F-Secure: Android Accounted For 97% of All Mobile Malware In 2013 193
An anonymous reader writes "Back in 2012, Android accounted for 79 percent of all mobile malware. Last year, that number ballooned even further to 97 percent. Both those data points come from security firm F-Secure, which today released its 40-page Threat Report for the second half of 2013. More specifically, Android malware rose from 238 threats in 2012 to 804 new families and variants in 2013. Apart from Symbian, F-Secure found no new threats for other mobile platforms last year."
welcome to the big time (Score:5, Insightful)
Linux is secure, right? Isn't Android Linux?
This is what you get running unsigned code from anywhere people! The last 30+ years of malware on Amiga, DOS, Windows, Unix, Linux, etc. should be a lesson. Trust code to execute by default and this is what you get. Rely entirely on the end user to determine whether or not code is legitimate, and this is what you get.
The average Joe is not capable of making that decision. Sure, it sucks, but them's the breaks.
Re: (Score:2)
Security is the minimum of "how secure the system can be" and "how secure the user can be". Not the average of them. The minimum. The most secure system is worthless if a user allows any kind of code to run. Likewise is the best security professional without a chance when facing an inherently insecure system.
The only way to avoid this is to go the Apple way: Simply taking the choice out of the user's hand. You may only run what we deem ok.
There is no "right" or "wrong" in this. If you want to have control
Re:welcome to the big time (Score:5, Insightful)
Re: (Score:2)
If you can make a computer so simple even an idiot can use it, only an idiot will want to.
How do you know that? I use many things that even an idiot can use, and still find them useful even when I'm not a complete idiot myself.*
*) Some people may disagree.
Re: (Score:2)
Nail, head hit. There are two choices:
1: Buy a device that disallows access to the user for anything except inputting a credit card number and buying apps through only specific channels. Access to the hardware will never happen. Take iOS: A user can't footshoot themselves, but neither can they use their device other than the way Tim or the late Steve wants them to. Want to run a Wi-Fi signal scanner or some specialty software... heck, even a Bitcoin wallet? You can play the jailbreak game, but with A
Re: (Score:2)
Re: (Score:2)
The dancing rabbits problem will be a constant plague, unfortunately. It is a choice of lesser evils... allow users to have full access to their device and even with all the warnings, give them the ability to auto-footshoot, or take everything away and have everything happening on a device be at the whim of whatever corporate marketing drones are in charge.
This is the same problem with desktop machines. Do we want full control of our machines, or do we want to cede all authority to a third party who promi
Re: (Score:2)
Having just turned off security briefly to install flash for a specific application I can tell you that in order to do it, you have to go into security and select the ability to do so. When you do it pops up a message that basically says "By doing this if you totally screw up your device you know it is totally your fault right, and don't come to us all whiny about it. You sure you want to proceed?"
If you aren't comfortable with that, click no.
That said, it isn't something that I would get into a habit of do
Re: (Score:3)
It's not proof that Apple's iOS or MacOS or Windows mobile are intrinsically more secure, but that they're smaller targets. How much malware is there directed to FreeBSD or OpenBSD or vxWorks in comparison? Emphasis on comparison - sure, there's malware directed at anything which might be Internet facin
I've heard this before... (Score:2)
...the old Windows meme submerging the fact that Windows really was a piece of swiss cheese.
Re: (Score:3)
Re: (Score:2)
It comes down to: would you rather have Security, or Freedom?
They aren't absolutes. You never have 100% security or 100% freedom and most people would rather a device that can only access a particular app store (Apple's or Google's) as the tradeoff is a much lower security risk (see TFA which states that only 0.1% of the malware is in Google Play). It isn't a case of "you use an iPhone and they took away your freedom!", that's just rubbish fear-mongering, nothing was taken away at all, you have just chosen a device that has certain particular limitations. For some re
Re: (Score:2)
Have you never asked yourself why Android is getting all of these attacks, but you rarely (if ever) hear anything about Debian/Ubuntu/Red Hat/Arch/Slackware/whatever distro suffering the same fate? Are they not Linux OS's, too? In fact, I think it's Dalvik that's getting exploited rather than the kernel itself; I could be wrong but that's pretty much the biggest difference I see between the vanilla-variety distro and Android. I will admit that your point about running strange code from untrusted sources is
Re: (Score:3)
No, it's the user who is getting exploited. And that's the point: the average end user (and in the case of more advanced malware, the average technical user, or in fact anyone who hasn't been able to audit the application source code) is vulnerable to this sort of malware.
