  Android is the most popular operating system with billions of active devices.
Unfortunately, its popularity and openness makes it attractive for unwanted
apps, i.e., malware and potentially unwanted programs (PUP). In Android, app
installations typically happen via the official and alternative markets, but
also via other smaller and less understood alternative distribution vectors
such as Web downloads, pay-per-install (PPI) services, backup restoration,
bloatware, and IM tools. This work performs a thorough investigation on
unwanted app distribution by quantifying and comparing distribution through
different vectors. At the core of our measurements are reputation logs of a
large security vendor, which include 7.9M apps observed in 12M devices between
June and September 2019. As a first step, we measure that between 10% and 24%
of users devices encounter at least one unwanted app, and compare the
prevalence of malware and PUP. An analysis of the who-installs-who
relationships between installers and child apps reveals that the Play market is
the main app distribution vector, responsible for 87% of all installs and 67%
of unwanted app installs, but it also has the best defenses against unwanted
apps. Alternative markets distribute instead 5.7% of all apps, but over 10% of
unwanted apps. Bloatware is also a significant unwanted app distribution vector
with 6% of those installs. And, backup restoration is an unintentional
distribution vector that may even allow unwanted apps to survive users' phone
replacement. We estimate unwanted app distribution via PPI to be smaller than
on Windows. Finally, we observe that Web downloads are rare, but provide a
riskier proposition even compared to alternative markets.
