SECURITY: Did something get in? Ideas/tests welcome

[Flapjacks2012]

Hi All,

In short: Browsing usual pages, unprompted download starts, panicked, can't see anything new but want assurances please.

More detailed:

I've been browsing today on my HTC One S on websites I've used for years on my HTC Desire. Whilst I was surfing I got the download arrow appear in my notification bar without being prompted - cue paranoia! Can't rip out the battery or memory card as its a sealed unit and by the time I thought about powering off the OS restarted - not the entire phone though (didnt get the HTC splash/bios).

Immediately phoned my carrier to get premium number calling blocked on my phone (too paranoid?) just to be safe.

Looking in my Apps I can't see anything new or suspect and I had previously set the "allow non-market apps" as OFF i.e. No. Can't see anything untoward in ICS's task manager either.

Can anyone suggest a known good app for malware/virus scanning or doesn't one exist? Some website (in brief) say they dont really do anything.

Thanks lots,
Flapjacks

 

[lunatic59]

Hello and welcome to Android Forums!

I wouldn't worry too much. First, if you're not rooted, malware can't do anything that a simple reset wouldn't fix. Second, drive-by downloads can't auto-install or install silently (you'd be prompted for permissions) and finally, if you haven't enabled installation from unknown sources you couldn't install it even if you wanted to.

What is a more likely scenario is that one of your already installed apps auto-updated with no change in permissions. It was simply coincidental with your browsing. Do this ... open the Play app on your phone and go to menu>settings and see if auto update apps is checked. If it is then that's most likely what you saw.

 

[dylo22]

Second, drive-by downloads can't auto-install or install silently (you'd be prompted for permissions) and finally, if you haven't enabled installation from unknown sources you couldn't install it even if you wanted to.

"Can't" is a strong word. It's possible to exploit bugs in the browser to escalate permission levels. Security researchers have developed proof of concepts to do drive-bys downloads on android with out user intervention. We just haven't seen these sophiscated attacks in the wild yet. But it's very possible.

Android smartphones infected via drive-by exploit - Update - The H Security: News and Features


In the OP's case, I don't think this is a drive by download. Like lunatic59 said, it's most likely just one of your apps trying to auto update itself.

 

[AngryHatter]

It's also possible that I will be the next president of the United States - just very unlikely.

 

[dylo22]

It's also possible that I will be the next president of the United States - just very unlikely.

No arguments with you there. I never said anything on the likelyhood of this happening. I'm just clearifying to the OP that drive by download is possible on android.

 

[jefboyardee]

It's also possible that I will be the next president of the United States.

Stranger things have happened.

 

[Harry2]

OP, did you look in your folder Download for the downloaded file?
Sometimes I tip accidentally on a link with PDF and then the PDF would be downloaded.

If you have a file browser (like EStrongs File Explorer) go to the Download folder (on the storage's root) and look after the most recent file (with sorting 'Changed').

If you have set EStrongs to show the files size, type and date you'll find this downloaded file.

Harry