Using an app store plus code-signing enables a trusted third party to audit the code, and sign it as approved to run on the device. In the case of appliances like phones, tablets, etc., expecting your typical non-technical user to au
Re: (Score:2, Insightful)
Re:welcome to the big time (Score:4, Insightful)
If you rebuilt a compromised host due to somebody leveraging a bug in sendmail, then the admin is/was a moron. Processes should not be run with root privileges, and any public-facing system should be configured in such a way as to limit the damage that can be caused by compromised service accounts. See: PEBKAC; ID10T error.
Yeah, good thing there aren't any privilege escalation bugs in the Linux kernel. Ever.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
You completely missed my point. The entire point is that relying on the end user, who has no access to to the source code to verify the operation of the app they are about to install, and no way to verify whether or not the code that was published has been altered, to verify whether or not they want to run it is inherently flawed.
Its easy enough to run anything you want on iOS - get your own cert, and compile/sign it yourself. Doing that DOESN'T open you up to any and all possibly dodgy code running on
Re: (Score:2)
Also. You are arguing that trojans are NOT malware? Seriously? Of course they're fucking trojans. That's the point. The end user is in no way qualified to determine that software is NOT a trojan, and this is why them having root on a device with full ability to run any shitware trojan they like is never going to work. WE've had 30 years hammering this point home time and time again. It's not going to change.
People have unprotected sex with strangers they just met 3 hours ago. This isn't some kind of virtual virus that would crash their damn phone, this is a risk of an actual virus that can take their life.
And yet STDs run rampant in our society. HPV is worse than we ever imagined.
Until you can change the mentality towards actual virus infections, don't expect people to act any smarter about virtual ones. People demand these features on their phones. It will only change when the majority are tired of it.
Re: (Score:2)
Right, people won't change. That's the argument for curated app stores. Have qualified people look at the software first to weed out the malware. And in the worst case where malware slips past, and makes it into the store, once one person finds it and reports it, it's removed from download to everyone.
It's no coincidence that 97% of mobile malware in the last year was on Android, and there was zero on iOS.
Apple have solved this problem. Google can't now - the cat's already out of the bag for Android.
Re:welcome to the big time (Score:5, Insightful)
Android has problems with it's "app store".
RTFA (I know, I know, new here and whatnot):
The title of the article is "F-Secure: Android accounted for 97% of all mobile malware in 2013, but only 0.1% of those were on Google Play".
Essentially all of the Android malware comes from non-Google app stores, or sideloaded APKs. And with respect to the malware that does manage to make it into the Play Store, F-Secure says "the Play Store is most likely to promptly remove nefarious applications, so malware encountered there tends to have a short shelf life.”
Re: (Score:2)
Re: (Score:2)
This is why I wanted to see the story posted. There is no significant risk as long as you use a trustworthy app store.
It is not possible to check every application to see if it is harmless or not. Nobody has those kinds of resources.
knew there were people to come to complain that Linux/Android was insecure and they needed a good correcting. Thanks.
I think it is 100% accurate to say Android is insecure by design in much the same way DOS era Windows file sharing is 100% insecure by design.
Android is intended for a mass market audience of people who know nothing about computers or software threats... Knowing this the designers decided the only access controls would be take it or leave it DEMANDS made by APPLICATIONS. This is why Android i
Re:welcome to the big time (Score:4, Interesting)
It is not possible to check every application to see if it is harmless or not. Nobody has those kinds of resources.
