More than once and 10 times you will have heard of the supposed insecurity of Android. In fact, on this page and whoever writes these lines has written articles about the mobile operating system of Google has become, thanks to its global success, a preferred target for developers of malware. But to what extent is Android safe or insecure? Are we really exposed to cybercriminals or does it all respond to a conglomerate of interests of the competition and information security companies? If you think so, let's try to delve into the matter a bit.
Let's not be innocent Both software development companies and other companies that own their own operating system would be the main beneficiaries. in the case of spreading and even taking root the idea that Android It is unsafe. Some because they will manage to create a artificial demand for their products that, otherwise, would not be produced, while the others could fish in troubled waters those fish – users – more given to the conspiracy and that they flee from the supposed helplessness in which they were in the operating system of Google.
On the other hand, we must also admit that, until relatively recently, those in Mountain View lacked a reasonably reliable way of determine the extent of the problem, that is, how serious the insecurity in its operating system could become.
The security of the installation of applications in Android
Well, according to the presentation by Android Security Chief Adrian Ludwig, whose images you can see illustrating this article, it is estimated that less than 0,001% of app installations are able to evade the OS's defense system, which is made up of different layers, including the app's own verification system, trusted sources, runtime defenses, etc. The figure provided by Ludwig corresponds to apps installed through Google Play, as well as the 1.500 billion installations made through other means other than the American giant's online store.
From this data, somewhat more precise information can be extracted, such as, for example, in installations outside of Google Play, 0,5% are flagged as suspicious by the app verification system. Of that percentage, less than 0,13% are installed by the user and less than 0,001% Of these, they manage to bypass Android's defenses while the app is running. However, Ludwig's presentation doesn't clarify the actual number of apps that are actually harmful.
In any case, 0,001 percent – or 1 in 100.000 – is a small enough number to be ignored. That said, it is not an absolute zero, but it is small enough to be considered a significant factor. general feeling So, when it comes to apps, Android is generally a secure operating system. However, we must remember that the source of the data is also a stakeholder, so we might want to stick with the middle term Between the feeling of absolute insecurity advocated by competitors and antivirus companies, and the near-total security that the Android Security Chief tries to sell us. Because, as Aristotle said: "Virtue lies in the middle ground..."
What kinds of apps set off the alarm?
Still, we should not disdain the information provided by Adrian Ludwig, far from it, so if we look back and look at what kind of applications are the ones that have triggered Android alarms the most times, we will see that in the 40% of the cases are 'fraud' or apps that register the user in Premium services and the like. Other 40% These are applications that could not be classified as potentially harmful, but not malicious in themselves – tools for rooting terminals and others of the like. Of the remaining 20 percent, a 15% is part of the so-called spyware commercial, which records things like user behavior on the Internet, while the 5% The remaining percentage is made up of applications that could be classified as truly malicious. In short, we're talking about five percent of the 0,001 percent of the total installed applications.
Signs of possible malware on your Android
Recognize in time the symptom helps to nip many problems in the bud:
- On the device: insistent alerts about infections, drop in performance, reboots or crashes, abnormal battery consumption, significant storage loss, or apps that you can't uninstall.
- In the browser: persistent pop-ups, new tabs that appear on their own, unwanted bars or extensions, changes to the home page or search engine without permission, redirects to unknown places.
- In your accounts: your contacts receive messages you didn't send or you see strange logins. It can also raise the data usage or your bill for unaccepted premium subscriptions.
Defense layers and features already included in Android
Android incorporates several barriers that work together to reduce risks:
- Google Play Protect: Check apps before downloading them and periodically analyzes the device. If it detects harmful behavior, it may warn you, disable or delete automatically the suspicious app.
- Privacy Alerts: It alerts you if an app can access personal data in a deceptive manner or in violation of policies.
- Resetting permissions due to inactivity: In certain versions, Android may revoke permissions from apps you haven't used in a while to protect your privacy.
- Analysis of apps outside of Play: If you install from unknown sources, you can activate Improve detection to submit those apps to Google and strengthen the analysis.
- Certification status: From Play Store > Settings > About you can check if your device is certified for Play ProtectIf you see the message “the device is not certified,” follow the wizard that appears to correct it.
Although these layers are effective, they are not infallibleIn independent testing, built-in filters may not detect all attempts to Phishing or all variants of malware, so it is advisable to combine these defenses with prudent usage habits.
How to reduce risk in everyday life
- Install only from official stores and check reviews, number of downloads and permitsBe wary of apps that ask for access they don't need (SMS, accessibility, notifications, camera, or microphone for no reason).
- Be wary of unexpected links via SMS, email, or instant messaging. If it's from your bank or a payment method, enter by typing the URL or using their official app.
- Keep everything updated: system, apps and browser with security patches assets. Turn on automatic updates whenever possible.
- Secure Wi-Fi and Browsing: Avoid unencrypted public networks and unsecured websites. Consider a trusted vpn if you access sensitive information on the go.
- Bluetooth with head: Turn it off in public places if you're not using it to avoid unwanted pairings.
- Locking and encryption: Set up PIN/password or biometrics. If your device allows it, enable it. storage encryption and “Find my device”.
- Beware of fake antivirus: Avoid “miracle tests.” If you want extra protection, turn to recognized suppliers and download from Play Store.
Common types of threats and their impact
- Banking Trojans: They look for credentials and financial theft, sometimes abusing Accessibility to overlay screens and intercept passwords.
- RAT (remote access): give control to the attacker, allow exfiltrate data, activate camera or microphone and execute actions.
- Droppers: They bypass controls and then unload the main malware for more targeted attacks.
- Bookmarks/SMSpremium: subscribe to paid services without consent, increasing the bill.
- Clickers and adware: They generate advertising fraud and saturate with ads, affecting performance and data.
- Ransomware: locks the device or encrypts files and demands payment.
- botnets: They recruit the mobile for DDoS or other illicit activities.
If you suspect infection: immediate actions
- Reboot into safe mode to disable third-party apps and gain control.
- Check and uninstall Unknown apps or apps that request unnecessary permissions. If any are marked as administrator, revoke that permission first.
- Skip Play Protect from Play Store > Play Protect and perform an on-demand scan.
- Clean the browser (clear cache and site data) if you see constant pop-ups or redirects.
- Change your Google password and critical accounts (banking, email) and activates the two step verification.
- Connect to a reliable network and avoid public networks while you resolve the incident.
- Last resource: Backup and factory reset. Restore only from clean copies so as not to reintroduce the problem.
Corporate environment and physical security
The mobile phone is already the main work tool and the BYOD model multiplies the attack surfaceIn companies it is advisable to combine MDM/EMM, security policies, encryption, least privileges, app control and awareness against Phishing. In addition, it prioritizes the physical securityFeatures like crash detection, emergency alerts, and location sharing with trusted contacts can make a difference, and they work alongside anti-malware layers for a more secure device all around.
Android has a mature security architecture and powerful tools like Play Protect, but the deciding factor remains the user behaviorBy installing from trusted sources, updating, limiting permissions, and reacting quickly to unusual signals, risk is drastically reduced without sacrificing the freedom that characterizes the ecosystem.
Source: Quartz Via: xda-developers.