In 2011, an Android malware known as DroidDream appeared on over fifty Android apps. This was reported by Aaron Gingrich of Android Police back then. On a more recent note, last year in October, a few researchers from German universities, Leibniz and Philipps, have identified forty-one insecure apps in the Google Play store that could compromise sensitive information on your Android device—things like your bank account number, credit card number, and more.
Here is the detailed PDF of the study. The important thing about this study is that these forty-one apps have been downloaded over 185 million times, and they are among the top rated free apps available in the Android market. The apps have since been pulled.
As of yesterday, Android market, the Google Play store, has 618,751 apps in total. Over 77 per cent of them are free apps, and they enjoy enormous number of downloads.
Google has its store secured with proper security measures. It was in February last year that Google introduced a malware detection system to the Play Store, known as Bouncer. In June last year, a security company called Duo Security has shown us how it can circumvent the Bouncer. Here’s a video by Dr. Oberheide of Duo Security that I found:
It was a little bit technical for most of us. Still, that clearly shows us one thing: that Google’s Bouncer can also not completely prevent malware on the store. The detailed report given at SummerCon he was talking about in the video is here. The study by researchers in the German universities I mentioned earlier corroborates this fact. How, then can you really be secure with your app downloads? Here’s how.
Every app you download on Play Store has its own requirements. It needs some information and permissions from your smartphone in order to operate. If you are visiting the app’s page on Google Play, you can see a tab that says Permissions, where you will see all the details about what the app can and can’t do once installed. When you are installing an app, it will give you notification on your device about various permissions.
Here, we have the details about various permission types in Android Play Store.
You should be extremely careful if the app can take advantage of services that cost you money. This will be explicitly stated in the Permissions tab. With this particular warning, you should understand that the app is capable of using important phone functions, such as texting and calling someone.
This function can be used by a malware to actually make phone calls to premium telephone numbers and charge you for that. Read this infographic about various security threats.
With this permission, the app will have full access to your network settings, to download updates or send information across. With this permission, the app can automatically use Wi-Fi, BlueTooth, or the regular data access connection on your phone.
If the app contains a malware, it can easily contact its vendor to send information across to him. Even if the app doesn’t include a malware during the initial download, it can update online to gather a malware component from a remote server through this permission.
This permission is slightly different from the first one we mentioned. This doesn’t let the app make a call or send a text message, but it gives the app permission to access phone records, know whether a call is coming or not, and read your incoming SMS.
A malware working inside the app could send this type of information across to the vendor, thereby compromising your security.
With this permission, the app can read your location using either just the GPS or both GPS and the network. If it has network access, extremely precise location info can be identified by the app.
If the app has a malware inside, it can illegally send across your location to a bad guy, who can easily stalk you.
With this permission, the app can easily read various confidential information you store on your smartphone—contact list, calendar entries, browser bookmarks and history.
It doesn’t matter whether you have security settings cited within these details; the app will still be able to share all these details with the real world. A malware can easily take advantage of this. This is one of the most common ways your personal information gets stolen.
This particular permission allows the app, system-level access. It enables the app to do such things as closing other apps, setting and changing system time, changing Wi-Fi settings, automatically starting at boot, etc.
As you can see, a malware can easily deploy these functions to do something like a Denial of Service (DoS) attack.
If your phone has extended storage in the form of USB OTG or MicroSD, this permission will let the app write data into it. Simply put, the app can store or delete whatever into the MicroSD card.
A malware-affected app, thus, can immediately delete the contents of the MicroSD card or create a copy of itself within the card, which will spread the infection to other devices if you use the card on them.
Looking at these app permissions doesn’t give any comfort, does it? It is disturbing to know that most of the apps (paid and free) in the app store require most of these permissions. You should be able to make out why a particular app requires a particular function.
For instance, imagine you are installing a legitimate antivirus app. The app most probably requires permission to read through your text messages. It is probably benign as an antivirus app should be capable of scanning incoming messages. In the same way, if you are installing an image editing tool, it may require disk access to read and write data into it. This should be benign as well.
On the other hand, what if you are about to install an app that modifies your phone’s lock screen and that app requires access to calling functions that may cost you money? You should immediately be wary, shouldn’t you?
For instance, we have in Android Play Store, an app known as Espier Launcher, which has two versions—2.0 and 4.0 plus. The version 2.0 is a free app that modifies the interface of your Android phone to suit iOS style. 4.0 is a paid upgrade to the launcher. I believe I must be missing something, but if you look closely at the app permissions, you will notice the free edition requires a lot of permissions, such as calling functions, personal information, location information, etc. On the other hand, the pro edition doesn’t require any special permission.
Many out there believe the app is legitimate and I have no reason to suspect why not, although it is disturbing to know several of such apps demand quite a bit of unnecessary permissions. If you allow such app installs, it will be like advertising your SSN on a TV show.