You do know we're talking about Google, right? Why would Google not have those kinds of resources? They scan the Internet every day, upload an hour of video every second, filter spam for hundreds of millions - better than anybody, and they made Android so they have the inside track on detecting undesirable code.
I think it is 100% accurate to say Android is insecure by design in much the same way DOS era Windows file sharing is 100% insecure by design.
These two things are unrelated. Now you seem to be saying you're complaining about Android security because others complain about the security of your preferred system. That is not relevant. Also, it's a confession that your argument lacks merit. Maybe not the direction you wanted to go.
Android is intended for a mass market audience of people who know nothing about computers or software threats... Knowing this the designers decided the only access controls would be take it or leave it DEMANDS made by APPLICATIONS. This is why Android is insecure by design... it totally and utterly fails to protect the USER in the most basic rudimentary way possible.
Now we are talking about a totally different thing - apps which require excessive permissions. As in, the end user gets to decide how much access he is willing to give each application. This is not malware at all and off topic for the discussion, but let's cover it. This is restraining applications that want to be more than the end user wants them to be, giving the end user full disclosure when an update seeks to do things it didn't do before. You make it sound like a bad thing, when in fact it's an enhancement above the other methods of application security provided by the system that empowers the user to be more restrictive than any algorithm could appropriately be. You make it sound like a bad thing. It's not.
Re: (Score:2)
You do know we're talking about Google, right? Why would Google not have those kinds of resources?
Nobody does, humanity lacks the tools necessary to accomplish this feat in general purpose software.
They scan the Internet every day, upload an hour of video every second, filter spam for hundreds of millions - better than anybody, and they made Android so they have the inside track on detecting undesirable code.
Then why has Google not used this mythical capability to plug all the security leaks in their own Android operating system? A quick search shows hundreds of documented failures.
http://web.nvd.nist.gov/ [nist.gov]
Even my Google search results - the core competency that makes google google still contain as much useless garbage spam as ever.
These two things are unrelated.
Try explaining this to victims of a premium SMS scam.
Now you seem to be saying you're complaining about Android security because others complain about the security of your preferred system.
I think all of the major mob
Re: (Score:2)
It is not possible to check every application to see if it is harmless or not. Nobody has those kinds of resources.
And yet the report says that there was zero malware discovered on iOS last year. It seems Apple know something you don't.
Re: (Score:2)
Except well, for some markets, like say, China, the only app stores available are third party ones with questionable trust values.
And that checkbox is useless because there are perfe
Re: (Score:2)
Re: (Score:3)
On the other hand, Android has problems with "signed code". Yes. That's right. Android has problems with it's "app store". This isn't your grandfather's Windows style malware.
Read TFA:
"Android accounted for 97% of all mobile malware in 2013, but only 0.1% of those were on Google Play"
Re: (Score:2)
What kind of crack are you on?
Unix and Linux have no malware to speak of and they are completley open platforms.
AKA the Voldemort solution to malware. If we don't mention it, it doesn't exist.
Re: (Score:2)
Since everyone says that only stupid people use iPhones
No. Everyone does not say that. In fact, a lot of Android users don't really care much one way or the other about iPhones.
Personally, I am disappointed in iOS but I certainly don't care about it enough to consider iOS/Android to be a glorious battle of the righteous. They're just two phone operating systems and I prefer Android. Can't we keep it that simple?
Re: (Score:2)
Re: (Score:2)
android was never meant to be highly secure (Score:1, Flamebait)
think of why it exists: it gets google your eyeballs and your time. with that, they are wildly successful.
beyond that, they could give a flying fuck. seriously. they don't exist for user experience, safety, privacy (ha!) or quality. as long as its 'good enough' to keep eyeballs glued there, that's all they care about.
I can't wait for a true '3rd option' (not apple and not android) to come on the market. I don't enjoy or trust either of the two existing choices.
Re: (Score:3)
I can't wait for a true '3rd option' (not apple and not android) to come on the market. I don't enjoy or trust either of the two existing choices.
