telefónica, T-Mobile, SingTel, Smart, Telstra, Cricket and others.

Digital Turbine’s biggest product, known as Ignite, is designed to allow developers to speed up the roll-out of software and apps for smartphones. The video below will give you the gist. It’s not a bad idea, as carrier updates are usually painfully slow as they have to test and package their software for every new Android build, but there’s a little more to the story.
Digital Turbine Ignite lets mobile operators regain a competitive edge, maximizing the efficiency of pre and post loading applications on smartphones for more advertising 

Mandalay Digital Group, which owns Digital Turbine, has recently announced that it will be buying Appia, the largest independent mobile app marketer outside of Facebook. Mandalay plans to integrate Appia’s app marketing into Digital Turbine, and possibly into its Ignite distribution package as well.

The result is that app marketing and carrier software distribution look set to become increasingly intertwined. Optimistically, such a service could provide users with carrier supplied apps that actually match your wants and needs. However, the skeptic in me finds it unlikely that such a service will offer any real value to consumers. Worse still, there is already evidence to suggest that this idea will result in extra unwanted bloatware appearing after you’ve already purchased your device!

there’s a risk of pushing out malicious software to a large number of consumers

T-Mobile and Verizon are currently signed up and using Digital Turbine’s Ignite service. The DT Ignite application appears to have been recently sneakily installed onto T-Mobile devices under the guise of a “performance enhancement” update, which instantly sets alarm bells ringing. The app demands a full range of permissions, yet an option is never presented asking if users would like to install it or not.

Our worst bloatware fears appear to be confirmed, as Reddit user Real666_ has reportedly found that DT Ignite is responsible for downloading three unwanted apps to his Galaxy Note 4; Cookie Jam, Drippler, and RetailMeNot; without attempting to consult him. Forcing OTA bloatware to a user’s phone is bad enough, but the fact that this bypasses Google’s app permission requests means that there’s a risk, however small, of pushing out malicious software to a large number of consumers.

The only way to prevent the apps from automatically downloading is to disable DT Ignite, but the best way to completely remove the application would be to root your handset, something that carriers aren’t too keen on.

app marketing and carrier software distribution look set to become increasingly intertwined

Alternatively, resetting your handset to a factory image and avoiding future carrier updates would also work, but this is far from an ideal solution.

At the moment, only carriers seem to be interested in Digital Turbine’s Ignite software. Non-carrier branded handsets, unlocked variants and Nexus smartphones should remain safe from any app spam. I am very interested to know what Google thinks of apps that attempt to bypass user permissions.

There is a good reason why consumers dislike carrier installed bloatware and this situation is unlikely to help their reputation. If you’ve encountered any strange app downloads, please let us know.