41 ms·

Whenever i see anything about android anti-virus apps I've always been confused about what it is they actually look for. Every app on an android phone has fine

Whenever i see anything about android anti-virus apps I've always been confused about what it is they actually look for. Every app on an android phone has fine grained permission management and for anything you give specific access to system functions(like drawing over other apps) to, you have to go to a specific extra permission enabling screen full of warnings to enable it. I understand there's apps with malicious things buried in them, but how can an antivirus determine between something like that and something benign? As far as i can tell, traditional viruses, the way the work on windows and dos systems, just wouldn't work on android. I'm not sure if i'm just missing something, but this article kind of confirms my suspicions. It just seems like you'd have to be really fucking around, or just completely and utterly oblivious to some very obvious red flags, to install a straight up virus on android.

scarface74 8y ago
As if most people pay attention to warnings. Android warnings are about as effective as Windows UAC.
Drakim 8y ago
I could imagine either just a vanilla app blacklist that's regularly updated, or maybe a scanner that looks for known third party libraries commonly used for evil purposes?
ignoramous 8y ago
> As far as i can tell, traditional viruses, the way the work on windows and dos systems, just wouldn't work on android. You might be interested in reading Google's guidelines on what they consider to be a "potentially harmful application" (PHA) [0]. > [..] anything you give specific access to system functions(like drawing over other apps) to, you have to go to a specific extra permission enabling screen full of warnings to enable it. Oh despite the on-device on-use/first-use consent, the android app ecosystem was a big mess before Google started auto-detecting rouge apps and booting them out of play store. Even today, despite GooglePlayProtect, I occasionally find my friends complaining about apps hijacking their phones to show ads and sometimes be very hard to dismiss, and they do not absolutely know what to do (disable/uninstall no longer used apps, revoke permissions, disable notifications). They'd install anti-viruses in hope that it would help fix that. > how can an antivirus determine between something like that and something benign Not sure what anti-viruses do, but some examples from Google's 2018 report on how they fished out PHAs using static/dynamic analysis of apks and machine learning [1]: 1. Re-packaged game apps with data-hoarding/adware. 2. Click-fraud apps (see above). 3. Suspension of key device functionality (on a rooted device, esp). > It just seems like you'd have to be really fucking around, [..] to install a straight up virus on android. You might be right: A good percentage of 2bn active android users might be doing just that. -- [0] https://source.android.com/security/reports/Google_Android_Security_PHA_classifications.pdf https://source.android.com/security/reports/Google_Android_S... [1] https://security.googleblog.com/2019/01/pha-family-highlights-zen-and-its.html https://security.googleblog.com/2019/01/pha-family-highlight...
- pitaj 8y ago
  But do apps from the play store have the system permissions to carry out those operations on other apps? I don't think they do.
- sonnyblarney 8y ago
  To be specific, we're not talking about classical viruses here. This is a different kind of malware. Fortunately, you're probably not going to get 'infected' merely by being on the same network as someone with malware. I think perhaps Google should take some API steps to help fix the problem. There are just some kinds of things that nary any app should be able to do anyhow.

scarface74 8y ago

As if most people pay attention to warnings. Android warnings are about as effective as Windows UAC.

Drakim 8y ago

I could imagine either just a vanilla app blacklist that's regularly updated, or maybe a scanner that looks for known third party libraries commonly used for evil purposes?

ignoramous 8y ago

> As far as i can tell, traditional viruses, the way the work on windows and dos systems, just wouldn't work on android. You might be interested in reading Google's guidelines on what they consider to be a "potentially harmful application" (PHA) [0]. > [..] anything you give specific access to system functions(like drawing over other apps) to, you have to go to a specific extra permission enabling screen full of warnings to enable it. Oh despite the on-device on-use/first-use consent, the android app ecosystem was a big mess before Google started auto-detecting rouge apps and booting them out of play store. Even today, despite GooglePlayProtect, I occasionally find my friends complaining about apps hijacking their phones to show ads and sometimes be very hard to dismiss, and they do not absolutely know what to do (disable/uninstall no longer used apps, revoke permissions, disable notifications). They'd install anti-viruses in hope that it would help fix that. > how can an antivirus determine between something like that and something benign Not sure what anti-viruses do, but some examples from Google's 2018 report on how they fished out PHAs using static/dynamic analysis of apks and machine learning [1]: 1. Re-packaged game apps with data-hoarding/adware. 2. Click-fraud apps (see above). 3. Suspension of key device functionality (on a rooted device, esp). > It just seems like you'd have to be really fucking around, [..] to install a straight up virus on android. You might be right: A good percentage of 2bn active android users might be doing just that. -- [0] https://source.android.com/security/reports/Google_Android_Security_PHA_classifications.pdf https://source.android.com/security/reports/Google_Android_S... [1] https://security.googleblog.com/2019/01/pha-family-highlights-zen-and-its.html https://security.googleblog.com/2019/01/pha-family-highlight...

pitaj 8y ago
But do apps from the play store have the system permissions to carry out those operations on other apps? I don't think they do.
sonnyblarney 8y ago
To be specific, we're not talking about classical viruses here. This is a different kind of malware. Fortunately, you're probably not going to get 'infected' merely by being on the same network as someone with malware. I think perhaps Google should take some API steps to help fix the problem. There are just some kinds of things that nary any app should be able to do anyhow.