Before you install an app from even the most trusted app store, take some precautions. Do not install apps from unknown providers even if they are free. Take a deep look at the app’s permission details to know what it can do on your phone. Understand the various security issues related to the installation. Keep your smartphone always secure with a very good security app, none of these.
[Image source: tested.com]
Here is the detailed PDF of the study. The important thing about this study is that these forty-one apps have been downloaded over 185 million times, and they are among the top rated free apps available in the Android market. The apps have since been pulled.
As of yesterday, Android market, the Google Play store, has 618,751 apps in total. Over 77 per cent of them are free apps, and they enjoy enormous number of downloads.
Google has its store secured with proper security measures. It was in February last year that Google introduced a malware detection system to the Play Store, known as Bouncer. In June last year, a security company called Duo Security has shown us how it can circumvent the Bouncer. Here’s a video by Dr. Oberheide of Duo Security that I found:
It was a little bit technical for most of us. Still, that clearly shows us one thing: that Google’s Bouncer can also not completely prevent malware on the store. The detailed report given at SummerCon he was talking about in the video is here. The study by researchers in the German universities I mentioned earlier corroborates this fact. How, then can you really be secure with your app downloads? Here’s how.
Know the App’s Permission Settings
Every app you download on Play Store has its own requirements. It needs some information and permissions from your smartphone in order to operate. If you are visiting the app’s page on Google Play, you can see a tab that says Permissions, where you will see all the details about what the app can and can’t do once installed. When you are installing an app, it will give you notification on your device about various permissions.
Here, we have the details about various permission types in Android Play Store.
1. Services That Cost You Money
You should be extremely careful if the app can take advantage of services that cost you money. This will be explicitly stated in the Permissions tab. With this particular warning, you should understand that the app is capable of using important phone functions, such as texting and calling someone.
This function can be used by a malware to actually make phone calls to premium telephone numbers and charge you for that. Read this infographic about various security threats.
2. Network Communication
If the app contains a malware, it can easily contact its vendor to send information across to him. Even if the app doesn’t include a malware during the initial download, it can update online to gather a malware component from a remote server through this permission.
3. Your Messages and Phone Calls
This permission is slightly different from the first one we mentioned. This doesn’t let the app make a call or send a text message, but it gives the app permission to access phone records, know whether a call is coming or not, and read your incoming SMS.
A malware working inside the app could send this type of information across to the vendor, thereby compromising your security.
4. Location Information
With this permission, the app can read your location using either just the GPS or both GPS and the network. If it has network access, extremely precise location info can be identified by the app.
If the app has a malware inside, it can illegally send across your location to a bad guy, who can easily stalk you.
5. Personal Information
With this permission, the app can easily read various confidential information you store on your smartphone—contact list, calendar entries, browser bookmarks and history.
It doesn’t matter whether you have security settings cited within these details; the app will still be able to share all these details with the real world. A malware can easily take advantage of this. This is one of the most common ways your personal information gets stolen.
6. System Tools
This particular permission allows the app, system-level access. It enables the app to do such things as closing other apps, setting and changing system time, changing Wi-Fi settings, automatically starting at boot, etc.
As you can see, a malware can easily deploy these functions to do something like a Denial of Service (DoS) attack.
7. Storage
If your phone has extended storage in the form of USB OTG or MicroSD, this permission will let the app write data into it. Simply put, the app can store or delete whatever into the MicroSD card.A malware-affected app, thus, can immediately delete the contents of the MicroSD card or create a copy of itself within the card, which will spread the infection to other devices if you use the card on them.
Protect Your Phone From Malware
Looking at these app permissions doesn’t give any comfort, does it? It is disturbing to know that most of the apps (paid and free) in the app store require most of these permissions. You should be able to make out why a particular app requires a particular function.
For instance, imagine you are installing a legitimate antivirus app. The app most probably requires permission to read through your text messages. It is probably benign as an antivirus app should be capable of scanning incoming messages. In the same way, if you are installing an image editing tool, it may require disk access to read and write data into it. This should be benign as well.
On the other hand, what if you are about to install an app that modifies your phone’s lock screen and that app requires access to calling functions that may cost you money? You should immediately be wary, shouldn’t you?
Many out there believe the app is legitimate and I have no reason to suspect why not, although it is disturbing to know several of such apps demand quite a bit of unnecessary permissions. If you allow such app installs, it will be like advertising your SSN on a TV show.
Conclusion
Before you install an app from even the most trusted app store, take some precautions. Do not install apps from unknown providers even if they are free. Take a deep look at the app’s permission details to know what it can do on your phone. Understand the various security issues related to the installation. Keep your smartphone always secure with a very good security app, none of these.
[Image source: tested.com]