What, WindowsPhone isn't good enough to qualify as that "3rd option"? Seriously, you can still get a blackberry, WinPhone or just a plain ol dumb phone that tethers really well (my TMO plan has free tethering) and run an iPod touch or equivalent.
Re: (Score:2)
What dumb phone provides tethering?
Re: (Score:2)
Who pays for the "privilege" of doing something the device is already entirely capable of doing? I sure as hell don't.
Re: (Score:2)
I am aghast at the notion that there's a country where it does cost money. It's simply unconscionable.
Re: (Score:2)
What dumb phone provides tethering?
I haven't been paying attention to the current crop of dumb phones, but back when I was using them, it was pretty much a standard feature. E.g., Nokia 8290 [wikipedia.org] had a v.32 modem and an IR port, and IR was pretty common on laptops of the day. Point the two at each other, and you can start a PPP connection to your dialup ISP. Then when GPRS data became popular, I had a Siemens M46 [phonescoop.com], which didn't have an IR port, but if you got the data cable, you could plug it into a serial port and tether by setting up a PPP conne
Re: (Score:2)
There's.... Windows :D
Ironically, I would wager Windows mobile is probably the most secure of the mobile platforms at the moment.
Re:android was never meant to be highly secure (Score:5, Funny)
True, leaving the device powered off permanently in its shrinkwrap on a store shelf does make it rather secure.
Re: (Score:2)
saw that coming (Score:1, Interesting)
Google Made a Core Mistake with "OPEN" (Score:4, Insightful)
It sounds nice in the hacker world, but in the hands of the 'average Joe', an "Open Handset" is an invitation to have your bank account stolen.
Re: (Score:2)
welcome to management, here's a nice gold watch.
You're obviously an impostor, otherwise you would know that the watches are made from platinum, dolphin leather, and powered by the tears of the poor.
We're number one! (Score:1)
But seriously, malware tends to target the top player in the market (by numbers). Nothing really to see here.
Re:We're number one! (Score:5, Insightful)
Re:We're number one! (Score:4, Funny)
Obviously, the malware is so well written that nobody has found it yet.
Re: (Score:1)
The Craftsman/Craftstress behind either shenanigan will not be needing to work, then, unless they get nicked.
Re: (Score:1)
Then explain the lack of similar quantities of malware for iOS between 2007 and 2012?
It's for the same reason that the murder rate inside Disney World is very low.
Re: (Score:2)
I dunno, there are now some Jar-Jar mascots
Re: (Score:2)
It's for the same reason that the murder rate inside Disney World is very low.
Security. Yes, that's it exactly.
Re:We're number one! (Score:5, Insightful)
explain the lack of similar quantities of malware for iOS between 2007 and 2012?
Because of Apple's "walled garden". The only way to get apps for iOS is from Apple's store, and Apple tries to keep the malware out.
Apple always charges $100 to put an app in the store, so malware has to make at least $100 before it is discovered or the person who put the malware on the store loses money.
The "walled garden" does have advantages.
Personally, I like having a device where I can install anything I want... but I pretty much just get stuff from the Google Play store. If I need an SSH app, and I see one with over 30,000 votes rating it 4 or 5 stars, I'm pretty sure it won't be malware when I download it.
And according to TFA, almost all of the malware was side-loaded. Almost none of the malware came from the Google Play store. Thus, Android gives me the advantage of the walled garden, while still being more free than iOS.
P.S. The reason I went with Android rather than iOS was Apple's policy of no interpreters and no emulators. I wanted Python and games emulators. Apple has since then unbent a bit, but Android has always allowed you to install whatever sorts of apps you prefer.
Thus I am able to install interpreters and emulators, without rooting my phone, and getting them from the Google Play store. Why wouldn't I want this?
Re: (Score:2)
Is it $100 each time, or is that $100 for the development kit?
Re: (Score:2)
Re: (Score:2)
Of course if any malware is discovered, that developer account is closed, with no refund, and no chance of reopening with the same credit card/mail address etc. And the possibility of a police investigation.
So yes, the is more of a discouragement than for the ordinary developer.
