Anti-Virus for Android

**extorian** · 10-13-2010, 03:23 AM

But that assumes that people are talking about backgrounds (i.e. JPGs and PNGs) or similar non-executable files - they're not. I can make my apps (i.e. apps I've written) auto-run on installation easily. You just have a package_installed receiver. Any receiver that listens for the package_installed broadcast will be executed by Android whenever any package is installed. You then code the package_installed receiver to run the main app. I use this same method, but with a package_updated receiver, to restart my apps after they've been updated. So the act of simply downloading any app on Android could easily result in that app, and any malicious code it may contain, being executed without any further user intervention. The app could do pretty much anything it liked within the boundaries of its privileges. By privs I'm referring the ones you see when you install an app that warn you about what the app may be capable of doing. But that's no safety net either as all you need is the Full Internet Access priv and the app can download and modify its own code quite easily. Unfortunately this priv is easy to explain as any app that has adverts in it, or needs to upload highscores, etc would need it.

So - you now have a situation where any app that requires Full Internet Access can essentially do absolutely anything it likes on your phone that any app is capable of doing, just by downloading it. You don't even need to run it yourself.

The Background app referred to previously was an application, not a background, that allows you to browse and download backgrounds with specific themes. It was the first known app to exploit the Full Internet Access security hole which is why it got some notoriety.

**MrTylerGreen** · 10-16-2010, 09:09 AM

access to contact info is a different permission. most malware collects info for spam companies so phone numbers and email addresses are what they want. To this date I have yet to install an app that needed access to contact info. It was an excellent security design idea to include that as a permission. And the stuff about not getting it from mp3s and ring tones was more of a fun fact than a reason you don' need AV.

**extorian** · 10-16-2010, 10:19 AM

The point is though that there's a security hole in Android that allows any app with Full Internet Access to download new and different code to itself and run that code without ever needing any new permissions, even if the new code would normally need such permissions. The permissions are only EVER checked when you download the app through the Market (either originally or through an update). They are not checked if the app decides to modify itself.

Therefore, any app with Full Internet Access can potentially have all over permissions with you ever knowing about it.

**TheJuan** · 10-16-2010, 11:04 AM

Originally Posted by extorian

The point is though that there's a security hole in Android that allows any app with Full Internet Access to download new and different code to itself and run that code without ever needing any new permissions, even if the new code would normally need such permissions. The permissions are only EVER checked when you download the app through the Market (either originally or through an update). They are not checked if the app decides to modify itself.

Therefore, any app with Full Internet Access can potentially have all over permissions with you ever knowing about it.

Well..That sucks

Sent from my Nexus One using Android Community App

**extorian** · 10-16-2010, 11:10 AM

...and not only that... it's not just about contacts. Any app can read your SD card contents - you know where many apps store stuff like their twitter caches, email caches, people store pics of their girlfriends, etc. Full Internet Access could send the lot somewhere.

**asdfg** · 03-03-2011, 08:52 PM

anti virus is very much essential for android also.. now dr web is giving theie beta version of mobile security suite for free..
download it..
http://mobilerobo.blogspot.com/2011/...droid-for.html

**extorian** · 03-04-2011, 03:48 AM

...trying to find an AV product on Android that doesn't have a free version here

**jdstrydom** · 03-07-2011, 01:44 AM

installing droidwall from market goes a long way to stop apps from calling home. just define which apps are allowed to access internet via wireless / 3g

**androiddeveloper1987** · 12-22-2011, 02:43 PM

for linux even, its impossible to be completely virus proof.However, the OS design and structure does make it harder for
viruses to take a hold or exploite it. Also as linux is open source there are 100s and 1000s of eyes watching the distros and they can fix them in sometime, much quicker than windows actualy finds n fixes the loophole. So linux isnt virus free. Yet it is difficult for attackers to write virus for rather small community of linux users. Thats abt linux.