I found the paper very eye-opening, but perhaps I missed the "moral" of the story. I understand that Google's auto updater can behave similarly to a malicious utility by an APT, but what recourse or mitigation techniques are available? According to the paper, each step individually is indistinguishable from benign activity. Techniques for identifying the end result of the activity and flagging it as suspicious are omitted (or perhaps I missed them).