Re: (Score:2)
"You run OS X?"
Yeah, your brother's sister's hairdresser had all this malware -- and of course all those security firms who present dire warnings every week in order to drum up business.
Did "You" actually have malware that effectively exploited your machine? Or are you just here to add balance because you've "heard" rumors? What was the name of this malware -- what did it do? How did it exploit the system?
There are problems and benefits of all kinds of systems -- but what we don't need is people throwing ar
Re: (Score:2)
Yes.
That's your inference, that is not backed up by any real world data. The iOS market is large and was previously larger than the android market. In terms of web usage stats, iOS leaves android for dead. So one would
Re: (Score:2)
Re: (Score:2)
Nobody needs to write malware when you're accepting any cert from any server. You can do it all server side.
Simply solution (Score:1)
By default most Android phones (which today means made by Samsung) will not install anything from outside the Google Play store, and in the case of only Samsung phones outside the Google Play store and the Samsung store. Most users do not adjust this setting, so virtually nobody is susceptible to this malware. F-Secure is making mountains out of molehills.
If you don't use a Samsung Android phone, I commend your spirit of adventure. It's not worth the hassle for me. There's where you start becoming susceptib
Moral of the story: (Score:5, Insightful)
At the very bottom of the list was Google Play itself, with the lowest percentage of malware in the gathered samples: 0.1 percent. F-Secure also noted that “the Play Store is most likely to promptly remove nefarious applications, so malware encountered there tends to have a short shelf life.” While that’s great news for most Android users, it
Why would anybody shop for apps on their android phone/tablet like a crack addict looking for their next hit is beyond me. Are people really that naive?
Re: (Score:2)
That may be true in the US, but i've heard from friends overseas that other markets prefer their own stores, like a Chinese phone will have a custom rom and local app store, of which the legitimacy of the apps may come into question.
Left out a key piece of the original headline (Score:5, Insightful)
"...but only 0.1% of those were on Google Play"
So that vast majority is practically all third-party installations (something which isn't even an option on iOS).
Re:Left out a key piece of the original headline (Score:5, Insightful)
The ability is off by default, you have to go pretty deep in the options to turn it on, when you do turn it on, you get all sorts of warning telling you to watch out. And if you do turn it on and do something stupid, you may get malware
That's leagues better than not having the option at all (or to have to use what basically amount to root exploits to enable it), as well as better than having the option on by default for everyone.
There's some collateral damage (the cheap bozos who wants to save 5 bucks and get owned in the process), but its worth it.
Re: (Score:2)
The ability is off by default, you have to go pretty deep in the options to turn it on, when you do turn it on, you get all sorts of warning telling you to watch out. And if you do turn it on and do something stupid, you may get malware
Alright so Joe Smith goes and installs an app requiring access to SMS, dialer, contact lists, phone number, network stack and file system. Most apps ask for everything as a matter of course and no user has any idea why. Seems like more than enough access to fuck over Joe Smith to me... what about you?
http://xkcd.com/1200/ [xkcd.com]
Re: (Score:3)
While that's obviously a problem, it isn't what the article is about, and is not at all what i was replying to.
Re:Left out a key piece of the original headline (Score:4, Insightful)
...(something which isn't even an option on iOS).
Wait. You just acknowledge that the VAST majority of malware comes from sideloaded apps and then make a snide comment about iOS because sideloading malware-laden apps isn't an option.
REALLY??
Only on Slashdot is the inability to load malware-riddled apps on your phone viewed as a negative...
Because it is negative. Just like a car limited to 30 km/h is negative, even if it prevents accidents. You know, with a real car you have the option of staying under 30 km/h if you want to. And with Android you have the walled garden option if you want to. Just don't activate the sideload option. If you are too stupid to activate it and you get malware, you have earned it.
Re: (Score:3)
Yes, on Slashdot, the majority of users promote the idea of unfettered access to their systems, coupled with education so you know what to do with it. Seems pretty consistent to me.
