> UA rotation is rarely used for legitimate purposes
It’s not uncommon for hundreds of users to share a single public IPv4 IP address through an ISP-provided NAT. The same applies to corporate LANs with a single uplink channel.
These users gonna have random UA corresponding to market share of web browsers and operating systems, all coming to the same web server from a single IP address.
I mean on the play store side, where they scan app submissions for TOS violations before they even hit the store. UA rotation on the client side is rarely used for good.
As from the blog post, the source is public[0] and the Android review process is almost entirely automated static/dynamic analysis of apps submitted, so it wouldn't be super hard to find UA-like strings and have some elevated manual review if there are a lot of them (if they decided to implement this sort of abuse policy).
Google very likely only scans the input application, I'm not sure why you would bother with an automated system to detect a code repo for it when the majority of applications on the Play Store are closed-source and there's a low confidence if the builds are not repeatable.
Anyway, regardless of that it sounds like it would be easily defeated with the following C format string:
For bonus points you can make those floating points, too, and split it up a bit further. Now nobody can scan for this without a lot of false positives (The strings are going to display in anything that embeds a web browser or references it, lol) and you get ultimate flexibility.
I think that’s only possible if they ban TCP/IP for play store apps, enforce that in the OS kernel (SELinux can probably do), and instead expose the one and only high-level HTTP API for apps.
It’s not uncommon for hundreds of users to share a single public IPv4 IP address through an ISP-provided NAT. The same applies to corporate LANs with a single uplink channel.
These users gonna have random UA corresponding to market share of web browsers and operating systems, all coming to the same web server from a single IP address.