News for hackers. Stuff that matters.

A comment on Two-thirds of all Android antivirus apps are frauds. Parent comment

Re:Two-thirds of all Android antivirus apps are frauds by ignoramous on Saturday March 16, 2019 @06:16PM (#19410721)
> As far as i can tell, traditional viruses, the way the work on windows and dos systems, just wouldn't work on android.

You might be interested in reading Google's guidelines on what they consider to be a "potentially harmful application" (PHA) [0].

> [..] anything you give specific access to system functions(like drawing over other apps) to, you have to go to a specific extra permission enabling screen full of warnings to enable it.

Oh despite the on-device on-use/first-use consent, the android app ecosystem was a big mess before Google started auto-detecting rouge apps and booting them out of play store.

Even today, despite GooglePlayProtect, I occasionally find my friends complaining about apps hijacking their phones to show ads and sometimes be very hard to dismiss, and they do not absolutely know what to do (disable/uninstall no longer used apps, revoke permissions, disable notifications). They'd install anti-viruses in hope that it would help fix that.

> how can an antivirus determine between something like that and something benign

Not sure what anti-viruses do, but some examples from Google's 2018 report on how they fished out PHAs using static/dynamic analysis of apks and machine learning [1]:

1. Re-packaged game apps with data-hoarding/adware.

2. Click-fraud apps (see above).

3. Suspension of key device functionality (on a rooted device, esp).

> It just seems like you'd have to be really fucking around, [..] to install a straight up virus on android.

You might be right: A good percentage of 2bn active android users might be doing just that.

--

[0] https://source.android.com/security/reports/Google_Android_S...

[1] https://security.googleblog.com/2019/01/pha-family-highlight...

[ Parent | on HN ]
Re:Two-thirds of all Android antivirus apps are frauds by pitaj on Saturday March 16, 2019 @07:35PM (#19411128)
But do apps from the play store have the system permissions to carry out those operations on other apps?

I don't think they do.

[ Parent | on HN ]
Re:Two-thirds of all Android antivirus apps are frauds by sonnyblarney on Sunday March 17, 2019 @12:36AM (#19412262)
To be specific, we're not talking about classical viruses here.

This is a different kind of malware.

Fortunately, you're probably not going to get 'infected' merely by being on the same network as someone with malware.

I think perhaps Google should take some API steps to help fix the problem. There are just some kinds of things that nary any app should be able to do anyhow.

[ Parent | on HN ]