My kids have android tablets, I pointed out the feature to them, told them not to use it unless they had a good reason to, and to talk to me first. As their education improves, I expect them to ask me less. So far, the only sideloaded app they have is flash player. It's from the adobe site so I don't think it counts as malwar
Re: (Score:3)
THREATS are not attacks. It's not possible to install sideloads on iOS, that doesn't make it more secure, that makes it suck. It's like saying your house is better because you don't have doors. Fine, it's harder for people to get in. I can lock my doors or I can choose not to, that's up to me. But you don't even have an option. This is the same bullshit walled garden crap that Apples been spewing since the 80s.
google play .. (Score:1, Interesting)
That is beyond my understanding
Re: (Score:3)
Re: (Score:2)
why does an app ( from google play) which just produces fart sounds ( just like 80% of the other apps) want permissions to access my browser bookmarks , call information, data store and what not .
Yes, it seems like every single app now needs full control of our lives. I'm not happy about granting such sweeping powers where they are clearly unnecessary.
Except the apps from f-droid, for some dumb reason open source apps tend not to overreach on permissions and snooping.
Oh, but I guess now we can assume those are 33% malware since it's not the play store.
Is there a android malware scanner for the PC (Score:2)
It's possible to download Android apk's at developers sites as well as other places,
be nice to scan them for malware before transferring/installing them to the Android.
An example is AdAway which I assume is safe from malware, you can't download this from play.google.com
https://f-droid.org/repository... [f-droid.org]
I've Googled this query and have gotten no results, figure I'd hit on a geek :}
Re: (Score:2)
Most of the big-name AV companies have a free(ish) client for Android, but it just runs hashes against lists of known-bad executables. Nothing I've seen does actual content scans against a signature DB, presumably due to the resource demands.
Sigh... Thank you.
The only "open" platform left... (Score:2)
As others have said, the walled gardens are *EXTREMELY* safe. iOS App Store and Google Play are both *VERY* safe.
Jailbroken iPhones are targets, but most people concerned with open platforms are on Android - and sadly Google has gotten people used to "going off-reservation" for some apps. (Is Kindle Market available to install direct from Google Play yet? Or do you still need to root and side-load?)
Symbian is effectively dead (the former leader of malware,) and Palm is all but buried at this point. Not su
The actual report (Score:2)
http://www.f-secure.com/static... [f-secure.com]
The content of interest here starts on page 22.
It'd be nice if TFA actually included a link. Or even cited the fucking source of the graphics they lifted.
what other? (Score:2)
Not surprising (Score:2)
That isn't to say there are some very obvious things that Android
Re:Is this like that old study of Linux malware? (Score:4, Informative)
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
Isn't the entire selling point of android that you can install software from wherever you like though?
Well, one of several selling points.
This study simply validates apples decision to more strictly control what software is allowed on their devices.
97% of all murders happen in societies that don't put all their citizens in cages. Does that validate the idea that everyone should live in a cage?
For those users who do need to install anything they like, they can still do it without compromising the security
Re: (Score:1)
And even on android its a small problem... if you have a million iphones and a million androids, and of them 3 iphones have malware, and 97 androids have malware, that's still 97% of malware is on android -- but its still a very minor problem, that only affects people who do REALLY stupid things.
I think you missed the part of the original posting where the 3% of the non-Android malware referred to Symbian. There were no instances of malware on iOS.
Open Source? (Score:2)
Maybe I'm conflating several notions from your post, but I get the distinct feeling you liken Apple products as being in a cage. I can tell you it's more like being in Club Med with hot cocktail waitresses and sunny days with the chain link fence holding back hordes of lepers.
This entire decade, all I've heard was how fully vetted open source gave you freedom and security at the same time. Write all the code you want and run it everywhere. Safely. Freely.
The GnuTLS Library bug tells me it's all been BS. To
Re: (Score:2)
I can tell you it's more like being in Club Med with hot cocktail waitresses and sunny days with the chain link fence holding back hordes of lepers.
