The Anti-virus Times

Wednesday, July 20, 2016

Android is an open-source platform which means that any developer can design applications for it. As a result, programs for various Android versions number in the hundreds of thousands. How can a user decide if they need a certain application? After all, one can't test all of them!

1. Reading user reviews in the store and on forums prior to installation is one of the common recommendations made for solving this problem. A high user rating and lots of downloads are supposed to indicate that an application is useful and user-friendly. And, for some reason, secure, too. But that’s not true!

   Malicious applications uploaded by attackers onto Google Play have been downloaded many thousands of times!

   Find out more in the Anti-virus Times issues Never trust, always verify! and lves in sheep’s clothing lurk in stores.

2. It is also recommended to check the application developer's or the publisher’s official site. Of course, the developer's site will be a more reliable source of information than user reviews, but here criminals have found a way around that, too. Now they are increasingly more often distributing malicious code with legitimate programs. For example, they embed malicious features into harmless applications or create malicious plug-ins for legitimate programs.
3. Checking an application's permissions (listed in the manifest file), which are displayed prior to its installation, is another security tip for vigilant users. The user can't grant permission for some things and not for others. If an application appears suspicious, all the user can do is reject it.

Unfortunately, many users tap OK and proceed with an installation without thinking about why the application is requesting access to certain features. Although, naturally, one might wonder: Why does a calculator or a torch app need to make outgoing calls or send SMS messages, or be able to access the camera and take photos? But sometimes developers add certain unnecessary features to a product “just in case”. So this doesn't necessarily mean that a program is malicious—it’s just what the developer decided, and the program may never need the feature that is listed in the program requirements.

It's really hard to determine whether good reasons or malicious intent are behind a permission request.

So is there a way?