Malware risks

[pickle0259]

Hi! I've been using Android phones for the past 4 years now.
About 2 years ago I downloaded some pretty sketchy apps on my phone and now that I think about it I'm pretty fearful that the apps may have stolen some private information like videos or photos and posted them online. The phone that I previously used has already been completely wiped (using factory reset). I have never rooted my phones. I don't know if I've ever been hacked but about 2 years after having my first Android phone (a Motorola Milestone XT), it started getting very hot very easily but I think that was more of a battery problem.
What are the chances that somewhere out there someone is holding sensitive information against me waiting to strike?
Also, is there any possible way to see if my phone has ever been hacked/routed by external sources even after it's been completely reset?
Thanks so much for your help, this issue has really been keeping me up at night.

 

[Crashdamage]

Relax. As long as you only install software from trusted sources like Google Play or Amazon your chances of trouble are *extremely* small.

Linux user #266351. Android since v1.0

 

[omnius]

Relax. As long as you only install software from trusted sources like Google Play or Amazon your chances of trouble are *extremely* small.

Linux user #266351. Android since v1.0

I used to feel this way too, now I'm not so confident. Tests run against both Google Play's Bouncer malware scanner and against jelly bean built in new scanner have found not only that it was only able get about a 15% detection success, but that the means to spoof Bouncer have been made public. Latest studies are also showing a 580% increase year on year of malware on Android taken from a total of official apps and sideloaded apps.

Frankly I'm pretty pissed off because I like Android far above other mobile OS'S but I'm growing tired of having to carefully dissect permissions for every app I install, and tweak permissions myself for each one using LBE security guard. I'm getting tired of trying to find good apps that have no requirement to have Internet access yet have it listed as a permission. The most recent news story of an Australian developer discovering that he was given a buyer's email address and rough home location by Google Play is just icing on the cake.

I use mobile banking and other similar apps on my phone, I don't need the stress of worrying about being compromised.

 

[sdrawkcab25]

I used to feel this way too, now I'm not so confident. Tests run against both Google Play's Bouncer malware scanner and against jelly bean built in new scanner have found not only that it was only able get about a 15% detection success, but that the means to spoof Bouncer have been made public. Latest studies are also showing a 580% increase year on year of malware on Android taken from a total of official apps and sideloaded apps.

Frankly I'm pretty pissed off because I like Android far above other mobile OS'S but I'm growing tired of having to carefully dissect permissions for every app I install, and tweak permissions myself for each one using LBE security guard. I'm getting tired of trying to find good apps that have no requirement to have Internet access yet have it listed as a permission. The most recent news story of an Australian developer discovering that he was given a buyer's email address and rough home location by Google Play is just icing on the cake.

I use mobile banking and other similar apps on my phone, I don't need the stress of worrying about being compromised.

http://www.extremetech.com/computin...e-growth-greatly-exaggerated-to-freak-you-out

https://plus.google.com/app/basic/stream/z12yz3wyuuqyzfdq404cgbsyhn3suxl3o

 

[jefboyardee]

I have Avast, Comodo, Malwarebytes, GoBack and God knows what else on my PC. They’re only there because there’s a lot of free space on my hard drive and enough memory to get around them. But I haven’t seen any instance, in over ten years, of them saving my system. If space was as critical there as on my droid, they’d be the first things to go.

As for two years with my droid, there isn’t enough space for any of that, and as long as I stick to the playstore and watch the news, I ain’t worried.

 

[omnius]

Reports of exponential Android malware growth greatly exaggerated to freak you out | ExtremeTech

https://plus.google.com/app/basic/stream/z12yz3wyuuqyzfdq404cgbsyhn3suxl3o

Not so fast my friend. Let's take a closer look at those

While the Android Market allows anyone to upload apps, Google actually does police it fairly well. Apps that exhibit suspicious behavior are pulled very quickly, and the company can even remove malware remotely if it has to..

There's several publicly available reports that have proven this wrong. I've already mentioned in my above post that Google's methods were only successful in detecting 15% of tested threats, and that hackers have already publicized proven methods to fool it.

The article link you provided did mention that the numbers were exaggerated because it includes non official apps from places outside of Google Play. That is true. So what? So the increase is then 300% instead of 580? Hardly a consolation prize.

Especially when looking at a company like McAfee, which sells antivirus, users should remember to be skeptical. The firms producing these reports are counting on people to be gobsmacked by multi-hundred percent increases, and millions of new malware signatures. The reality is that mobile operating systems are much safer than most analysts would have us believe.