I have a macbook pro, and my previous phone was an iphone. I know exactly what its like. OSX isn't bad at all, ios *is* a cage; and its all fun and games until you run into something apple doesn't want you to have. Then it gets ugly.
The GnuTLS Library bug tells me it's all been BS
It should tell you the process works.
To that end, why should I trust any random de
Re: (Score:2)
Fair enough... but nobody "found" the GnuTLS bug until the effects of it became apparent. Then the Open Source community started looking for it. That's what runs counter to the claim of "many eyes on the code makes security". Nobody was really looking and nobody noticed that some random cert could be reported as trusted for almost ten years. It's just a truth even I've advertised about Linux until I find the truth has been shattered.
Ignorance isn't blissful at all and this very thing is the weakness of clos
Re: (Score:2)
Apple knows they're not allowing the Dancing Pigs into the iOS spectrum and with that comes restrictions which will frustrate some people. They don't advertise anything different from that. So far, they've made 800 million iOS customers really happy at the expense of maybe 100,000 code monkeys.
The point remains that Apple could have allow the option of leaving the walled garden, and 800 million people would still be just as safe as long as they didn't leave, and they wouldn't leave.
Android allows you to le
Re: (Score:2)
hen you buy a humblebundle that has iOS (or if you buy... from pretty much anyone something on iOS outside the app store) you are sent a redemption key. Nothing evil or different has changed.
This is factually incorrect. Apple does not allow you to sell a product for the apple store outside of the apple store, and then provide a redemption key.
The humblebundle does not do this, and would not be allowed to do this.
As for FSF/GPL. That's a political organization akin to NSA/GunRights.
Nutter.
Re: (Score:2)
Well sort of. If you restrict yourself to Google's Play store for software the rate was .1%. The rest, almost all of it in this case, came from other stores for Android software. Mostly Saudi Arabia and India. So it would be nice if Android were more interested in security, but on the other hand it isn't the huge dramatic result that would warrant the headline. Stay with Google Play and things are pretty safe.
Trusting security to app store screeners is not a viable solution. Either devices are designed to tolerate the most malicious software possible by default or they end up accounting for 97% of all mobile malware.
Even if there were no platform security vulnerabilities and the system worked 100% as intended I would not expect much to change. The core problem with Android is applications dictate privileges to the user in a take it or leave it manner rather than users having any ability to make decisions based
Re: (Score:2)
Clickbait post, shame on /. (Score:5, Informative)
To the "anonymous reader" who posted the main article : If you link to TFA, at least post the less misleading title it used:
Makes a world of difference. And yes, shame on you.
Re: (Score:2)
Re: (Score:2)
I don't think that Hipster Joe and Facebook Sue can comprehend source code
Re: (Score:3)
0.1 % is not much, bu still stomething. It would be better if Google Play only allowed free software where the user could read the source code prior to installing, that way knowing that the software wa snot malicious; unlike non-free software which we know is malicious.
Do you realize that an app can realistically be tens of thousands lines of code? Good luck going through and fully understanding that before installing an app.
A better approach might be to have much more strict policies towards unnecessary permissions the apps are asking. If a fancy sound board app needs permissions to read your call data and have full access to Internet, Google should disapprove the application from the Play Store.
Re: (Score:2)
I still think Google needs two tiers. One tier in the store brutally curated with a very long agreement that a software vendor must agree to, and Google can refuse to approve anything it chooses to.
The second tier is as it is now -- upload anything, and obvious malware is tossed with the dev banned.
Then on devices, there is a checkbox similar to allowing sideloading to allow access to the more open tier.
This way, Joe Facebook by default is well protected from malware because they are tossed in a walled gar
Re: (Score:2)
So stop spreading FUD you idiot. I would accuse you of being a shill but given that it's free software you're just a butthurt religious zealot.
The angry blurb at the end of some AC comments is really a classic. I should start collecting these.
Re: (Score:2)
So let's not make a mountain out of a whorehill.
So Android has 97% of all mobile software written for it? 80%? Is it at least the platform where most of the mobile software appears first?