As has been discussed to death in the AV threads though, the apps now will do nothing to find a Trojan or other spyware. An app could be stealing your info and using pay services all day and the apps would say nothing. The only thing they do actually do is provide a false sense of security that is worse then no security.
-
After 15+ years, we've made a big change: Android Forums is now Early Bird Club. Learn more here.
- Thread starter ardchoille
- Start date
As has been discussed to death in the AV threads though, the apps now will do nothing to find a Trojan or other spyware. An app could be stealing your info and using pay services all day and the apps would say nothing. The only thing they do actually do is provide a false sense of security that is worse then no security.
The difference between a trojan and a virus isn't the damage done--it's how it gets on your system. A virus will get on your system automatically, exploiting a software vulnerability. A trojan you choose yourself to install because you believe the application to be benign when it's actually malicious.
Bob Maxey
Android Expert
And iOS/Apple puts everything in the sandbox so a virus is not really a serious problem. If you are not jailbroken, very little can get installed or changed even if you wanted to do it.
If you do JB, the first thing you must do to prevent potential problems is to change your root password which happens to be 'Alpine.' Unless you change it, every iDevice has the same password. If you do not JB, it matters very little.
Wait...how do we know this? I understand AV can't find new trojans because that's not what they are designed for, but old ones should not be a problem.
Here's series of videos that tests AVs against known malwares.
Android Security Test Part 1 - YouTube
It's only a false sense of security if you treat it as the only source of security. You can have an AV and check permissions at the same time. It's doesn't have to be one or the other. The AV will serve as a second layer of security for added protection.
I understand that. My original question was what happens if you accidentally or mistakenly install these malicious apps? In such a situation, don't we want to have a secondary security system to alert us and prevent us from installing?
I ask this because we are all humans and we all make mistakes. Even those of us who are really diligent can trip up and install something that we didn't intend to. Also hackers are smart people too. They're don't want to make this obvious for us. They're going to try very hard to trick us to install something that it is not.
Sure, it's easy to point out a malicious app when it's a wallpaper asking for contact info access or internet access, but what if is a game or a utillity app? I think in those cases, it's less obvious.
Don't get me wrong, I'm not saying that AV is necessary on android. We can go without just fine. But hey, if someone want additional security, we shouldn't discourage it either. There's really no harm in having one.
A.Nonymous
Extreme Android User
If I put an app on the market that is a live wallpaper, but I really use it to suck all your contacts off your phone and send spam SMS messages to all of the, no AV app in the world is going to detect it because the AV app has no idea if that is what you want the program to do or not.
Fair enough. I'm not proclaiming that AV will catch everything - because they don't. But as long as it does catch some, then you're getting the adding benefits of that extra layer of security.
A.Nonymous
Extreme Android User
It's only going to catch known malware which isn't going to make it into the Market in the first place. It'll protect you if you're in the habit of loading warez on your phone, but if you do that it's kind of like buying drugs from some guy in an alley and trusting that they're not laced with something.
Why not? To my knowledge Google isn't screening our vetting their apps. Anyone can post apps to the market.
There are malware apps released on the market that go into circulation until they are pulled by google. There are other ways of getting apps that could have been pulled from the market other than via warez. Perhaps you downloaded it from the market when it was on it and made a backup on your SD. Then at a later point you could reinstall without knowing it was pulled for being malware. Given warez users are likely some of the biggest malware prone users of Android even with warez AV apps would not be as effective as they are reported to be by the devs (IMO at least
)Google doesn't screen apps, but if an app is reported as being malware or doing something illegal they can pull it and even remotely uninstall it from devices if it needs to be (I think the remote uninstall has been done maybe once or twice)
Bob Maxey
Android Expert
That is a very good point. All Android users know that some apps ask for permissions to do many things. And most users really do not know if it is good or potentially dangerous. They blindly trust things will be OK.
A.Nonymous
Extreme Android User
All iOS users blindly trust that things will be OK. They have no other choice and Apple does a good job of filtering things in most cases. At the end of the day though there is no way users on that platform can exercise even common sense. You have no choice but to trust Apple. Google, on the other hand, does no filtering and lets users use common sense. Both approaches are flawed, just in different ways.
Bob Maxey
Android Expert
Because I do not know what happens when you seek app approval from Apple, I'll simply make a few guesses based upon what I do know. Last I knew, there was an approval process for apps and it was not a cursory inspection.
Again, I do not know what hoops devs must jump through to get his or her app approved by Apple.
But consider this:
The Apple/iOS sandbox provides very strict limit on the system resources applications can access. It is not a matter of blind trust. Programmers must write code that "plays" only within the sandbox. The sandbox is essentially a small area within your iDevice where the code can play freely. It is not allowed to play anywhere else. Hence the term Sandbox.
Because of the sandbox, it is very difficult to do simple things like uploading images to the web. There is no easy or convenient way to do this from email clients, Safari or other web browsers. There are no "upload" buttons.
This is because the sandbox isolates things; most applications simply cannot access other areas of the file system. Bad programs have a difficult time interacting with essential parts of iOS.
The sandbox is one of the reasons people have less to worry about. Is it infallible? No, I am betting some clever person will find a way to create issues. Or perhaps they never will because of iOS limitations.
If you are jailbroken, things can be/could be/are likely different. Jailbreaking exposes the iDevice file system so it can be accessed and manipulated in ways Apple does not allow. So jailbreakers must take steps. We are in the minority, however.
A.Nonymous
Extreme Android User
At the end of the day it's still the same. With iOS you are putting complete faith in Apple that a malicious product is not going to make it to the market. Yet malicious apps have made it into the App Store on ocassion because no system is perfect. Apple has promptly pulled them down. With Google the responsibility is completely on the end user. More malicious apps make it to the market and Google pulls them down once they're notified of them, but it's ultimately the end user's responsibility.