This is a tired argument. I could link you article after article by IT companies who DON'T sell security software products who will tell you the risk of malware is substantially higher than closed system mobile OS's. We can sit here and play that forum argument game of seeing who can link the most expert opinions all week to prove who's right if you want, but in this case you're the one who's going to be hard pressed to find more sources saying there's nothing to be concerned about.

Google hasn't exactly had a sterling reputation these days when it comes to being concerned about the privacy and security of people using their products and services. Find me a substantial number of large corporations IT departments who don't cringe at the prospect of android phones being in included in a BYOD setup. That speaks loud and clear volumes right there.

 

[Crashdamage]

I'm fairly security-conscious. For example, I use SE Linux (Fedora or CentOS) at home and would never use Windows or any mobile device for online banking. I only install software from trusted sources - Play Store or from developers directly, no Chinese software, etc. I never use a rooted device for daily use.

But, I admit I pay little attention to permissions and wouldn't use a software scanner on Android if you paid me to.

All that said, I'm more concerned about being hit by a meteor than my Nexus being compromised. A lotta smoke but very little fire.

Linux user #266351. Android since v1.0

 

[epp]

There's also pros and cons, regarding whether one actually needs antivirus software on an Android, because all the apps run in sandboxes.

 

[sdrawkcab25]

Not so fast my friend. Let's take a closer look at those

There's several publicly available reports that have proven this wrong. I've already mentioned in my above post that Google's methods were only successful in detecting 15% of tested threats, and that hackers have already publicized proven methods to fool it.

The article link you provided did mention that the numbers were exaggerated because it includes non official apps from places outside of Google Play. That is true. So what? So the increase is then 300% instead of 580? Hardly a consolation prize.

The point is they are exaggerated... If you only download tried and trusted apps from known publishers, there is virtually zero risk of malware(at least, if not let less than any other OS). You can find malware for any platform just as easy if you stray off the beaten path. Spend time on uTorrent or Cydia and you will find an exponential number of malware apps.

This is a tired argument. I could link you article after article by IT companies who DON'T sell security software products who will tell you the risk of malware is substantially higher than closed system mobile OS's. We can sit here and play that forum argument game of seeing who can link the most expert opinions all week to prove who's right if you want, but in this case you're the one who's going to be hard pressed to find more sources saying there's nothing to be concerned about.

As an IT professional, I'd say those companies are misinformed and stuck in their old ways. Just like so many companies are afraid to update past windows xp or Internet explorer.

Google hasn't exactly had a sterling reputation these days when it comes to being concerned about the privacy and security of people using their products and services. Find me a substantial number of large corporations IT departments who don't cringe at the prospect of android phones being in included in a BYOD setup. That speaks loud and clear volumes right there.

Also, as an IT professional who works for a very large telecom company in the USA...those IT departments are changing their minds, for example, we are right now in the process of switching 50,000 or so employees over to the android platform to manage our telecom network from the field. And we aren't the only large company making the switch . The android platform has plenty of methods at its disposal to keep the devices extremely secure. You are right though, many companies have not adopted android yet, it is still young; like I said above, look how long it takes large corporations to move off windows XP. Blackberry is on its way out

 

[Metroid Prime]

Just install apps and games from Google Play, read the permissions, check the ratings/comments, and you can always ask here about an app or game for feedback. The community is your best bet.

 

[omnius]

OK thx for the feedback guys

 

[epp]

Does an Android really need antivirus software, especially on memory-challenged phones?

Some AV apps are between 4 and 6Mb for the download, but when they are fully running, they use a good 10Mb, if not more.

 

[lunatic59]

In my experience, it's just a placebo. Your security is determined more by your habits and practices. If you install apps only from trusted sources from established developers, then the need for antivirus is practically nil. If you arbitrarily download, install and grant permissions to apps from anywhere you can find them, then antivirus software won't likely protect you.

If all you are concerned about is malware, then be prudent and leave it off your device. There are, however other aspects to security software beyond the detection of malware. For instance, remote wipes of data and locating missing devices. Many times these are all bundled together so you only need one app for everything.

 

[epp]

Lunatic59 - Thanks for the reply. Every app I've installed has been from Google Play and the setting to allow the installation of 'non-Market' (non-Google Play) apps, is unchecked.