Download LauncherSpam Demo

Today, probably like many of you, I updated the Google Maps application to discover something rather odd. Google Maps is now sporting four separate icons, one of which is a replacement for an existing stand-alone application. The strangeness stuck with me all day and what initially struck me as somewhat odd has now grown into a full-on What were they thinking?!

Before I even get started, let me preface everything I’m about to say with a hearty I can’t believe I’m about to call out Google Maps, one of my favorite and most-used applications of all time. The app and its maps have saved my tail more times than I care to count. Normally it’s a shining beacon of how an app should function on the Android OS. And while four icons might just seem like a missed step, I believe there might be a little more at stake here.

Allowing an application to place multiple icons (and thus, multiple points of entry) is a dangerous game. The Google Maps case is likely the most appropriate use of multiple icons I can imagine. All the icons are completely relevant to the core application and clearly labeled. But what would happen if an app wasn’t playing nicely? Could an unscrupulous app place dozens of hidden applications without my knowledge?

Having flashbacks to the PC days of unwanted add-on toolbars and Bonsai Buddy, I contacted Justin of nEx.Software, our resident Android guru. I asked if he knew of any limit to the number of icons a standard market application could spawn. He said there wasn’t and the idea was born.

Enter LauncherSpam, a quick demo application built in a couple hours that is already live in the Market. The idea behind LauncherSpam is simple. When installed, the app will drop a dozen spammy (although completely harmless) apps into the launcher tray. The apps (all fake) range from spyware scanners to free MP3s to ringtones and even a set of smilies (really channeling the old PC days throwback). Without warning the user, the original LauncherSpam app is able to easily spawn a dozen “hidden apps.”

If only all security risks were so forthcoming

Luckily for us, LauncherSpam is just a simple demo. The “hidden apps” are nothing more than silly PNG files cooked up by Angie and myself to make a point. It’s just… weird to us that this ability exists, completely unchecked by application permissions or some kind of user prompt.

If an application you trust (maybe undeservedly) comes side-loaded with a spam add-on, wouldn’t you like to know? With Google Maps, the extra icons aren’t as offensive because I know what they are and with which application they are associated with. With some of the icons you’ll find in your tray after installing LauncherSpam, you won’t be so lucky. For reference (and for fun), I made a complete list of the fake apps side-loaded with LauncherSpam:

• Free MP3′s
• Keyboard
• Kitty Doc
• LauncherSpam (core app)
• Lightning Bug
• Ring Me
• Smilies
• Spyware Agent
• Suspicious Package
• Tips
• Tron
• TweetBox
• Virus

Most of these titles are applications you wouldn’t even give a second look to, let alone install them. But a standard market app with devious intent has the ability to make it appear that these apps are real, functioning programs on your phone. Even worse, after noticing an offending “hidden app”, the average user would have no real way of knowing which “core app” was the culprit, leading to an awkward pattern of uninstalling and evaluation to find the offending application.

At the time of publication, there doesn’t seem to be too serious a problem with Market apps spamming the launcher tray. And I’d love for it to stay that way, which is why I was so surprised to see Google behaving in such a manner. Google applications are the ruler by which other applications are measured. They are filled with best practices and all kinds of innovation. They set precedents, for better or worse. I don’t want to see less savory developers using these methods for underhanded means and thinking it is acceptable because Google Maps did it.

And now is the part where we let you, the reader, decide. Am I blowing this out of proportion? When I first asked Android users on Twitter today if four icons was too many, most didn’t seem to mind. So I ask What if it wasn’t Google?

LauncherSpam is available now in the Android Market. You can download it by scanning the QR at the top of this post or by clicking here on your device. Remember, to get rid of all the garbage apps, simply uninstall the original LauncherSpam app. The icons used in the test app were from the Crystal Clear set, via Wikimedia Commons

An Android application file (extension .apk) is just a zip file in disguise. Replace the a-p-k with z-i-p and they will be recognized as a zip archive by any zip archiver like WinZip, Windows Explorer (seen as compressed folders), StuffIt etc. This also includes the handy ASTRO for Android. You can use any combination of these tools to do the same thing, but I’m going to use ASTRO because you can actually do all of this on your phone without developer tools like adb.

If you have the SDK and know how to use adb, just replace the terminal commands with commands in “adb shell.” It’s also easy to type “adb pull /data/app/the.icon.pack.name.apk” and work with it from your desktop. First, open Terminal Emulator. Type “su” to get super user privileges. At this point you may get a prompt from “Superuser Whitelist” if you’re working with a JF Image for root. Add Terminal Emulator to the whitelist and you’re free to go on as root.

cd /
chmod 777 data
cd data
chmod 777 app
cd app

You’re now in the directory with all your .apk files. Do an “ls” to see everything that’s in there. I picked the RBO icon pack as an example.

mv com.betterandroid.icons.robo.apk com.betterandroid.icons.robo.zip
chmod 777 com.betterandroid.icons.robo.zip

Copying with ASTRO

You’re done with Terminal Emulator for now. Open ASTRO and browse to the zip file. Tap on it and it should open. Go into the “assets” and then the “icons” directory. You should see a list of .png files.

From here you can do what you want with the images. You can hit menu, Edit, Select All, then menu, Edit, copy and browse to the directory where you want them (I recommend /sdcard, which will put them on your sd card) and hit menu, Edit, paste to copy them there.

The Extracted Icons

Deleting the icons you don’t want in place doesn’t work. You won’t be able to see the application on your desktop anymore or reinstall it because the signature won’t work with fewer files in the archive. This shouldn’t matter, however, because applications like BetterCut that allow you to change shortcut icons work just as well from the raw file on your sd card.

If you’re going to get rid of the icon pack, the safest thing to do is change the extension back to .apk (you can do this with ASTRO now that the file permissions are set) and uninstall normally. Luckily, ASTRO does that too. Just click on the apk and hit “Uninstall.” You can also just delete the .zip file, although there will be a reference in Settings ⇒ “Manage applications” to the icon pack that will need to be removed as well. You can uninstall it as if it were an application.

[Custom theme images via Extreme Themes]